crealstealer | 355bb7cd13e2b17a20c4956af0f402c107a186e95ad82864913b1849cc044939

Sharing

Copy URL

Twitter E-mail

General

Target

funni game.rar
Size

69.8MB
Sample

240123-n5by9ahhgk
MD5

0497d3d3448e093441c98df7465514b2
SHA1

3eaa55d381d772587f49bbb9be8d0826a27702e2
SHA256

355bb7cd13e2b17a20c4956af0f402c107a186e95ad82864913b1849cc044939
SHA512

67bea1ac015d9f0e9ab9cf9b841b0925e149286e45e92e1fb2705f2ce2daaa56a83ccec8c063243ec52886f21901a79213b2ab7e24e6fde882757ccffaadbb22
SSDEEP

1572864:/Y4g+847Nq+K5jHPuVw9juS7qU/nn3tkUKKjGQtsYECoqspWi7Hrw:/Y4gGNKPwS7F/nnf5iQtJU2SHrw

Score

10^/10

Malware Config

Targets

- Target
  
  funni game/_Redist/dotNetFx40_Full_setup.exe
- Size
  
  868KB
- MD5
  
  53406e9988306cbd4537677c5336aba4
- SHA1
  
  06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA256
  
  fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- SHA512
  
  4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP
  
  24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral1
- Target
  
  funni game/_Redist/dxwebsetup.exe
- Size
  
  281KB
- MD5
  
  fd6057b33e15a553ddc5d9873723ce8f
- SHA1
  
  f90efb623b5abea70af63c470daa8674444fb1df
- SHA256
  
  111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- SHA512
  
  d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP
  
  6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
Score

7^/10

persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral2
- Target
  
  funni game/_Redist/oalinst.exe
- Size
  
  790KB
- MD5
  
  694f54bd227916b89fc3eb1db53f0685
- SHA1
  
  21fdc367291bbef14dac27925cae698d3928eead
- SHA256
  
  b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- SHA512
  
  55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP
  
  12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
Score

1^/10
behavioral3
- Target
  
  funni game/_Redist/vcredist_2015-2019_x64.exe
- Size
  
  14.3MB
- MD5
  
  f0248d477e74687c5619ae16498b13d4
- SHA1
  
  9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA256
  
  b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- SHA512
  
  0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP
  
  393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral4
- Target
  
  funni game/_Redist/vcredist_2015-2019_x86.exe
- Size
  
  13.7MB
- MD5
  
  de34b1c517e0463602624bbc8294c08d
- SHA1
  
  5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA256
  
  ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- SHA512
  
  114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP
  
  393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral5
- Target
  
  funni game/_Redist/vcredist_x64.exe
- Size
  
  5.5MB
- MD5
  
  630d75210b325a280c3352f879297ed5
- SHA1
  
  b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA256
  
  b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- SHA512
  
  b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP
  
  98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral6
- Target
  
  funni game/_Redist/vcredist_x86.exe
- Size
  
  4.8MB
- MD5
  
  b88228d5fef4b6dc019d69d4471f23ec
- SHA1
  
  372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA256
  
  8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- SHA512
  
  cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP
  
  98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral7
- Target
  
  funni game/_Redist/xnafx40_redist.msi
- Size
  
  6.7MB
- MD5
  
  97c2eebb30c5a88c68c8f24f37183f1d
- SHA1
  
  49efdc29f65fc8263c196338552c7009fc96c5de
- SHA256
  
  e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- SHA512
  
  c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP
  
  98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
Score

6^/10
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral8
- Target
  
  funni game/money/MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
- Size
  
  773KB
- MD5
  
  1edfa2a911cac9727b97141d95468b0b
- SHA1
  
  83ea96b2bf037292b3811285ad2aac118ac76e2c
- SHA256
  
  60dfe986e7699d5dadd99b413214900b514161bcd41f94f53748b1ec0484fe78
- SHA512
  
  82d4d3f895ccf09d1817033dce10eab38702887b196394038e204167414746b9d97e67c6f7135d08bc228664b1d0769dede7bfeddfa71bfee142c7012a61915b
- SSDEEP
  
  12288:gPCcsYATVuvVTY+Dzz1Ex1wurpbpnOWyio5quPfnsTYmfHC7:gPAByVTY+Dzz1Ex1phOZio5RPfnsThi
Score

1^/10
behavioral9
- Target
  
  funni game/money/MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
- Size
  
  4.7MB
- MD5
  
  d304cd9ce64dbe76273dba6a87b6c817
- SHA1
  
  f3eba33f692a38c7b1a90b0a76ab87b0737e2855
- SHA256
  
  55911542f46e58b3842147fc8f3fd8f6b07206898615202125c57f313970256a
- SHA512
  
  deaa47e5f4e8cb910b5b60cd08aaab7b8886e42dd4c1ac936340da6b3d8810ce97b99a1e0bbb4cd8fd08282a7e19dc2c75f703c655ff680d7c8634d96a4d4432
- SSDEEP
  
  98304:xFWQ6mmTAsgtObkwi/sedvdjnORSq57e5OiciMQIl:qCmTAsuObkw8dvdjnORSq5y5fLMQIl
Score

1^/10
behavioral10
- Target
  
  funni game/money/MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
- Size
  
  59KB
- MD5
  
  f7be9f1841ff92f9d4040aed832e0c79
- SHA1
  
  b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA256
  
  751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- SHA512
  
  380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP
  
  768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
Score

1^/10
behavioral11
- Target
  
  funni game/money/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size
  
  59KB
- MD5
  
  f7be9f1841ff92f9d4040aed832e0c79
- SHA1
  
  b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA256
  
  751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- SHA512
  
  380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP
  
  768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
Score

1^/10
behavioral12
- Target
  
  funni game/money/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size
  
  59KB
- MD5
  
  f7be9f1841ff92f9d4040aed832e0c79
- SHA1
  
  b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA256
  
  751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- SHA512
  
  380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP
  
  768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
Score

1^/10
behavioral13
- Target
  
  funni game/money/UnityCrashHandler64.exe
- Size
  
  1.4MB
- MD5
  
  1be1db1f341b5af486fc9cb76ceff0c2
- SHA1
  
  092080b28d457833edf63b5fd84a5ed9179ca705
- SHA256
  
  ce69977d39bfe50acc33e8709402961b589cd1c077f1d832fa71e9bf5d7033cf
- SHA512
  
  e1e651c39675df6d3d0db63f75683ab1db2e455168aee987d289dfe38821592f7591622901ae4d9e7c0dc28456cb5010372f7ac762ac726eec4930b5415d3933
- SSDEEP
  
  12288:pahxH/N6NqEGh9ZfTIr5LqT7mU6TzKou4ez1:YhxfNaqEGjJTIrBqH76TzKmeR
Score

1^/10
behavioral14
- Target
  
  funni game/money/UnityPlayer.dll
- Size
  
  21.8MB
- MD5
  
  dd013e08194fc1e7c1420eb18e48e3f5
- SHA1
  
  a4a073e4e275abf97be6683ade4d99bbf25a1fa9
- SHA256
  
  df3384be156e3bf025ff50a1118a191152d3e1793c3ea1b6b72e8d2e81a6cc3e
- SHA512
  
  56f79b4139c1c52d4ddcdd65f2a5f91e2da8ab9793cd3ece0bec111c7666fa501dd37a5c0007f4fa1b8286ae02ead67fd0685aa6e40e9dd4f3590db9e0b638fb
- SSDEEP
  
  393216:Y9/WogtPYI+z4X7Au7OwZtg6FhvwW5t2xcJbButzygx:Y9zZNtzygx
Score

1^/10
behavioral15
- Target
  
  funni game/money/VclStylesinno.dll
- Size
  
  3.0MB
- MD5
  
  b0ca93ceb050a2feff0b19e65072bbb5
- SHA1
  
  7ebbbbe2d2acd8fd516f824338d254a33b69f08d
- SHA256
  
  0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
- SHA512
  
  37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
- SSDEEP
  
  49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
Score

1^/10
behavioral16
- Target
  
  funni game/money/WinPixEventRuntime.dll
- Size
  
  41KB
- MD5
  
  ae4d6c34422b85bfa2e99a456fc4c733
- SHA1
  
  bbfb4b08c694ff7df134939a19f05eac0c84a816
- SHA256
  
  2f84a7583f08064f55ac9ea3426f898e1bef6f408fecee22c1f5567601e70123
- SHA512
  
  e49d71b062b935445fdc172cd401a3ccc890225147d19d477e9353ea408d8df5590c93176d420e619caad5a9bfe2bf1b95941195b1f3866aba6d1876c36acd8a
- SSDEEP
  
  384:6/30skuKCMqwvuULtj+K9tX2jBcZaXB5wGlq47zvQHVsrHJWZvkA80aq0GftpBj3:iECMEULtj+RaI0GlqYSusQiC6bcy1oY
Score

1^/10
behavioral17
- Target
  
  funni game/money/good game.exe
- Size
  
  17.1MB
- MD5
  
  128405340080858858bde3db2fa11223
- SHA1
  
  3f1835054b0666af34dd244f5a180d5066e99827
- SHA256
  
  c4eb5a2c2ba748933f0d298233cd2ca9794566bacaf1411d24140b91435bb636
- SHA512
  
  b80648204ea92ea4eb677f70cd9bf69c8eec47675a07f382ec2c2423ef29454393a35829e8cff934ece09a76b72b525f6636c9ba73d66d2b81c82c79a13a7d64
- SSDEEP
  
  393216:wxVhQfundQuslN/m3pql96voWOv+9fIWBJHVtPh9I1jV1:wdQmndQu4KyQvorvSQ0vhKxn
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Enumerates connected drives

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18