Analysis
- max time kernel
91s - max time network
183s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
15/11/2022, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
300 seconds
General
- Target Setup.exe
- Size 304.4MB
- Sample221115-sbrj3aed45
- SHA256 40107b7d418a2a0dffcc0cf361a2accbb9df7875d35f0fc26d0f32f8b42819f1
- MD5 2e93e62249b4f08a433801a52c814ab7
- SHA1 c23589e5251e0fe4affd86e7e9fc3961fde93642
- SHA512 98c354167a8d574e3d9a531cd1686c746b78485c97bd825caebedb8069bbb2829e98e8f5691214a9571b031071a358a5a14ad545054fe6fa61697faf6d6d7433
- SSDEEP 98304:FGJDRd1piurm9Xv7oXsK1QtyLQQ42+SMWNxJ7/nATC4K7X:kJDXlrm9Xv7oXsK14mnbP3JzATC4C
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cryptbot
C2
-
http://jaczhy110.top/gate.php
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4748 corsve.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\ProductId Setup.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3428 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe 4296 Setup.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4296 wrote to memory of 4736 4296 Setup.exe 83 PID 4296 wrote to memory of 4736 4296 Setup.exe 83 PID 4296 wrote to memory of 4736 4296 Setup.exe 83 PID 4296 wrote to memory of 4932 4296 Setup.exe 85 PID 4296 wrote to memory of 4932 4296 Setup.exe 85 PID 4296 wrote to memory of 4932 4296 Setup.exe 85 PID 4932 wrote to memory of 3428 4932 cmd.exe 87 PID 4932 wrote to memory of 3428 4932 cmd.exe 87 PID 4932 wrote to memory of 3428 4932 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Maps connected drives based on registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jgnud > jgnud2⤵PID:4736
-
-
C:\Windows\SysWOW64\cmd.exe/C schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\yrnd\corsve.exe""" """C:\Users\Admin\AppData\Roaming\yrnd\corsve.dat"""" /sc once /du 9700:20 /ri 1 /st 00:05 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\yrnd\corsve.exe""" """C:\Users\Admin\AppData\Roaming\yrnd\corsve.dat"""" /sc once /du 9700:20 /ri 1 /st 00:05 /f3⤵
- Creates scheduled task(s)
PID:3428
-
-
-
C:\Users\Admin\AppData\Roaming\yrnd\corsve.exeC:\Users\Admin\AppData\Roaming\yrnd\corsve.exe "C:\Users\Admin\AppData\Roaming\yrnd\corsve.dat"1⤵
- Executes dropped EXE
PID:4748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\yrnd\corsve.dat
- Size 136KB
- SHA256 7c3d215e085c842786240fd5aff5fe910c2409a2ce16ec2749193dde70ea33c2
- MD5 0bb6c9e676ac5a89004e97587a3ed419
- SHA1 f619dcf92595c4541a36c04a11cb0c95fbaf602e
- SHA512 881c26d40389160f92e8f204e74a41ee3a8270942b7664192dfb5fc7bc2162586bb523af3cdc59f056f0ecad5f2f0404721ccc6c93e1c256beacbca89cddecb7
- SSDEEP 768:H1+m35uj8ntK5uvphxBzOioA6uFcs6IR5o:V+mAYtK5uvRhFcs6Iro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\yrnd\corsve.exe
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP