Analysis
-
max time kernel
145s -
max time network
281s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
submitted
31-07-2022 08:50
General
-
Target
946a0aa660c43bb7e89ee62b4a214741ee6fa33c5d47cccde4842483d2e9e490.exe
-
Size
2.1MB
-
MD5
b663be6e34606bdcf6f9037c087149d2
-
SHA1
d54149390ba0b8c196772c2771a802bfaa980209
-
SHA256
946a0aa660c43bb7e89ee62b4a214741ee6fa33c5d47cccde4842483d2e9e490
-
SHA512
588e934a19f25ffee25ec2928332d2b575a02502e3f40414724e53bb0d414f0ad2affffec95929462b00bdbbd64332474c598ea88ac22a9d5bed0728629553f3
-
SSDEEP
49152:yURBz01OdeAF79Xc/599Dm1p8JTKHKS8Fjm:yURBzgan9XcR7D881S8F
Malware Config
Extracted
cryptbot
myy01.top
Signatures
-
CryptBot
A C++ stealer distributed widely in bundle with other software.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\946a0aa660c43bb7e89ee62b4a214741ee6fa33c5d47cccde4842483d2e9e490.exe"C:\Users\Admin\AppData\Local\Temp\946a0aa660c43bb7e89ee62b4a214741ee6fa33c5d47cccde4842483d2e9e490.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.8MB
-
Filesize
1.6MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
1.6MB