Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-12-2023 19:23

General

  • Target

    f23000a51a7ac80b39bab71e83c3983a.exe

  • Size

    1.5MB

  • MD5

    f23000a51a7ac80b39bab71e83c3983a

  • SHA1

    647a3ce6cfc9e4a4f5c952678d8c7bda038a14f5

  • SHA256

    bd7020c913d0170d15354c8e693a4b2469d2332768ef477c702bd1c51e41887c

  • SHA512

    e7193498cea1d3a56a4a207c3f94aff45b591d4dc95b2ba67830a1252dd79560b63c8abdb36216f90e74fae22123c38f82b606953551ca54f1b015ca987ee7f3

  • SSDEEP

    24576:VyEptD7sRjWDFtr9xE8OoNTtfvJeqkIftCstIt2J5CNmfh8+IED471iuejTya:jZARsFtrTRbdtw4tC0LkyqED4xiuej

Malware Config

Extracted

Family

cryptbot

C2

ewaqfe45.top

morjau04.top

Attributes
  • payload_url

    http://winhaf05.top/download.php?file=lv.exe

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe
    "C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c cmd < Pel.pptx
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1240
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c rgmLAtaO
      2⤵
        PID:3872
    • C:\Windows\SysWOW64\cmd.exe
      cmd
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 30
        2⤵
        • Runs ping.exe
        PID:116
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com
        Vorra.exe.com o
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3628
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V /R "^zhstQWiUaSsAnmkEODbzVxaWPpDrIiPtovZYFBuQSwQDdEWokoffoLwZVcgHzrklejseAhZhbHAUDOGlhxSmSAWbcqephnvOQFArhTIXpeSAlucuPrzYkLaCdUGAkPqYlMtYhCXzLUdQHchgE$" Aggiogati.pptx
        2⤵
          PID:4136
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com o
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of FindShellTrayWindow
        PID:2868

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aggiogati.pptx

        Filesize

        872KB

        MD5

        f435197ac66954c9aaa768c402bb2f6e

        SHA1

        81cb16becf08ab1cb2d88c1a0d51872aac7af78f

        SHA256

        682c0c70fdc6522a9ee445de9439348405b945ef9707b983ddf3e88c869ea576

        SHA512

        ca39a95f003340290b4ae5037313432061c1213f976253bbda8b5149f0f1e295cacbc43dbe63fa1cc54e5336a3161eac7962f73afad775a4122ad23f0330117b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pel.pptx

        Filesize

        487B

        MD5

        b508376c348b13291d124eab9cce3534

        SHA1

        26e23e157da1b214a98d84c581c103a97d2f4121

        SHA256

        a0a6240b767c17f2bbe16985044599f369fdee62ee626a4326e975edbb01a9b4

        SHA512

        018c7dcf04180da81065647d957e4d08e40ee7e6ca93fe70ab6bfa49ab8532fcd40fe9add8ddc09816e343f04174b1d3e3dc16ba4cd7c93545814fc1992256b8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com

        Filesize

        872KB

        MD5

        c56b5f0201a3b3de53e561fe76912bfd

        SHA1

        2a4062e10a5de813f5688221dbeb3f3ff33eb417

        SHA256

        237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

        SHA512

        195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

      • C:\Users\Admin\AppData\Local\Temp\iSncpIO8pC\LubAlwY6wtYM3.zip

        Filesize

        785KB

        MD5

        f8c1704e198600846e523ded289572aa

        SHA1

        070a19acd704141b393dd7ae10683173a0d7006f

        SHA256

        755d602d3d1d77fe98f6287a17dc7c4ad70486ef2264ed4c84bb5c5f951ba9d9

        SHA512

        e2e2e5a62b05590c37315268361a737f5f6edd8d43d786a7be460d90dbab4e7ea09bcde0709523219d4e94d2bb27651abcd1f5a821098479dbd9842ca0a5707d

      • C:\Users\Admin\AppData\Local\Temp\iSncpIO8pC\_Files\_Files\ConfirmWait.txt

        Filesize

        745KB

        MD5

        6b4364950e66f6bc2e3c0e626344420b

        SHA1

        367460cda5692d82802999b0ee358d401acff294

        SHA256

        2a94b8c796d9dc175199377b3d5e4053820c56e1d02ced3c72b9f16728d8f778

        SHA512

        6a386f4131124d06c40f370b5cb8b401c04542062f3f90f9830d0dd05a114e8f0493fe95d1b57ad503357dc2d9b770f9eb3687693d0a3d4cb9170a27c1971e7a

      • C:\Users\Admin\AppData\Local\Temp\iSncpIO8pC\_Files\_Information.txt

        Filesize

        1KB

        MD5

        d9a21089e1b3b0016a0b68acab575ca8

        SHA1

        1cd7a023cc4e44a731bdf8c8a387a9065b7c305b

        SHA256

        590eb8e782638f8a44108ec4a41ea5429955571b44b11ad0cafa4e35da099568

        SHA512

        3ecf349823c4a36bff8536ecb93ac58cef537d55cc45b0b974c50d5e3df1fa29344e7664f5f13d91351670f99edeea178869ed612746fb226bacefbd409bd0ab

      • C:\Users\Admin\AppData\Local\Temp\iSncpIO8pC\_Files\_Information.txt

        Filesize

        3KB

        MD5

        88a9e70aeff1eee9acc0375eabdd48e5

        SHA1

        4bfc396229e910341b62ad38119e935ca49dd98c

        SHA256

        a111a5c380334907042e1e1be9c0571f5e4d7e67cf97523af0af53916af3e286

        SHA512

        9677d22e15f8766c7ed6d2ccba53582f91cda1b52ce86d7d690cd81334a060be1daf7cf8dd9bed03503fc81a7a6687d1316036e8ecb55181f3e8895f0e6f840c

      • C:\Users\Admin\AppData\Local\Temp\iSncpIO8pC\_Files\_Information.txt

        Filesize

        4KB

        MD5

        7e4cabf86ad2deb9632764ab2101eba7

        SHA1

        9629c0880c9ab664df56f4d72442ff1759099a72

        SHA256

        a830b8d7201733d5fdd12479d605e49459496f69ce2066bbc49174311451abe8

        SHA512

        c7e4770e48d8ddaed31dcb59429f0fa09d376fbceae0c4018534d021db65bb6838f1ea788b0cd9e7a553c991cb2a97058b74f55a1a712efa378e43145ae24218

      • C:\Users\Admin\AppData\Local\Temp\iSncpIO8pC\_Files\_Screen_Desktop.jpeg

        Filesize

        45KB

        MD5

        d99ccc7c33d77c38248d324171200f9f

        SHA1

        65cf21860a5df51d7f18c25c6c2495ab4d7a3334

        SHA256

        b5664e06bb8453201a8b8cdf149cf77b3b72a395f1da91061abdfad9c887e1de

        SHA512

        87341e040ffe92ed7a8a1bba3c96a3081fcd6f60bcf21514a3808d9a019d7c0b37f93662b2821bbf42729621b5ef8c23d4c5c5296ed363606b02c18f926703e8

      • C:\Users\Admin\AppData\Local\Temp\iSncpIO8pC\files_\system_info.txt

        Filesize

        1KB

        MD5

        4b41c02d15b1d0e2cc5b06ace64fd013

        SHA1

        680a85f72fd6aaff4af8e523af60b33f09b95e3f

        SHA256

        2fe7f5e60c67db0dcdb4c810c7a464c1e34c4c575e792eb70824ba7bc69db1d1

        SHA512

        623ba98b3a90844ffe33306d5055cd728c8d0938b79e3c960e2357567c1a15f69156df59b8fddf31dc083ccf7d92ca8a5248e352ce179aef13b0ad91f91e549b

      • C:\Users\Admin\AppData\Local\Temp\iSncpIO8pC\files_\system_info.txt

        Filesize

        4KB

        MD5

        8833c7116e88c4b7e4c57773e8d1d796

        SHA1

        00c311ea509f1d913b5a374884062c9349cfa76f

        SHA256

        ad06f5e2d084a0b919b9a1b7af1584c7156b5297924f46e9b98d128c20e29953

        SHA512

        66dfd2de1c447d458b2edbbba5afa225b0789e5a969f77dae513873142237135a51785f82d2f259dd5f64d4ea6d4e9bb9069708aab9eb84eeebf8b5940c1eeaf

      • memory/2868-24-0x00000000042C0000-0x0000000004363000-memory.dmp

        Filesize

        652KB

      • memory/2868-29-0x00000000042C0000-0x0000000004363000-memory.dmp

        Filesize

        652KB

      • memory/2868-27-0x00000000042C0000-0x0000000004363000-memory.dmp

        Filesize

        652KB

      • memory/2868-26-0x00000000042C0000-0x0000000004363000-memory.dmp

        Filesize

        652KB

      • memory/2868-25-0x00000000042C0000-0x0000000004363000-memory.dmp

        Filesize

        652KB

      • memory/2868-23-0x00000000042C0000-0x0000000004363000-memory.dmp

        Filesize

        652KB

      • memory/2868-22-0x00000000042C0000-0x0000000004363000-memory.dmp

        Filesize

        652KB

      • memory/2868-21-0x0000000000F50000-0x0000000000F51000-memory.dmp

        Filesize

        4KB

      • memory/2868-242-0x00000000042C0000-0x0000000004363000-memory.dmp

        Filesize

        652KB