Analysis
-
max time kernel
156s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
24-06-2024 09:09
General
-
Target
setup.exe
-
Size
2.1MB
-
MD5
3657f6fadee899005c6556c07a890bba
-
SHA1
bb532f5420c5baacb7b19f508ec29440135c3c74
-
SHA256
0ab71f45b1e9c6f5eba7ce76b31285a18e7a2851870e551b6aa3dbd8cd756aae
-
SHA512
3158f42fc30ee5425a252dd976c0d3634b1df124cf364c5790071677e33082343be4f117f05c8cc725cfd566f87229c4d2fdd235849b1b34b13d9a7285324068
-
SSDEEP
49152:/GxbKmg8Yvmx2jy1u9HWS8XCtMgdm4CnP22FbN7fwqGV7RkV:edKnmxujcStMkmxbFbN7w7C
Malware Config
Extracted
cryptbot
verf04.info
Signatures
-
CryptBot
A C++ stealer distributed widely in bundle with other software.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD5c12be1e7b6541de7746a7e6f7c722027
SHA1c637002a9c8aa73dc4dbccc2908aef8ea15819cc
SHA2560f974cdba262cc57a0a57aac5fc2ab5516ff2dd953247cf817690425dca401fd
SHA512f7472f853b360639007a307ab6db31ba4287c117bbacc2c0081904e47afdca6f4c236dab438bb387740166cc5bacc184a0752b69d0d7cea92315bac9b5dbd5c5
-
Filesize
3B
MD5ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA157218c316b6921e2cd61027a2387edc31a2d9471
SHA256f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
SHA51237c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
-
Filesize
4KB
MD5a412def0fbb80aab0733acbd52140f35
SHA1a4f2bad6d8949262909b261cae4cb3f81fe63a6d
SHA256e7efae89aa1edb614de36dda215ea0ca1084ba18b7218482ab395423aa0f84f8
SHA512540bfb45837dc939b6891e48792ca540a2d86a7481aba8535ceaefd434a2c583ec2210dcfb3a5354a85c9a1d35a87c52f4464a6cb544952be8c73d5ac322bb67
-
Filesize
7KB
MD5a5e387d09a1d2a70feffb294b240f34c
SHA1a901e0dad0e83e8eaa17b957ba1f5704619f99a8
SHA2565b5e9851bf5212f8882793e99595905bdb6e9ce5796dd4d21c2191cf291cb1a7
SHA512fea642b8a291645d5e9d944f67ce2a503d35c2eb17b9e9bdf3ec344339c7de51d12bb1d8776b3758bd9b5252ac9cc4f67129a87036828142fb718ef5d1730e2d
-
Filesize
46KB
MD5c3b5e088750cb735f7c376df679a9971
SHA199ffef258ed5366d88b9cb3da8010003c4e9b87d
SHA256bc309e335821ada4631a157ba788ab1553e732767e97294fa23c650e3d0ede18
SHA512e2ae810a950c62bed1879d22bb75e1ae5db3b7904dbf0266a0f081014bc91b6e414ffba088bf386f262a6598924501cc4ce8da4ec3120cb53ceb9c8b8e5988de
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
4KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
392KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
8KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB