Analysis

  • max time kernel
    1s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    09-01-2024 18:40

General

  • Target

    ecb1af6d6c9818c93ffb5c9a54ea9a8a.exe

  • Size

    1.6MB

  • MD5

    ecb1af6d6c9818c93ffb5c9a54ea9a8a

  • SHA1

    c74e20b6423d7536429ff8593c45ab6b999e473b

  • SHA256

    7ef4fa243476257544a992beb265e6f26ea3a3f439488d27bd9700cae2199ae8

  • SHA512

    4f5f1276b260face9b05a1c51eca4ec2d277303ffba6208ead7ed901299555705de8b50cff4dca4f2bd874d756e41a813503943c415e528d28607327b079037d

  • SSDEEP

    49152:1YNosFaoyKxdY4nT+kWQZQtZOby7D/YPBVQ3IBbiLoSG:1K5a6dJPWQQtZO2PmBVQ3I1iLoZ

Malware Config

Extracted

Family

cryptbot

Attributes
  • payload_url

    http://ewsjasew03.top/download.php?file=lv.exe

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecb1af6d6c9818c93ffb5c9a54ea9a8a.exe
    "C:\Users\Admin\AppData\Local\Temp\ecb1af6d6c9818c93ffb5c9a54ea9a8a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c dOPsYvb
      2⤵
        PID:2064
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c certutil -decode Sorso.xltm Pallore.accde & cmd < Pallore.accde
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          3⤵
            PID:2808
            • C:\Windows\SysWOW64\findstr.exe
              findstr /V /R "^VagMWnXqBIFcKZdYcTQuiOWIjFBjSYnEBJsCtnoFZOuMjCNfLyEyGViicGmsXKiClqUqIOUWLkuzIlcJRjBNxaYFClubZRHgGDBk$" Sapro.vst
              4⤵
                PID:2840
              • C:\Windows\SysWOW64\certutil.exe
                certutil -decode Subitanea.xlsx l
                4⤵
                  PID:2816
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 30
                  4⤵
                  • Runs ping.exe
                  PID:2108
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Illusione.com
                  Illusione.com l
                  4⤵
                    PID:2700
            • C:\Windows\SysWOW64\certutil.exe
              certutil -decode Sorso.xltm Pallore.accde
              1⤵
                PID:2776
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Illusione.com
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Illusione.com l
                1⤵
                  PID:2604

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pallore.accde

                  Filesize

                  27KB

                  MD5

                  ff0a5d410cb9c7ac26fb826444110430

                  SHA1

                  999a5a7c1957091e2972974db59f02c7465e1d4a

                  SHA256

                  660bf9d18618e101d9f547ee57329731e8c36d9e6b41c22b8d2db5aceadf4e6c

                  SHA512

                  6958e216cb2b872f1df7626be10a097ef1ab8990a5cad354e2002f872acab0b162d55d882735c3f477a528cb41142f3254e68ae30b07a1ccf97e58c882c0c8cc

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sorso.xltm

                  Filesize

                  38KB

                  MD5

                  8ed844dfd87dade7cf42085edcbeed5b

                  SHA1

                  6a32bd4c765b720988105f155ff0f7ef24d4d635

                  SHA256

                  39960e1c7fe74e983fc1f3772a0fca8be5835d4928524dd56848b459c232756c

                  SHA512

                  26258c17fe26db165c583aa91ad33179dc5ed1069382e2dd25ed96b3061376e01bddf5dfc5ef1fdc3004741e87855bd31ddc99c0e0eb3732c575df402c1fd48c

                • memory/2604-25-0x0000000000110000-0x0000000000111000-memory.dmp

                  Filesize

                  4KB

                • memory/2604-27-0x00000000037B0000-0x0000000003893000-memory.dmp

                  Filesize

                  908KB

                • memory/2604-28-0x00000000037B0000-0x0000000003893000-memory.dmp

                  Filesize

                  908KB

                • memory/2604-26-0x00000000037B0000-0x0000000003893000-memory.dmp

                  Filesize

                  908KB

                • memory/2604-30-0x00000000037B0000-0x0000000003893000-memory.dmp

                  Filesize

                  908KB

                • memory/2604-31-0x00000000037B0000-0x0000000003893000-memory.dmp

                  Filesize

                  908KB

                • memory/2604-29-0x00000000037B0000-0x0000000003893000-memory.dmp

                  Filesize

                  908KB

                • memory/2604-32-0x00000000037B0000-0x0000000003893000-memory.dmp

                  Filesize

                  908KB

                • memory/2604-35-0x00000000037B0000-0x0000000003893000-memory.dmp

                  Filesize

                  908KB