Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-12-2021 17:08
General
-
Target
55e7693d5a0b716ad7ab1dcccc415f3f.exe
-
Size
2.7MB
-
MD5
55e7693d5a0b716ad7ab1dcccc415f3f
-
SHA1
191303ed147c489d4b81838d60f932bf6c16c521
-
SHA256
43177ddc1570d4f98b6dfcea2df466e25910143d37c1a006c85deafecf2ff200
-
SHA512
4927bb43bc86062951e209448eeb2841de0918aa548604f0f4549ca636015f48034e7253a1599cd7c178c39613d31417e5cd80f050fa0f90df9b451cfb6e3cb6
Malware Config
Extracted
cryptbot
daipey72.top
morboh07.top
Signatures
-
CryptBot
A C++ stealer distributed widely in bundle with other software.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55e7693d5a0b716ad7ab1dcccc415f3f.exe"C:\Users\Admin\AppData\Local\Temp\55e7693d5a0b716ad7ab1dcccc415f3f.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2416-115-0x0000000001310000-0x00000000019FD000-memory.dmpFilesize
6.9MB
-
memory/2416-116-0x0000000001310000-0x00000000019FD000-memory.dmpFilesize
6.9MB
-
memory/2416-117-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2416-118-0x0000000001310000-0x00000000019FD000-memory.dmpFilesize
6.9MB
-
memory/2416-119-0x0000000001310000-0x00000000019FD000-memory.dmpFilesize
6.9MB