Analysis
- max time kernel
416s - max time network
501s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
11/01/2023, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
600 seconds
General
- Target ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe
- Size 1.3MB
- Sample230111-mhldqsff81
- SHA256 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886
- MD5 0ffdae6b7d6f3045e7fef2b78bcbfd91
- SHA1 73ccfd6ac716ba904bd1bf0fded96099f8c5169c
- SHA512 61ba9821d7d8552dff0aa4feec374fec86681915e4a34a46e55156cdbbffe96b3ea519d937eedd088e9f17cebb12c31d98dafbe5e9e8307409c92576deeefd75
- SSDEEP 24576:WJG12WyjngNIGYYtc9NgfH+w1TppIKW7S36UIXEwJEW8MCqct34oYR:t12WiYtcH2BjoXEW8MQtohR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cryptbot
C2
-
http://wuqtaz510.top/gate.php
Attributes
-
payload_url
http://maltdi07.top/quasar.dat
Signatures
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum aspnet_compiler.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 aspnet_compiler.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4644 set thread context of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 aspnet_compiler.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString aspnet_compiler.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz aspnet_compiler.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4644 wrote to memory of 1156 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 87 PID 4644 wrote to memory of 1156 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 87 PID 4644 wrote to memory of 1156 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 87 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88 PID 4644 wrote to memory of 4792 4644 ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe"C:\Users\Admin\AppData\Local\Temp\ea70753df5c4285c7d07007d5f98c9dfbb3bd707be0947f70b0d08aed04d1886.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe2⤵PID:1156
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe2⤵
- Maps connected drives based on registry
- Checks processor information in registry
PID:4792
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:2192
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:544