Malware Analysis Report

2024-10-23 17:14

Sample ID 240109-w5s7jaffar
Target f23000a51a7ac80b39bab71e83c3983a.exe
SHA256 bd7020c913d0170d15354c8e693a4b2469d2332768ef477c702bd1c51e41887c
Tags
cryptbot persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bd7020c913d0170d15354c8e693a4b2469d2332768ef477c702bd1c51e41887c

Threat Level: Known bad

The file f23000a51a7ac80b39bab71e83c3983a.exe was found to be: Known bad.

Malicious Activity Summary

cryptbot persistence spyware stealer

CryptBot

CryptBot payload

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Checks processor information in registry

Runs ping.exe

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-09 18:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-09 18:30

Reported

2024-01-09 18:35

Platform

win7-20231129-en

Max time kernel

28s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe"

Signatures

CryptBot

spyware stealer cryptbot

CryptBot payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3060 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe C:\Windows\SysWOW64\cmd.exe
PID 3060 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe C:\Windows\SysWOW64\cmd.exe
PID 3060 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe C:\Windows\SysWOW64\cmd.exe
PID 3060 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe C:\Windows\SysWOW64\cmd.exe
PID 3060 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe C:\Windows\SysWOW64\cmd.exe
PID 3060 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe C:\Windows\SysWOW64\cmd.exe
PID 3060 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe C:\Windows\SysWOW64\cmd.exe
PID 3060 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe C:\Windows\SysWOW64\cmd.exe
PID 3004 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3004 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3004 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3004 wrote to memory of 2036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2036 wrote to memory of 3028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2036 wrote to memory of 3028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2036 wrote to memory of 3028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2036 wrote to memory of 3028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2036 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com
PID 2036 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com
PID 2036 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com
PID 2036 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com
PID 2036 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2036 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2036 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2036 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2168 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com
PID 2168 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com
PID 2168 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com
PID 2168 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com

Processes

C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe

"C:\Users\Admin\AppData\Local\Temp\f23000a51a7ac80b39bab71e83c3983a.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c rgmLAtaO

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 30

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com o

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vorra.exe.com

Vorra.exe.com o

C:\Windows\SysWOW64\findstr.exe

findstr /V /R "^zhstQWiUaSsAnmkEODbzVxaWPpDrIiPtovZYFBuQSwQDdEWokoffoLwZVcgHzrklejseAhZhbHAUDOGlhxSmSAWbcqephnvOQFArhTIXpeSAlucuPrzYkLaCdUGAkPqYlMtYhCXzLUdQHchgE$" Aggiogati.pptx

C:\Windows\SysWOW64\cmd.exe

cmd

C:\Windows\SysWOW64\cmd.exe

cmd /c cmd < Pel.pptx

Network

Country Destination Domain Proto
US 8.8.8.8:53 ebSjyqjdxCUUHsVfxQT.ebSjyqjdxCUUHsVfxQT udp
US 8.8.8.8:53 ewaqfe45.top udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Aggiogati.pptx

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pel.pptx

MD5 b508376c348b13291d124eab9cce3534
SHA1 26e23e157da1b214a98d84c581c103a97d2f4121
SHA256 a0a6240b767c17f2bbe16985044599f369fdee62ee626a4326e975edbb01a9b4
SHA512 018c7dcf04180da81065647d957e4d08e40ee7e6ca93fe70ab6bfa49ab8532fcd40fe9add8ddc09816e343f04174b1d3e3dc16ba4cd7c93545814fc1992256b8

memory/2996-25-0x00000000039F0000-0x0000000003A93000-memory.dmp

memory/2996-27-0x00000000039F0000-0x0000000003A93000-memory.dmp

memory/2996-26-0x00000000039F0000-0x0000000003A93000-memory.dmp

memory/2996-24-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/2996-28-0x00000000039F0000-0x0000000003A93000-memory.dmp

memory/2996-30-0x00000000039F0000-0x0000000003A93000-memory.dmp

memory/2996-29-0x00000000039F0000-0x0000000003A93000-memory.dmp

memory/2996-31-0x00000000039F0000-0x0000000003A93000-memory.dmp

memory/2996-32-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

memory/2996-251-0x00000000039F0000-0x0000000003A93000-memory.dmp

memory/2996-252-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-09 18:30

Reported

2024-01-09 18:33

Platform

win10v2004-20231222-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A