Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07-09-2023 20:49

General

  • Target

    Device/HarddiskVolume1/FileHistory/SreejithK@VIRTUSHOLDING.COM/LTP-566/Data/C/Users/SreejithKumaya/D.exe

  • Size

    3MB

  • MD5

    0afb947cb776933653e23d970a3d8d14

  • SHA1

    c8ab072395450ae11a6abf5323922d74c180d24a

  • SHA256

    ad08c7d20f5342efc20b4460ad66b0961a423804915012ab2969efe25e1288b5

  • SHA512

    ae031402db52a167e6754bf9c04b3f810ad0e2e1202349141f878dc89de6ad1fbfb586d1ef8aee3ca79efa70539dc18ec2da7ca74e3255c01e9956f57d987dc0

  • SSDEEP

    98304:zdh4mx3ywXIaszDU5j5eXOUvlDYL5JZNKdSC7ZUY6NsOoWNCCy9R:zP4s3hXIan5e+UNiuF7INNoWdyn

Malware Config

Extracted

Family

cryptbot

C2

tuytee13.top

moriiikk07.top

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 17 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume1\FileHistory\SreejithK@VIRTUSHOLDING.COM\LTP-566\Data\C\Users\SreejithKumaya\D.exe
    "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume1\FileHistory\SreejithK@VIRTUSHOLDING.COM\LTP-566\Data\C\Users\SreejithKumaya\D.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\SysWOW64\CScript.exe
      "C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\NextGen\lanret\Setup1.vbs" //e:vbscript //B //NOLOGO
      2⤵
      • Blocklisted process makes network request
      PID:1928
    • C:\Program Files (x86)\NextGen\lanret\1.exe
      "C:\Program Files (x86)\NextGen\lanret\1.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2616
    • C:\Program Files (x86)\NextGen\lanret\Setup1.exe
      "C:\Program Files (x86)\NextGen\lanret\Setup1.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\cvtssltnlvfn.exe"
        3⤵
          PID:2204
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\ohxvlklaw.exe"
          3⤵
            PID:2704

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Defense Evasion

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Unsecured Credentials

      2
      T1552

      Credentials In Files

      2
      T1552.001

      Discovery

      Query Registry

      5
      T1012

      Virtualization/Sandbox Evasion

      2
      T1497

      System Information Discovery

      3
      T1082

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Web Service

      1
      T1102

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\NextGen\lanret\1.exe
        Filesize

        2MB

        MD5

        4632afa001ad4b9b2fa32a73deee9be2

        SHA1

        027bc0b083ecf0694622f570fb0dac89fbb6f8a4

        SHA256

        c4b1a76190d578a545a01940f158af937849920ab0e3eaef5688db745cb6aa58

        SHA512

        4c025455316cc015d0b32a83d5002b804d0a384bc44dd6cc6c60f5aac100746c5d353d9bd7b5b11c27195354c77fdc170f5d9cdbd7bc75082e951afb682ac7ec

      • C:\Program Files (x86)\NextGen\lanret\1.exe
        Filesize

        2MB

        MD5

        4632afa001ad4b9b2fa32a73deee9be2

        SHA1

        027bc0b083ecf0694622f570fb0dac89fbb6f8a4

        SHA256

        c4b1a76190d578a545a01940f158af937849920ab0e3eaef5688db745cb6aa58

        SHA512

        4c025455316cc015d0b32a83d5002b804d0a384bc44dd6cc6c60f5aac100746c5d353d9bd7b5b11c27195354c77fdc170f5d9cdbd7bc75082e951afb682ac7ec

      • C:\Program Files (x86)\NextGen\lanret\1.exe
        Filesize

        2MB

        MD5

        4632afa001ad4b9b2fa32a73deee9be2

        SHA1

        027bc0b083ecf0694622f570fb0dac89fbb6f8a4

        SHA256

        c4b1a76190d578a545a01940f158af937849920ab0e3eaef5688db745cb6aa58

        SHA512

        4c025455316cc015d0b32a83d5002b804d0a384bc44dd6cc6c60f5aac100746c5d353d9bd7b5b11c27195354c77fdc170f5d9cdbd7bc75082e951afb682ac7ec

      • C:\Program Files (x86)\NextGen\lanret\Setup1.exe
        Filesize

        2MB

        MD5

        56223d505921bba6a2eaed8efbc2586a

        SHA1

        a52b467278904f6cc309fc56bc45adc710f47c1e

        SHA256

        d1fb6a1beb12ae8f0fa8570c80515602c07ad9f22e22a8d92b8c9d0f26850dd8

        SHA512

        9ef9bd969a1c3f894bacd60d13139aecfdd49b585fec4d9aa66f080a8ce1b3592f51a33043a51a7bfd9dd9f7afb9e5687a4cea2f0cdd85b38603df1954b19718

      • C:\Program Files (x86)\NextGen\lanret\Setup1.exe
        Filesize

        2MB

        MD5

        56223d505921bba6a2eaed8efbc2586a

        SHA1

        a52b467278904f6cc309fc56bc45adc710f47c1e

        SHA256

        d1fb6a1beb12ae8f0fa8570c80515602c07ad9f22e22a8d92b8c9d0f26850dd8

        SHA512

        9ef9bd969a1c3f894bacd60d13139aecfdd49b585fec4d9aa66f080a8ce1b3592f51a33043a51a7bfd9dd9f7afb9e5687a4cea2f0cdd85b38603df1954b19718

      • C:\Program Files (x86)\NextGen\lanret\Setup1.vbs
        Filesize

        126B

        MD5

        3ffc26d751f79fb801ecbb715885e852

        SHA1

        f54da1552aabfbf68ef07fa98234a8a1ff789a16

        SHA256

        8816d2a6adff6e256c6f478c46b283991feeb28dedc384914fe35f14f673d5d6

        SHA512

        08e00923d92f9141ec09ed420738126883772e359e6fc2e703a293020d0bb42b915d2a9961ba03676ab2ad43d8f4563b46778e119f22007073b1d9f1124c0d24

      • C:\Users\Admin\AppData\Local\Temp\OZUBOWcRyS\_Files\_Information.txt
        Filesize

        7KB

        MD5

        c0f246045ab54b6c18abbff8bea2a64b

        SHA1

        2dc531d7056bae13e88f8d88e8c5d6c8acdfa5bf

        SHA256

        8ff65dee826edad6f14057db512cdf3becb49f440d9b6994a33ee7400af7e813

        SHA512

        6b0e8884cc2b2a9df1e8ade6004460e231f619fd0ac61db01d1727a7e0a5b3d527e7cec53aa31b8dbf10fb271b404742da54925aaefe7e6c3813dc34e9f6585b

      • C:\Users\Admin\AppData\Local\Temp\OZUBOWcRyS\_Files\_Information.txt
        Filesize

        3KB

        MD5

        64324acb2b6b9422185e365852d49f0a

        SHA1

        15c28af2a601414961bb4321e075d48192bf1dd4

        SHA256

        a9cda10fe4a79e1909cb53060d954c7c6cf37a7b1c6bc878750826e5188cb57b

        SHA512

        06dd570eaae292b42c2f3a0d9c48f3cc2e9730c086e0d7e175f79c6807a0b55e2fe7e1aeb9fa75e2eb26b0a3ad8d77d686b49d7fef9a21b4da19798fdb6a2a10

      • C:\Users\Admin\AppData\Local\Temp\OZUBOWcRyS\_Files\_Screen_Desktop.jpeg
        Filesize

        47KB

        MD5

        db7080965fd395a51097ef4580875976

        SHA1

        d1c14bc69b609590fa5718f168dbab560111ce74

        SHA256

        7d9c01140e94caf7cf4503efb7b6a6ef06a2ba0e47221db455fec51cc694e41b

        SHA512

        1492b49810313b30f041894d58108021c366d235c58b29be82ed6fe9256a91c63c5a4737a0b462934906063ba85c35f5aace37cf3807395cb1d3a278da66b5d4

      • C:\Users\Admin\AppData\Local\Temp\OZUBOWcRyS\files_\system_info.txt
        Filesize

        8KB

        MD5

        382a4fb241d87d5a0841001defa45508

        SHA1

        00d391e7ac35634de4961e8c1cf266829de3e3d3

        SHA256

        a83dae60b0f4483e237849addf7f7d2e2fb9b8fce51e9f21c60dc532b915f19e

        SHA512

        1024c917f3dfb11a93733fa55771169c7d7f3db5b3a693a75ef78266a50993c26be56c4913ea6954a822a5b464a407452744c7f8649bd99395aabdc7c45bcfbb

      • C:\Users\Admin\AppData\Local\Temp\OZUBOWcRyS\k1N1dWcvGonAty.zip
        Filesize

        40KB

        MD5

        2d450ecfc1e702778c7d4dfdb364817e

        SHA1

        32b2d635087390bc7f4bebd7a9fd89d9d9f3f898

        SHA256

        65d5ed0c6b53c8d417ac43d5fb35b7b30270a243bae8d75884fca200a1782e7b

        SHA512

        2853273d8b686268143be907dd0cf062a6e4aa250c557395e9ea596f62cb9e28bdeacc0ec02fa4449cbc38d79f5a12e1cbae0b1ff93244495f2d1411fc2d4884

      • C:\Users\Admin\AppData\Local\Temp\nsy30E1.tmp\UAC.dll
        Filesize

        14KB

        MD5

        adb29e6b186daa765dc750128649b63d

        SHA1

        160cbdc4cb0ac2c142d361df138c537aa7e708c9

        SHA256

        2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

        SHA512

        b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

      • C:\Users\Admin\AppData\Local\Temp\nsy30E1.tmp\nsExec.dll
        Filesize

        6KB

        MD5

        132e6153717a7f9710dcea4536f364cd

        SHA1

        e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

        SHA256

        d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

        SHA512

        9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

      • \Program Files (x86)\NextGen\lanret\1.exe
        Filesize

        2MB

        MD5

        4632afa001ad4b9b2fa32a73deee9be2

        SHA1

        027bc0b083ecf0694622f570fb0dac89fbb6f8a4

        SHA256

        c4b1a76190d578a545a01940f158af937849920ab0e3eaef5688db745cb6aa58

        SHA512

        4c025455316cc015d0b32a83d5002b804d0a384bc44dd6cc6c60f5aac100746c5d353d9bd7b5b11c27195354c77fdc170f5d9cdbd7bc75082e951afb682ac7ec

      • \Program Files (x86)\NextGen\lanret\1.exe
        Filesize

        2MB

        MD5

        4632afa001ad4b9b2fa32a73deee9be2

        SHA1

        027bc0b083ecf0694622f570fb0dac89fbb6f8a4

        SHA256

        c4b1a76190d578a545a01940f158af937849920ab0e3eaef5688db745cb6aa58

        SHA512

        4c025455316cc015d0b32a83d5002b804d0a384bc44dd6cc6c60f5aac100746c5d353d9bd7b5b11c27195354c77fdc170f5d9cdbd7bc75082e951afb682ac7ec

      • \Program Files (x86)\NextGen\lanret\1.exe
        Filesize

        2MB

        MD5

        4632afa001ad4b9b2fa32a73deee9be2

        SHA1

        027bc0b083ecf0694622f570fb0dac89fbb6f8a4

        SHA256

        c4b1a76190d578a545a01940f158af937849920ab0e3eaef5688db745cb6aa58

        SHA512

        4c025455316cc015d0b32a83d5002b804d0a384bc44dd6cc6c60f5aac100746c5d353d9bd7b5b11c27195354c77fdc170f5d9cdbd7bc75082e951afb682ac7ec

      • \Program Files (x86)\NextGen\lanret\1.exe
        Filesize

        2MB

        MD5

        4632afa001ad4b9b2fa32a73deee9be2

        SHA1

        027bc0b083ecf0694622f570fb0dac89fbb6f8a4

        SHA256

        c4b1a76190d578a545a01940f158af937849920ab0e3eaef5688db745cb6aa58

        SHA512

        4c025455316cc015d0b32a83d5002b804d0a384bc44dd6cc6c60f5aac100746c5d353d9bd7b5b11c27195354c77fdc170f5d9cdbd7bc75082e951afb682ac7ec

      • \Program Files (x86)\NextGen\lanret\1.exe
        Filesize

        2MB

        MD5

        4632afa001ad4b9b2fa32a73deee9be2

        SHA1

        027bc0b083ecf0694622f570fb0dac89fbb6f8a4

        SHA256

        c4b1a76190d578a545a01940f158af937849920ab0e3eaef5688db745cb6aa58

        SHA512

        4c025455316cc015d0b32a83d5002b804d0a384bc44dd6cc6c60f5aac100746c5d353d9bd7b5b11c27195354c77fdc170f5d9cdbd7bc75082e951afb682ac7ec

      • \Program Files (x86)\NextGen\lanret\Setup1.exe
        Filesize

        2MB

        MD5

        56223d505921bba6a2eaed8efbc2586a

        SHA1

        a52b467278904f6cc309fc56bc45adc710f47c1e

        SHA256

        d1fb6a1beb12ae8f0fa8570c80515602c07ad9f22e22a8d92b8c9d0f26850dd8

        SHA512

        9ef9bd969a1c3f894bacd60d13139aecfdd49b585fec4d9aa66f080a8ce1b3592f51a33043a51a7bfd9dd9f7afb9e5687a4cea2f0cdd85b38603df1954b19718

      • \Program Files (x86)\NextGen\lanret\Setup1.exe
        Filesize

        2MB

        MD5

        56223d505921bba6a2eaed8efbc2586a

        SHA1

        a52b467278904f6cc309fc56bc45adc710f47c1e

        SHA256

        d1fb6a1beb12ae8f0fa8570c80515602c07ad9f22e22a8d92b8c9d0f26850dd8

        SHA512

        9ef9bd969a1c3f894bacd60d13139aecfdd49b585fec4d9aa66f080a8ce1b3592f51a33043a51a7bfd9dd9f7afb9e5687a4cea2f0cdd85b38603df1954b19718

      • \Program Files (x86)\NextGen\lanret\Setup1.exe
        Filesize

        2MB

        MD5

        56223d505921bba6a2eaed8efbc2586a

        SHA1

        a52b467278904f6cc309fc56bc45adc710f47c1e

        SHA256

        d1fb6a1beb12ae8f0fa8570c80515602c07ad9f22e22a8d92b8c9d0f26850dd8

        SHA512

        9ef9bd969a1c3f894bacd60d13139aecfdd49b585fec4d9aa66f080a8ce1b3592f51a33043a51a7bfd9dd9f7afb9e5687a4cea2f0cdd85b38603df1954b19718

      • \Users\Admin\AppData\Local\Temp\nsy30E1.tmp\UAC.dll
        Filesize

        14KB

        MD5

        adb29e6b186daa765dc750128649b63d

        SHA1

        160cbdc4cb0ac2c142d361df138c537aa7e708c9

        SHA256

        2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

        SHA512

        b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

      • \Users\Admin\AppData\Local\Temp\nsy30E1.tmp\nsExec.dll
        Filesize

        6KB

        MD5

        132e6153717a7f9710dcea4536f364cd

        SHA1

        e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

        SHA256

        d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

        SHA512

        9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

      • memory/1880-30-0x0000000002930000-0x0000000002E30000-memory.dmp
        Filesize

        5MB

      • memory/1880-32-0x0000000002930000-0x0000000002E5B000-memory.dmp
        Filesize

        5MB

      • memory/1880-20-0x0000000002930000-0x0000000002E30000-memory.dmp
        Filesize

        5MB

      • memory/2612-48-0x0000000000C10000-0x000000000113B000-memory.dmp
        Filesize

        5MB

      • memory/2612-270-0x0000000000C10000-0x000000000113B000-memory.dmp
        Filesize

        5MB

      • memory/2612-295-0x0000000000C10000-0x000000000113B000-memory.dmp
        Filesize

        5MB

      • memory/2612-47-0x0000000001140000-0x000000000166B000-memory.dmp
        Filesize

        5MB

      • memory/2612-44-0x0000000001140000-0x000000000166B000-memory.dmp
        Filesize

        5MB

      • memory/2612-49-0x0000000002590000-0x0000000002592000-memory.dmp
        Filesize

        8KB

      • memory/2612-43-0x0000000000C10000-0x000000000113B000-memory.dmp
        Filesize

        5MB

      • memory/2612-279-0x0000000000C10000-0x000000000113B000-memory.dmp
        Filesize

        5MB

      • memory/2612-275-0x0000000001140000-0x000000000166B000-memory.dmp
        Filesize

        5MB

      • memory/2612-274-0x0000000000C10000-0x000000000113B000-memory.dmp
        Filesize

        5MB

      • memory/2612-271-0x0000000001140000-0x000000000166B000-memory.dmp
        Filesize

        5MB

      • memory/2616-273-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-313-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-269-0x0000000000F90000-0x0000000001490000-memory.dmp
        Filesize

        5MB

      • memory/2616-266-0x0000000000F90000-0x0000000001490000-memory.dmp
        Filesize

        5MB

      • memory/2616-265-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-272-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-45-0x0000000002730000-0x0000000002732000-memory.dmp
        Filesize

        8KB

      • memory/2616-27-0x0000000000F90000-0x0000000001490000-memory.dmp
        Filesize

        5MB

      • memory/2616-31-0x0000000000F90000-0x0000000001490000-memory.dmp
        Filesize

        5MB

      • memory/2616-278-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-33-0x0000000077110000-0x0000000077112000-memory.dmp
        Filesize

        8KB

      • memory/2616-26-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-46-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-268-0x0000000000F90000-0x0000000001490000-memory.dmp
        Filesize

        5MB

      • memory/2616-319-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-321-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-323-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-326-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-328-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-330-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-333-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-335-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-337-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-340-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB

      • memory/2616-342-0x0000000000350000-0x0000000000850000-memory.dmp
        Filesize

        5MB