Analysis
- max time kernel
90s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
15/11/2022, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
General
- Target 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe
- Size 304.4MB
- Sample221115-spxcgaee29
- SHA256 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7
- MD5 6aee12038a5eb63871262a6cc5dfaaee
- SHA1 cfd83d772242702e38c4bcbb25a7471354710eef
- SHA512 9ffe05b9678d108a0e12e16985a0f8923155a8999ca3c92ac08e3d0e1f442cfc38f2dbc02cf3262437d68247a589a65f345ced60d7a4f03a71c3d8a99b7ef8de
- SSDEEP 196608:lfH/PUae3NnYV5yfrE3zByQyVG/uzGNVyA:l/PVOmV5yolNSG/lVr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cryptbot
C2
-
http://yawhop210.top/gate.php
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4016 corsve.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\ProductId 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2972 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4640 timeout.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2348 wrote to memory of 3932 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 83 PID 2348 wrote to memory of 3932 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 83 PID 2348 wrote to memory of 3932 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 83 PID 3932 wrote to memory of 2972 3932 cmd.exe 85 PID 3932 wrote to memory of 2972 3932 cmd.exe 85 PID 3932 wrote to memory of 2972 3932 cmd.exe 85 PID 2348 wrote to memory of 1192 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 86 PID 2348 wrote to memory of 1192 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 86 PID 2348 wrote to memory of 1192 2348 9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe 86 PID 1192 wrote to memory of 4640 1192 cmd.exe 88 PID 1192 wrote to memory of 4640 1192 cmd.exe 88 PID 1192 wrote to memory of 4640 1192 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe"C:\Users\Admin\AppData\Local\Temp\9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exe/C schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\pktyqdpj\corsve.exe""" """C:\Users\Admin\AppData\Roaming\pktyqdpj\corsve.dat"""" /sc once /du 9700:20 /ri 1 /st 00:05 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\pktyqdpj\corsve.exe""" """C:\Users\Admin\AppData\Roaming\pktyqdpj\corsve.dat"""" /sc once /du 9700:20 /ri 1 /st 00:05 /f3⤵
- Creates scheduled task(s)
PID:2972
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout -t 5 && del "C:\Users\Admin\AppData\Local\Temp\9cdcab789850b924ea3f73d143bcce456d479967b64ced2d15d1cd4400e597d7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\timeout.exetimeout -t 53⤵
- Delays execution with timeout.exe
PID:4640
-
-
-
C:\Users\Admin\AppData\Roaming\pktyqdpj\corsve.exeC:\Users\Admin\AppData\Roaming\pktyqdpj\corsve.exe "C:\Users\Admin\AppData\Roaming\pktyqdpj\corsve.dat"1⤵
- Executes dropped EXE
PID:4016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\pktyqdpj\corsve.dat
- Size 136KB
- SHA256 7c3d215e085c842786240fd5aff5fe910c2409a2ce16ec2749193dde70ea33c2
- MD5 0bb6c9e676ac5a89004e97587a3ed419
- SHA1 f619dcf92595c4541a36c04a11cb0c95fbaf602e
- SHA512 881c26d40389160f92e8f204e74a41ee3a8270942b7664192dfb5fc7bc2162586bb523af3cdc59f056f0ecad5f2f0404721ccc6c93e1c256beacbca89cddecb7
- SSDEEP 768:H1+m35uj8ntK5uvphxBzOioA6uFcs6IR5o:V+mAYtK5uvRhFcs6Iro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\pktyqdpj\corsve.exe
- Size 872KB
- SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- MD5 c56b5f0201a3b3de53e561fe76912bfd
- SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
- MD5 SHA1 SHA512 SSDEEP