Analysis

  • max time kernel
    63s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12/02/2022, 08:41

General

  • Target

    36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe

  • Size

    7.6MB

  • MD5

    9e9b8e1845d216ee1504fa90ff6d5371

  • SHA1

    911c96b3976e0846ff1f46ecd0f8c855405d81da

  • SHA256

    36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95

  • SHA512

    c93e7be4bcc63a5106b4fc1d951c4c63854c5a2ea7a2fa278f580d375c764569ca3d23033b6ba027aea16f14faeb78923d643a99b9599440226a4483755e1448

Malware Config

Extracted

Family

cryptbot

C2

tishun65.top

morvak06.top

Attributes
  • payload_url

    http://dankvu08.top/download.php?file=teamer.exe

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • Drops file in Windows directory 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe
    "C:\Users\Admin\AppData\Local\Temp\36a91c2436063a936deafe03ce15685a4a952bc03d125fd4b79315a829d96c95.exe"
    1⤵
      PID:1464
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2328
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4464

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1464-133-0x0000000000438000-0x000000000043A000-memory.dmp

            Filesize

            8KB

          • memory/1464-134-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

            Filesize

            4KB

          • memory/1464-135-0x0000000002A00000-0x0000000002A48000-memory.dmp

            Filesize

            288KB

          • memory/2328-131-0x00000172E3740000-0x00000172E3750000-memory.dmp

            Filesize

            64KB

          • memory/2328-130-0x00000172E3520000-0x00000172E3530000-memory.dmp

            Filesize

            64KB

          • memory/2328-132-0x00000172E5C30000-0x00000172E5C34000-memory.dmp

            Filesize

            16KB