Analysis
-
max time kernel
149s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 21:36
Static task
static1
Behavioral task
behavioral1
Sample
37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe
Resource
win10v2004-20240802-en
General
-
Target
37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe
-
Size
6.3MB
-
MD5
c5143bd22b31ab714bae08e6be64f210
-
SHA1
937aeea94741a7aebbec23aa09130b78816ef3f8
-
SHA256
37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f
-
SHA512
26a207c89a1e62ae455dfe0fe1e49fa3280a8d1abb303120aa86c5f6236e91da71a58894c2ef5bd16ec9a9ebcac367ae4f2daf6383d862bd6d0fc3ca69fd5178
-
SSDEEP
98304:vw6bFrMzY8D2oSlaL+skDdH/L8X2Mfkex5iRCxB9j7:vwEoUBoSjA/XYunj7
Malware Config
Extracted
cryptbot
twov2sb.top
analforeverlovyu.top
-
url_path
/v1/upload.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 2 IoCs
Processes:
service123.exeservice123.exepid process 2088 service123.exe 2136 service123.exe -
Loads dropped DLL 4 IoCs
Processes:
37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exeservice123.exeservice123.exepid process 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe 2088 service123.exe 2136 service123.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exetaskeng.exedescription pid process target process PID 2216 wrote to memory of 2088 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe service123.exe PID 2216 wrote to memory of 2088 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe service123.exe PID 2216 wrote to memory of 2088 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe service123.exe PID 2216 wrote to memory of 2088 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe service123.exe PID 2216 wrote to memory of 2912 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe schtasks.exe PID 2216 wrote to memory of 2912 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe schtasks.exe PID 2216 wrote to memory of 2912 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe schtasks.exe PID 2216 wrote to memory of 2912 2216 37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe schtasks.exe PID 1616 wrote to memory of 2136 1616 taskeng.exe service123.exe PID 1616 wrote to memory of 2136 1616 taskeng.exe service123.exe PID 1616 wrote to memory of 2136 1616 taskeng.exe service123.exe PID 1616 wrote to memory of 2136 1616 taskeng.exe service123.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe"C:\Users\Admin\AppData\Local\Temp\37e5967f4396edb6c2a33180cd50de9bb59f028f2a303e16fb050d3df9e49f5f.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2912
-
C:\Windows\system32\taskeng.exetaskeng.exe {9E6BFA7C-59DA-49DE-97A7-6D1F6B8178D9} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136