Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 15:22
Static task
static1
Behavioral task
behavioral1
Sample
039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe
Resource
win10v2004-20240802-en
General
-
Target
039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe
-
Size
6.3MB
-
MD5
45b55d1e5d2bf60cc572f541ae6fa7d1
-
SHA1
2329f56147a299bcdbf20520e626cc8253e49a8d
-
SHA256
039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8
-
SHA512
5483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2
-
SSDEEP
49152:rDiHluIUMaBlQkeq99ytafJLHQH9UdaRESvgKQUN7LpNoyuwHw6c+M8rUr+9r:qABlQkeq9gtafJzQdUdatpgwdM8rUr4r
Malware Config
Extracted
cryptbot
fivev5sb.top
-
url_path
/v1/upload.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 3 IoCs
Processes:
service123.exeservice123.exeservice123.exepid process 2848 service123.exe 2364 service123.exe 532 service123.exe -
Loads dropped DLL 5 IoCs
Processes:
039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exeservice123.exeservice123.exeservice123.exepid process 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe 2848 service123.exe 2364 service123.exe 532 service123.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exetaskeng.exedescription pid process target process PID 3028 wrote to memory of 2848 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe service123.exe PID 3028 wrote to memory of 2848 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe service123.exe PID 3028 wrote to memory of 2848 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe service123.exe PID 3028 wrote to memory of 2848 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe service123.exe PID 3028 wrote to memory of 2708 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe schtasks.exe PID 3028 wrote to memory of 2708 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe schtasks.exe PID 3028 wrote to memory of 2708 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe schtasks.exe PID 3028 wrote to memory of 2708 3028 039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe schtasks.exe PID 2044 wrote to memory of 2364 2044 taskeng.exe service123.exe PID 2044 wrote to memory of 2364 2044 taskeng.exe service123.exe PID 2044 wrote to memory of 2364 2044 taskeng.exe service123.exe PID 2044 wrote to memory of 2364 2044 taskeng.exe service123.exe PID 2044 wrote to memory of 532 2044 taskeng.exe service123.exe PID 2044 wrote to memory of 532 2044 taskeng.exe service123.exe PID 2044 wrote to memory of 532 2044 taskeng.exe service123.exe PID 2044 wrote to memory of 532 2044 taskeng.exe service123.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe"C:\Users\Admin\AppData\Local\Temp\039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2708
-
C:\Windows\system32\taskeng.exetaskeng.exe {611BDB41-E6F3-4406-A2C5-F9B7CCDC4BEA} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532