Analysis
- max time kernel
90s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
13/10/2022, 11:00
Static task
static1
Behavioral task
behavioral1
Sample
8d854838208356a93256d723a35af478.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
General
- Target 8d854838208356a93256d723a35af478.exe
- Size 304.4MB
- Sample221013-m4ajcsbgar
- SHA256 9b6bca999c22441881b3c13fb886519a2a69e4c35092fe535b533d0d0cd350aa
- MD5 8d854838208356a93256d723a35af478
- SHA1 8255c40cc57af9f3bff8708b6c1f9ed3078b496c
- SHA512 fab23cc13e3fd8e636681b43fac1513f1181cd223914e79e7374149f4984c576c8b3f199d894b4c29d2ae4e8cd99aab614835351ff9f013f1dd48d65a540703a
- SSDEEP 98304:LahKoy5B3h1JzGP0hZsYA7DC6qmFfCVQ42+SMWNxJ7/nAT:qKp51JzcEq+6q8fCGnbP3JzAT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cryptbot
C2
-
[<
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4604 corsve.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 8d854838208356a93256d723a35af478.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 8d854838208356a93256d723a35af478.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\ProductId 8d854838208356a93256d723a35af478.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 8d854838208356a93256d723a35af478.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 8d854838208356a93256d723a35af478.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 8d854838208356a93256d723a35af478.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3632 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1304 timeout.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe 1732 8d854838208356a93256d723a35af478.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1092 1732 8d854838208356a93256d723a35af478.exe 84 PID 1732 wrote to memory of 1092 1732 8d854838208356a93256d723a35af478.exe 84 PID 1732 wrote to memory of 1092 1732 8d854838208356a93256d723a35af478.exe 84 PID 1092 wrote to memory of 3632 1092 cmd.exe 86 PID 1092 wrote to memory of 3632 1092 cmd.exe 86 PID 1092 wrote to memory of 3632 1092 cmd.exe 86 PID 1732 wrote to memory of 3712 1732 8d854838208356a93256d723a35af478.exe 93 PID 1732 wrote to memory of 3712 1732 8d854838208356a93256d723a35af478.exe 93 PID 1732 wrote to memory of 3712 1732 8d854838208356a93256d723a35af478.exe 93 PID 3712 wrote to memory of 1304 3712 cmd.exe 95 PID 3712 wrote to memory of 1304 3712 cmd.exe 95 PID 3712 wrote to memory of 1304 3712 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d854838208356a93256d723a35af478.exe"C:\Users\Admin\AppData\Local\Temp\8d854838208356a93256d723a35af478.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exe/C schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\agfpvtk\corsve.exe""" """C:\Users\Admin\AppData\Roaming\agfpvtk\corsve.dat"""" /du 9700:18 /st 00:02 /sc once /ri 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\agfpvtk\corsve.exe""" """C:\Users\Admin\AppData\Roaming\agfpvtk\corsve.dat"""" /du 9700:18 /st 00:02 /sc once /ri 1 /f3⤵
- Creates scheduled task(s)
PID:3632
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout -t 5 && del "C:\Users\Admin\AppData\Local\Temp\8d854838208356a93256d723a35af478.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\timeout.exetimeout -t 53⤵
- Delays execution with timeout.exe
PID:1304
-
-
-
C:\Users\Admin\AppData\Roaming\agfpvtk\corsve.exeC:\Users\Admin\AppData\Roaming\agfpvtk\corsve.exe "C:\Users\Admin\AppData\Roaming\agfpvtk\corsve.dat"1⤵
- Executes dropped EXE
PID:4604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\agfpvtk\corsve.dat
- Size 136KB
- SHA256 7c3d215e085c842786240fd5aff5fe910c2409a2ce16ec2749193dde70ea33c2
- MD5 0bb6c9e676ac5a89004e97587a3ed419
- SHA1 f619dcf92595c4541a36c04a11cb0c95fbaf602e
- SHA512 881c26d40389160f92e8f204e74a41ee3a8270942b7664192dfb5fc7bc2162586bb523af3cdc59f056f0ecad5f2f0404721ccc6c93e1c256beacbca89cddecb7
- SSDEEP 768:H1+m35uj8ntK5uvphxBzOioA6uFcs6IR5o:V+mAYtK5uvRhFcs6Iro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\agfpvtk\corsve.exe
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP