Analysis

  • max time kernel
    155s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25/06/2022, 09:45

General

  • Target

    76c9ea504ad7755830dea2cc444769c509fe85111ed23d93768883fe23b4a193.exe

  • Size

    4.2MB

  • MD5

    9b6bb16c4699b4af550f9420392b5524

  • SHA1

    7e33c896bb7a2a831ed95faee818523977ae2b8d

  • SHA256

    76c9ea504ad7755830dea2cc444769c509fe85111ed23d93768883fe23b4a193

  • SHA512

    8db363415b7eab22ae5752bc139c981ed036c778d4ad53e3e10755f658bb85f35039a8bfba1afbbe0a9da260e0d31d0f34e4251bc1f315d1b5f180ba3c4da597

Malware Config

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76c9ea504ad7755830dea2cc444769c509fe85111ed23d93768883fe23b4a193.exe
    "C:\Users\Admin\AppData\Local\Temp\76c9ea504ad7755830dea2cc444769c509fe85111ed23d93768883fe23b4a193.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Program Files (x86)\Busa\Setup.exe
      "C:\Program Files (x86)\Busa\Setup.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:3980
    • C:\Program Files (x86)\Busa\SetupX.exe
      "C:\Program Files (x86)\Busa\SetupX.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1420

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Busa\Setup.exe

    Filesize

    2.2MB

    MD5

    96f7de62cd081b662357e3617e0b3fd3

    SHA1

    611b41e93c3373469b872b309fe15f68927d7418

    SHA256

    e41202c14467ac53d72be5754802ce73a07c605c7159d4f65e0b9cda1e36a836

    SHA512

    aaee89a90b8b97bb16bbe1c1ef6ee2467f9c158d90d57fbda284259117aea2282788337ab88e2c081efe7bbce7845a72a3c43ffe73c057ebb9d287873932265c

  • C:\Program Files (x86)\Busa\Setup.exe

    Filesize

    2.2MB

    MD5

    96f7de62cd081b662357e3617e0b3fd3

    SHA1

    611b41e93c3373469b872b309fe15f68927d7418

    SHA256

    e41202c14467ac53d72be5754802ce73a07c605c7159d4f65e0b9cda1e36a836

    SHA512

    aaee89a90b8b97bb16bbe1c1ef6ee2467f9c158d90d57fbda284259117aea2282788337ab88e2c081efe7bbce7845a72a3c43ffe73c057ebb9d287873932265c

  • C:\Program Files (x86)\Busa\SetupX.exe

    Filesize

    2.1MB

    MD5

    8f3c4a9c8fefb93d54c2f8c2c34f6950

    SHA1

    9abd23d44a10989573f52170f9d8d099a7438dea

    SHA256

    b836fc72a895a97af35c1bcbfa07e077762179817832835ec7fffaaad8a8ec4c

    SHA512

    8677a05caddea2fa61d90f9820ae9832d620980088676e1d344d86443732aa448a7d251cd38a1799c238da44031b75742cca23daa38705ab1ae126b1f1b76d2b

  • C:\Users\Admin\AppData\Local\Temp\nsbCA3B.tmp\UAC.dll

    Filesize

    14KB

    MD5

    adb29e6b186daa765dc750128649b63d

    SHA1

    160cbdc4cb0ac2c142d361df138c537aa7e708c9

    SHA256

    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    SHA512

    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

  • memory/1420-141-0x0000000000400000-0x0000000000927000-memory.dmp

    Filesize

    5.2MB

  • memory/1420-147-0x0000000000400000-0x0000000000927000-memory.dmp

    Filesize

    5.2MB

  • memory/1420-145-0x0000000077020000-0x00000000771C3000-memory.dmp

    Filesize

    1.6MB

  • memory/1420-137-0x0000000000400000-0x0000000000927000-memory.dmp

    Filesize

    5.2MB

  • memory/1420-139-0x0000000077020000-0x00000000771C3000-memory.dmp

    Filesize

    1.6MB

  • memory/1420-143-0x0000000000400000-0x0000000000927000-memory.dmp

    Filesize

    5.2MB

  • memory/3980-138-0x0000000077020000-0x00000000771C3000-memory.dmp

    Filesize

    1.6MB

  • memory/3980-142-0x0000000000F30000-0x0000000001458000-memory.dmp

    Filesize

    5.2MB

  • memory/3980-140-0x0000000000F30000-0x0000000001458000-memory.dmp

    Filesize

    5.2MB

  • memory/3980-144-0x0000000077020000-0x00000000771C3000-memory.dmp

    Filesize

    1.6MB

  • memory/3980-136-0x0000000000F30000-0x0000000001458000-memory.dmp

    Filesize

    5.2MB

  • memory/3980-146-0x0000000000F30000-0x0000000001458000-memory.dmp

    Filesize

    5.2MB