Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25-07-2024 21:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe

  • Size

    898KB

  • MD5

    c02798b26bdaf8e27c1c48ef5de4b2c3

  • SHA1

    bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615

  • SHA256

    af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78

  • SHA512

    b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4

  • SSDEEP

    24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nifty.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    katsugoro00

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.af.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    hh5126

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.elettro-service.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    *Lara1970*

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Skeeter1@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Orphan@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Frontier1

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nn.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mongoose

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.coqui.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    EDGARDVG

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nn.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    yuto0920

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nn.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    rhne7psb

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nn.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    hiroki1150

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.phoenix-rto.it
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Mplacentino#1

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.kaluwonuea.go.th
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    73511023

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nn.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    0310ti

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    drake97

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.mariola.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    9600casa

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ax.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    197377

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Squidney1@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    escu7Dete!

Extracted

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    patientconnections.co.uk
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    x5856h4v

Extracted

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ax.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    password

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Gidget#1@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ax.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    igirisu0617

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ax.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mongoose

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    1962Kindan@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ax.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    shizu1216

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    tx.thn.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    xrw3eucq

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    3stooges

Extracted

Credentials

Extracted

Credentials

Signatures

  • Executes dropped EXE 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe
    "C:\Users\Admin\AppData\Local\Temp\af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        clamer.exe -priverdD
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1976
  • C:\ProgramData\xeltkvv\ljndbpm.exe
    C:\ProgramData\xeltkvv\ljndbpm.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
    Filesize

    37B

    MD5

    28151380c82f5de81c1323171201e013

    SHA1

    ae515d813ba2b17c8c5ebdae196663dc81c26d3c

    SHA256

    bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d

    SHA512

    46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
    Filesize

    453KB

    MD5

    a9f386515c3896a0a106940be362de47

    SHA1

    d1a9cf3c16555db4b2395d388995c2b13d2d683b

    SHA256

    12532d6bf0cdb5ea1cc0844e9ef73530456a337d5b73bb8d23e110fac46c3446

    SHA512

    7a2a4a6c7f9c426ff57066786892f4bbd7830f8c91985f1243abfd9148878345e83813eb09434b68b6616b76860d4163c1c7e32d4eb552953019fc8cb4c0a448

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
    Filesize

    16KB

    MD5

    e7d405eec8052898f4d2b0440a6b72c9

    SHA1

    58cf7bfcec81faf744682f9479b905feed8e6e68

    SHA256

    b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

    SHA512

    324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

    Download Submit

  • C:\Windows\Tasks\Test Task17.job
    Filesize

    242B

    MD5

    cccc9efca04567492cef5fc9e1adcaff

    SHA1

    aac1450d2a4bc44120312b776b085a3655a27d47

    SHA256

    520dc10ae6cc3936b6b8b890724791d26b7b753d34f2710412b8944c66ac4fa7

    SHA512

    261f8f6a5b7aa7244495df0caec6e485b062743808beacaea8930ed96a1d91153303fd84310e6021651839ae5eb8cb233b1e644c2b22204291f13df0dc38bd13

    Download Submit