Analysis
-
max time kernel
119s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12/02/2022, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe
Resource
win7-en-20211208
General
-
Target
36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe
-
Size
7.6MB
-
MD5
9e9b8e1845d216ee1504fa90ff6d5371
-
SHA1
911c96b3976e0846ff1f46ecd0f8c855405d81da
-
SHA256
36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95
-
SHA512
c93e7be4bcc63a5106b4fc1d951c4c63854c5a2ea7a2fa278f580d375c764569ca3d23033b6ba027aea16f14faeb78923d643a99b9599440226a4483755e1448
Malware Config
Extracted
cryptbot
tishun65.top
morvak06.top
-
payload_url
http://dankvu08.top/download.php?file=teamer.exe
Signatures
-
Deletes itself 1 IoCs
pid Process 1500 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1036 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 944 wrote to memory of 1500 944 36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe 27 PID 944 wrote to memory of 1500 944 36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe 27 PID 944 wrote to memory of 1500 944 36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe 27 PID 944 wrote to memory of 1500 944 36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe 27 PID 1500 wrote to memory of 1036 1500 cmd.exe 29 PID 1500 wrote to memory of 1036 1500 cmd.exe 29 PID 1500 wrote to memory of 1036 1500 cmd.exe 29 PID 1500 wrote to memory of 1036 1500 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe"C:\Users\Admin\AppData\Local\Temp\36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\vwGDQcpfcWjmo & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
PID:1036
-
-