Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
30/08/2024, 11:11
General
- Target cab87e55f9c6152fdb31f21e2586a6a0_JaffaCakes118.exe
- Size 4.6MB
- Sample240830-naqtxssdql
- SHA256 fad5e27feb085bc2549f7f726a2bfb7df0fb6668022a385682d66a494f219445
Malware Config
Extracted
-
cryptbot
-
bibinene03.top
-
moraass05.top
Signatures
- CryptBot
A C++ stealer distributed widely in bundle with other software.
- CryptBot payload 20 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cab87e55f9c6152fdb31f21e2586a6a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cab87e55f9c6152fdb31f21e2586a6a0_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sib94B0.tmp\0\4.exe"C:\Users\Admin\AppData\Local\Temp\sib94B0.tmp\0\4.exe" /s2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
HeGcL1XdRYV.zip
HhKAlpeFVlfWY.zip
LimitGrant.txt
_Information.txt
_Screen_Desktop.jpeg
system_info.txt
Sibuia.dll
4.exe
SibClr.dll
memory/1280-28-0x0000000000F01000-0x0000000000F5C000-memory.dmp
memory/1280-277-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-27-0x0000000005790000-0x0000000005791000-memory.dmp
memory/1280-26-0x00000000057A0000-0x00000000057A1000-memory.dmp
memory/1280-25-0x0000000005780000-0x0000000005781000-memory.dmp
memory/1280-29-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-30-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-23-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-139-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-298-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-295-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-292-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-290-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-283-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-252-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-253-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-254-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-256-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-258-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-280-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-261-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-264-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-267-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-270-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-275-0x0000000000F00000-0x0000000001413000-memory.dmp
memory/1280-24-0x00000000773F4000-0x00000000773F6000-memory.dmp
memory/3508-14-0x0000000010CE0000-0x0000000010CF2000-memory.dmp
memory/3508-249-0x0000000073BDE000-0x0000000073BDF000-memory.dmp
memory/3508-250-0x0000000073BD0000-0x0000000074380000-memory.dmp
memory/3508-15-0x0000000010D70000-0x0000000010E2A000-memory.dmp
memory/3508-10-0x0000000073BDE000-0x0000000073BDF000-memory.dmp
memory/3508-18-0x0000000073BD0000-0x0000000074380000-memory.dmp
memory/3508-22-0x0000000073BD0000-0x0000000074380000-memory.dmp