Analysis

  • max time kernel
    168s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2023 10:57

General

  • Target

    335f90c29d9255fa1239707c5beb9600.exe

  • Size

    1.4MB

  • MD5

    335f90c29d9255fa1239707c5beb9600

  • SHA1

    9fd4fe27fb41c97bd3288c29fc30af778302443c

  • SHA256

    5a1a8ce59103a53a79bab7db80b55ade80805711dad05d3e974d8f252bf53e2b

  • SHA512

    1df0f37f8014865fc7a4caf1c3335a355a17679fab612a30f82dcac87184be9f395b0060b95cef84a41b2a554834306171395e46c6d7e55a9c95ffdee254b765

  • SSDEEP

    24576:nfTe/ii2PVr6CtkgXpfWwRzyT3oDv3x0JkG8mmJFsPIhQRfVmaRFE2RxC0hkH:f2ii2Nr6afXVW4OT3CvymVr6DRf4aPE4

Malware Config

Extracted

Family

cryptbot

C2

ewazqx71.top

moraiw07.top

Attributes
  • payload_url

    http://winfyn10.top/download.php?file=lv.exe

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\335f90c29d9255fa1239707c5beb9600.exe
    "C:\Users\Admin\AppData\Local\Temp\335f90c29d9255fa1239707c5beb9600.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Windows\SysWOW64\dllhost.exe
      dllhost.exe
      2⤵
        PID:1612
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c cmd < Immobilita.jpeg
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:944
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1116
          • C:\Windows\SysWOW64\findstr.exe
            findstr /V /R "^mumoPPZWGBimmUlaTguxGjzvRKrMQXdfkNTRNxDOmizugKidJWVUULLjMedyLjuIlRhMwaFmKaVnTjoiCMeTevxAwGtKrnejqKVvvxfd$" Deposto.jpeg
            4⤵
              PID:4328
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ottobre.exe.com
              Ottobre.exe.com U
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3248
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ottobre.exe.com
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ottobre.exe.com U
                5⤵
                • Executes dropped EXE
                • Checks processor information in registry
                • Suspicious use of FindShellTrayWindow
                PID:2656
            • C:\Windows\SysWOW64\PING.EXE
              ping localhost -n 30
              4⤵
              • Runs ping.exe
              PID:2152

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Deposto.jpeg

        Filesize

        872KB

        MD5

        9c785807d7df67e25292763e4cb1f4f7

        SHA1

        befa1c8bba817d1b56d6383cdbc4177cd9c3e550

        SHA256

        12c551302118d893bff89bcb45e915ada5d4a5f2467cacde9e5f163d2dcd1d79

        SHA512

        8f1849c72120de2d8235c6d3d4f389055a262069e9e4692b8de83b2229e66b3e7233cd0817bf79b122027e44fd9f5ed86def8076cee45ec9f191c3e54806f1cb

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Immobilita.jpeg

        Filesize

        503B

        MD5

        3611fe089bdb6afb3fe4d4ec09e47d22

        SHA1

        724b400e99ca66d5f18e98d227913cd793151bda

        SHA256

        a26dd7ee53256d1a72ed01f1f109ef192e142a05b3d26e7ce9afe025d2fd4a56

        SHA512

        8335d51cf9ddc87f837ace6e204d5d64ef51004d02b764fba1d06fb4cd238c33ae8bd8bbf7b9463c9f49bbcabca9c8c8e196ddf105501778f1e3a7320eecc2bf

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mani.jpeg

        Filesize

        634KB

        MD5

        ce77273cb63c3f4999b6c7966071de93

        SHA1

        22c58f53c6c60b889f8f770cb7b86b4a7953671e

        SHA256

        4dff952a57883347535439e6830cc8fbc4579e61f502ed72aaa512acb3edb84f

        SHA512

        5e585bf47168c0c4f2b1818428c60f7e3df88f8500afcf5afad0378a4a32bd6091565a4410de842c34af7e448e3fb4c9e59ddbdc0dcf0ceb5d3e4c04898d2773

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ottobre.exe.com

        Filesize

        872KB

        MD5

        c56b5f0201a3b3de53e561fe76912bfd

        SHA1

        2a4062e10a5de813f5688221dbeb3f3ff33eb417

        SHA256

        237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

        SHA512

        195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Respirato.jpeg

        Filesize

        666KB

        MD5

        9d4c1ce3dde66558c9ce5023839040b0

        SHA1

        97f0f1bad1e0a562a24d325b90f9b7e50ea04822

        SHA256

        288326dbe1707422ae6164402f9c118c35d9f1ea39ba42b7881a0032cbe514ed

        SHA512

        50c8d573177c1f6902e407833e9d9f32bc46228dc209008f0acb40d6a3a7fee0e4530a8cbec9e53ca7cbca114e3a5ae2505146b1f87bbf804f3f429e8627a05b

      • memory/2656-22-0x00000000047D0000-0x0000000004873000-memory.dmp

        Filesize

        652KB

      • memory/2656-21-0x00000000045C0000-0x00000000045C1000-memory.dmp

        Filesize

        4KB

      • memory/2656-23-0x00000000047D0000-0x0000000004873000-memory.dmp

        Filesize

        652KB

      • memory/2656-24-0x00000000047D0000-0x0000000004873000-memory.dmp

        Filesize

        652KB

      • memory/2656-26-0x00000000047D0000-0x0000000004873000-memory.dmp

        Filesize

        652KB

      • memory/2656-27-0x00000000047D0000-0x0000000004873000-memory.dmp

        Filesize

        652KB

      • memory/2656-28-0x00000000047D0000-0x0000000004873000-memory.dmp

        Filesize

        652KB

      • memory/2656-29-0x00000000047D0000-0x0000000004873000-memory.dmp

        Filesize

        652KB

      • memory/2656-30-0x00000000047D0000-0x0000000004873000-memory.dmp

        Filesize

        652KB