Analysis
- max time kernel
149s - max time network
152s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
31/01/2024, 12:45
General
- Target 8472ae9fabd1a6ed08801c724d1f7370.exe
- Size 603KB
- Sample240131-py3n3aecel
- SHA256 b82f56d700f46d03d91ab996e3affd374c44312213dfa4440e0a8926f5433b0e
Malware Config
Extracted
-
cryptbot
-
haibam72.top
-
morelm07.top
-
payload_url
http://zelyoc10.top/download.php?file=lv.exe
Signatures
- CryptBot
A C++ stealer distributed widely in bundle with other software.
- CryptBot payload 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8472ae9fabd1a6ed08801c724d1f7370.exe"C:\Users\Admin\AppData\Local\Temp\8472ae9fabd1a6ed08801c724d1f7370.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
8LTfxIWx7d6.zip
_Information.txt
_Screen_Desktop.jpeg
system_info.txt
memory/2220-1-0x0000000002DB0000-0x0000000002EB0000-memory.dmp
memory/2220-2-0x0000000002CD0000-0x0000000002D70000-memory.dmp
memory/2220-3-0x0000000000400000-0x0000000002CCC000-memory.dmp
memory/2220-4-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/2220-221-0x0000000000400000-0x0000000002CCC000-memory.dmp
memory/2220-223-0x0000000002CD0000-0x0000000002D70000-memory.dmp
memory/2220-225-0x0000000002DB0000-0x0000000002EB0000-memory.dmp
memory/2220-227-0x00000000003D0000-0x00000000003D1000-memory.dmp