Resubmissions

20-07-2024 18:37

240720-w9hxcsxckq 10

20-07-2024 18:36

240720-w82m3sxcjq 10

Analysis

  • max time kernel
    4s
  • max time network
    6s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-07-2024 18:37

General

  • Target

    Creal.exe

  • Size

    20.6MB

  • MD5

    83c2397d023c39a35250c4fa9d8ca703

  • SHA1

    7f659595d1f45df3597e1ee14d60d3738bb1b8bc

  • SHA256

    3e23409d7625e3cf675b5766e85b6e0ba0aa740a2825583d0bf7631817ebfce8

  • SHA512

    d91d1e5d7ab86acb6f1fe3ea76c22cbc9a08cd1ad690f6e928d5c62b15bc591399a520a3363f2d939ab8be3fd970052999a5df38c792c0ab256e4aca7bdd62f3

  • SSDEEP

    393216:XQtsTP8Hr7M5li8k3me+cGfd0NYMR8E76lCgdYB:XQtsL8L7M5lDaE5F0NYysu

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 50 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Creal.exe
    "C:\Users\Admin\AppData\Local\Temp\Creal.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Users\Admin\AppData\Local\Temp\Creal.exe
      "C:\Users\Admin\AppData\Local\Temp\Creal.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:2440
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4292
          • C:\Windows\system32\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4256

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\Crypto\Cipher\_raw_ecb.pyd

      Filesize

      10KB

      MD5

      821aaa9a74b4ccb1f75bd38b13b76566

      SHA1

      907c8ee16f3a0c6e44df120460a7c675eb36f1dd

      SHA256

      614b4f9a02d0191c3994205ac2c58571c0af9b71853be47fcf3cb3f9bc1d7f54

      SHA512

      9d2ef8f1a2d3a7374ff0cdb38d4a93b06d1db4219bae06d57a075ee3dff5f7d6f890084dd51a972ac7572008f73fde7f5152ce5844d1a19569e5a9a439c4532b

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\MSVCP140.dll

      Filesize

      564KB

      MD5

      1ba6d1cf0508775096f9e121a24e5863

      SHA1

      df552810d779476610da3c8b956cc921ed6c91ae

      SHA256

      74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823

      SHA512

      9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\VCRUNTIME140.dll

      Filesize

      106KB

      MD5

      49c96cecda5c6c660a107d378fdfc3d4

      SHA1

      00149b7a66723e3f0310f139489fe172f818ca8e

      SHA256

      69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

      SHA512

      e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\VCRUNTIME140_1.dll

      Filesize

      48KB

      MD5

      cf0a1c4776ffe23ada5e570fc36e39fe

      SHA1

      2050fadecc11550ad9bde0b542bcf87e19d37f1a

      SHA256

      6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47

      SHA512

      d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_asyncio.pyd

      Filesize

      63KB

      MD5

      511a52bcb0bd19eda7aa980f96723c93

      SHA1

      b11ab01053b76ebb60ab31049f551e5229e68ddd

      SHA256

      d1fb700f280e7793e9b0dca33310ef9cd08e9e0ec4f7416854dffaf6f658a394

      SHA512

      d29750950db2ecbd941012d7fbdd74a2bbd619f1a92616a212acb144da75880ce8a29ec3313acbc419194219b17612b27a1833074bbbaa291cdb95b05f8486ff

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_brotli.cp311-win_amd64.pyd

      Filesize

      732KB

      MD5

      0606e7d1af5d7420ea2f363a9b22e647

      SHA1

      949e2661c8abf1f108e49ddc431892af5c4eb5ae

      SHA256

      79e60cd8bfd29ad1f7d0bf7a1eec3d9abadfce90587438ea172034074bc174ee

      SHA512

      0fbb16af2523f374c6057e2cb2397cd7ff7eee7e224372fd56a5feada58b0cebb992a9889865d3b971f960ca5f3bc37ff3017474b79ccc9b74aa4d341b7e06fc

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_bz2.pyd

      Filesize

      82KB

      MD5

      4438affaaa0ca1df5b9b1cdaa0115ec1

      SHA1

      4eda79eaf3de614d5f744aa9eea5bfcf66e2d386

      SHA256

      ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85

      SHA512

      6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_cffi_backend.cp311-win_amd64.pyd

      Filesize

      177KB

      MD5

      fde9a1d6590026a13e81712cd2f23522

      SHA1

      ca99a48caea0dbaccf4485afd959581f014277ed

      SHA256

      16eccc4baf6cf4ab72acd53c72a1f2b04d952e07e385e9050a933e78074a7d5b

      SHA512

      a522661f5c3eeea89a39df8bbb4d23e6428c337aac1d231d32b39005ea8810fce26af18454586e0e94e51ea4ac0e034c88652c1c09b1ed588aeac461766981f4

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_ctypes.pyd

      Filesize

      120KB

      MD5

      6114277c6fc040f68d25ca90e25924cd

      SHA1

      028179c77cb3ba29cd8494049421eaa4900ccd0e

      SHA256

      f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656

      SHA512

      76e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_hashlib.pyd

      Filesize

      63KB

      MD5

      1524882af71247adecf5815a4e55366a

      SHA1

      e25014c793c53503bdff9af046140edda329d01b

      SHA256

      6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327

      SHA512

      5b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_lzma.pyd

      Filesize

      155KB

      MD5

      737119a80303ef4eccaa998d500e7640

      SHA1

      328c67c6c4d297ac13da725bf24467d8b5e982e3

      SHA256

      7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28

      SHA512

      1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_overlapped.pyd

      Filesize

      49KB

      MD5

      ac053ef737e4f13b02bfa81f9e46170b

      SHA1

      5d8ebeb30671b74d736731696fedc78c89da0e1f

      SHA256

      cb68e10748e2efd86f7495d647a2774cea9f97ad5c6fe179f90dc1c467b9280f

      SHA512

      6ac26f63981dc5e8dfb675880d6c43648e2bbe6711c75dcac20ebe4d8591e88fbfac3c60660ab28602352760b6f5e1cb587075072abd3333522e3e2549bfa02e

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_queue.pyd

      Filesize

      31KB

      MD5

      8bbed19359892f8c95c802c6ad7598e9

      SHA1

      773fca164965241f63170e7a1f3a8fa17f73ea18

      SHA256

      4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065

      SHA512

      22ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_socket.pyd

      Filesize

      77KB

      MD5

      64a6c475f59e5c57b3f4dd935f429f09

      SHA1

      ca2e0719dc32f22163ae0e7b53b2caadb0b9d023

      SHA256

      d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49

      SHA512

      cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_sqlite3.pyd

      Filesize

      117KB

      MD5

      a7df575bf69570944b004dfe150e8caf

      SHA1

      2fd19be98a07347d59afd78c167601479aac94bb

      SHA256

      b1223420e475348c0bfb90fae33fc44ce35d988270294158ec366893df221a4b

      SHA512

      18c381a4ded8d33271cbf0bea75af1c86c6d34cc436f68fb9342951c071c10d84cf9f96a0509c53e5886d47fed5bca113a7f7863f6873583daa7bb6af1aa9afa

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_ssl.pyd

      Filesize

      172KB

      MD5

      a0b40f1f8fc6656c5637eacacf7021f6

      SHA1

      38813e25ffde1eee0b8154fa34af635186a243c1

      SHA256

      79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1

      SHA512

      c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\_uuid.pyd

      Filesize

      24KB

      MD5

      4faa479423c54d5be2a103b46ecb4d04

      SHA1

      011f6cdbd3badaa5c969595985a9ad18547dd7ec

      SHA256

      c2ad3c1b4333bc388b6a22049c89008505c434b1b85bff0823b19ef0cf48065a

      SHA512

      92d35824c30667af606bba883bf6e275f2a8b5cbfea2e84a77e256d122b91b3ee7e84d9f4e2a4946e903a11293af9648a45e8cfbe247cbdc3bcdea92eb5349c6

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\base_library.zip

      Filesize

      1.8MB

      MD5

      bbbf46529c77f766ef219f4c146e6ef5

      SHA1

      de07c922c7f4ba08bc1a62cf3fabddecc64f877e

      SHA256

      734e277712e823fca86ca75bf5d4f85a21893208e683c4ab407be10c3b9052dc

      SHA512

      3371a3a806dac2cfec59cc42937b348af67e190a8d575efc6a81ec3d8b215f8a0cb94010142f9d02c8881040a2d6b8364d124f85285d9b3b04f36226fb4fae66

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\charset_normalizer\md.cp311-win_amd64.pyd

      Filesize

      10KB

      MD5

      28af0ffb49cc20fe5af9fe8efa49d6f1

      SHA1

      2c17057c33382ddffea3ca589018cba04c4e49d7

      SHA256

      f1e26ef5d12c58d652b0b5437c355a14cd66606b2fbc00339497dd00243081e0

      SHA512

      9aa99e17f20a5dd485ae43ac85842bd5270ebab83a49e896975a8fa9f98ffc5f7585bef84ed46ba55f40a25e224f2640e85cebe5acb9087cf46d178ecc8029f0

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

      Filesize

      110KB

      MD5

      6cdca2fde9df198da58955397033af98

      SHA1

      e457c97721504d25f43b549d57e4538a62623168

      SHA256

      a4a758eabd1b2b45f3c4699bdfebc98f196dc691c0a3d5407e17fffffafc5df7

      SHA512

      7b3c384ba9993d3192ed852191ff77bdcd3421cbc69ff636c6deb8fe7248e066573b68d80a8f280ae0c1cb015f79967d46d910455d932eaeac072c76d0757e92

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\libcrypto-3.dll

      Filesize

      4.9MB

      MD5

      7a6a8c2a8c379b111cdceb66b18d687d

      SHA1

      f3b8a4c731fa0145f224112f91f046fddf642794

      SHA256

      8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b

      SHA512

      f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\libffi-8.dll

      Filesize

      38KB

      MD5

      0f8e4992ca92baaf54cc0b43aaccce21

      SHA1

      c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

      SHA256

      eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

      SHA512

      6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\libssl-3.dll

      Filesize

      771KB

      MD5

      64acb046fe68d64ee475e19f67253a3c

      SHA1

      d9e66c9437ce6f775189d6fdbd171635193ec4cc

      SHA256

      b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10

      SHA512

      f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\pyexpat.pyd

      Filesize

      194KB

      MD5

      cdcf0e74a32ad7dfeda859a0ce4fcb20

      SHA1

      c72b42a59ba5d83e8d481c6f05b917871b415f25

      SHA256

      91fe5b1b2de2847946e5b3f060678971d8127dfd7d2d37603fdcd31bd5c71197

      SHA512

      c26fdf57299b2c6085f1166b49bd9608d2dd8bc804034ebb03fb2bba6337206b6018bf7f74c069493ffae42f2e9d6337f6f7df5306b80b63c8c3a386bce69ea6

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\python3.DLL

      Filesize

      65KB

      MD5

      0e105f62fdd1ff4157560fe38512220b

      SHA1

      99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c

      SHA256

      803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423

      SHA512

      59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\python311.dll

      Filesize

      5.5MB

      MD5

      58e01abc9c9b5c885635180ed104fe95

      SHA1

      1c2f7216b125539d63bd111a7aba615c69deb8ba

      SHA256

      de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837

      SHA512

      cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\pywin32_system32\pythoncom311.dll

      Filesize

      654KB

      MD5

      f98264f2dacfc8e299391ed1180ab493

      SHA1

      849551b6d9142bf983e816fef4c05e639d2c1018

      SHA256

      0fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b

      SHA512

      6bb3dbd9f4d3e6b7bd294f3cb8b2ef4c29b9eff85c0cfd5e2d2465be909014a7b2ecd3dc06265b1b58196892bb04d3e6b0aa4b2ccbf3a716e0ff950eb28db11c

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\pywin32_system32\pywintypes311.dll

      Filesize

      131KB

      MD5

      90b786dc6795d8ad0870e290349b5b52

      SHA1

      592c54e67cf5d2d884339e7a8d7a21e003e6482f

      SHA256

      89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a

      SHA512

      c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\select.pyd

      Filesize

      29KB

      MD5

      653bdccb7af2aa9ccf50cb050fd3be64

      SHA1

      afe0a85425ae911694c250ab4cb1f6c3d3f2cc69

      SHA256

      e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279

      SHA512

      07e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\sqlite3.dll

      Filesize

      1.4MB

      MD5

      b49b8fde59ee4e8178c4d02404d06ee7

      SHA1

      1816fc83155d01351e191d583c68e722928cce40

      SHA256

      1afd7f650596ad97fcf358b0e077121111641c38ca9d53132bab4c9588cf262f

      SHA512

      a033ce87c2e503b386fb92aa79a7ec14d6c96e4a35d0cb76d4989bacd16f44c4ed5ac4e13057f05f9d199a3fd8545b9a25296515ec456f29c464d949ff34942a

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\unicodedata.pyd

      Filesize

      1.1MB

      MD5

      1905b5d0f945499441e8cd58eb123d86

      SHA1

      117e584e6fcc0e8cfc8e24e3af527999f14bac30

      SHA256

      b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532

      SHA512

      ed88cd7e3259239a0c8d42d95fa2447fc454a944c849fa97449ad88871236fefdafe21dbfa6e9b5d8a54ddf1d5281ec34d314cb93d47ce7b13912a69d284f522

    • C:\Users\Admin\AppData\Local\Temp\_MEI37602\win32\win32api.pyd

      Filesize

      130KB

      MD5

      1d6762b494dc9e60ca95f7238ae1fb14

      SHA1

      aa0397d96a0ed41b2f03352049dafe040d59ad5d

      SHA256

      fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664

      SHA512

      0b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00