Analysis

  • max time kernel
    1s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2023 14:02

General

  • Target

    3906bd87156d29380e32e4aa14cdb61a.exe

  • Size

    612KB

  • MD5

    3906bd87156d29380e32e4aa14cdb61a

  • SHA1

    46bae4add1c9a9c1816a3b762d9dd13a5dd102b8

  • SHA256

    199bbc42e66411fd345d097585df9bddba75ff75d0b927fc27d1259348f49793

  • SHA512

    d372f762d8e5753575682dbbae023657d474a0d8382298dc1f46d82588c0f5677e3c37750eabed5240c52b2223d6163e2bbee9757b4b2f68708b74ca81f07a58

  • SSDEEP

    12288:BR/Myxywm00uwkZLMWfc6CcCuG3jz7nWiYeA1wdtavtVPNZMFOi2:gyxywRe49C9uGnWiT3Ef

Malware Config

Extracted

Family

cryptbot

C2

knudin72.top

moreag07.top

Attributes
  • payload_url

    http://sarafc10.top/download.php?file=lv.exe

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3906bd87156d29380e32e4aa14cdb61a.exe
    "C:\Users\Admin\AppData\Local\Temp\3906bd87156d29380e32e4aa14cdb61a.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of FindShellTrayWindow
    PID:2124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2124-2-0x0000000003CD0000-0x0000000003D70000-memory.dmp

    Filesize

    640KB

  • memory/2124-1-0x00000000002D0000-0x00000000003D0000-memory.dmp

    Filesize

    1024KB

  • memory/2124-3-0x0000000000400000-0x0000000002402000-memory.dmp

    Filesize

    32.0MB

  • memory/2124-4-0x00000000024F0000-0x00000000024F1000-memory.dmp

    Filesize

    4KB

  • memory/2124-227-0x0000000000400000-0x0000000002402000-memory.dmp

    Filesize

    32.0MB

  • memory/2124-229-0x00000000002D0000-0x00000000003D0000-memory.dmp

    Filesize

    1024KB

  • memory/2124-232-0x00000000024F0000-0x00000000024F1000-memory.dmp

    Filesize

    4KB