Analysis
-
max time kernel
148s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 20:26
Static task
static1
Behavioral task
behavioral1
Sample
9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe
Resource
win7-20240903-en
General
-
Target
9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe
-
Size
4.7MB
-
MD5
47eaa7981dc34b70273b00f181749654
-
SHA1
2ff2d6202298d9cb0f06c4f00a966647923b34e7
-
SHA256
9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f
-
SHA512
9e6fa7b5c0552164d5ee98ce08eb7b2d514700eefb11667892d611e85d621a8de8edea9b9e52540ca12b70fd882d2700ea545f0e9ac24417c222d730d13cbfea
-
SSDEEP
98304:QsuzYSa+/ydDuZ731vVJ0kPwc31MJjh63rgIBr37/XfBGdRZ+Js:lpdDQB1MJQ3rl/3BGdRl
Malware Config
Extracted
cryptbot
analforeverlovyu.top
eihtv18sb.top
-
url_path
/v1/upload.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 4 IoCs
Processes:
VC_redist.x64.exeVC_redist.x86.exeservice123.exeservice123.exepid process 1716 VC_redist.x64.exe 2896 VC_redist.x86.exe 1864 service123.exe 2128 service123.exe -
Loads dropped DLL 12 IoCs
Processes:
9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exeVC_redist.x86.exeservice123.exeservice123.exepid process 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe 2896 VC_redist.x86.exe 2896 VC_redist.x86.exe 1864 service123.exe 2128 service123.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exeVC_redist.x86.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
VC_redist.x86.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 VC_redist.x86.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString VC_redist.x86.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exeVC_redist.x86.exetaskeng.exedescription pid process target process PID 1632 wrote to memory of 1716 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe VC_redist.x64.exe PID 1632 wrote to memory of 1716 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe VC_redist.x64.exe PID 1632 wrote to memory of 1716 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe VC_redist.x64.exe PID 1632 wrote to memory of 1716 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe VC_redist.x64.exe PID 1632 wrote to memory of 2896 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe VC_redist.x86.exe PID 1632 wrote to memory of 2896 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe VC_redist.x86.exe PID 1632 wrote to memory of 2896 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe VC_redist.x86.exe PID 1632 wrote to memory of 2896 1632 9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe VC_redist.x86.exe PID 2896 wrote to memory of 1864 2896 VC_redist.x86.exe service123.exe PID 2896 wrote to memory of 1864 2896 VC_redist.x86.exe service123.exe PID 2896 wrote to memory of 1864 2896 VC_redist.x86.exe service123.exe PID 2896 wrote to memory of 1864 2896 VC_redist.x86.exe service123.exe PID 2896 wrote to memory of 1724 2896 VC_redist.x86.exe schtasks.exe PID 2896 wrote to memory of 1724 2896 VC_redist.x86.exe schtasks.exe PID 2896 wrote to memory of 1724 2896 VC_redist.x86.exe schtasks.exe PID 2896 wrote to memory of 1724 2896 VC_redist.x86.exe schtasks.exe PID 2460 wrote to memory of 2128 2460 taskeng.exe service123.exe PID 2460 wrote to memory of 2128 2460 taskeng.exe service123.exe PID 2460 wrote to memory of 2128 2460 taskeng.exe service123.exe PID 2460 wrote to memory of 2128 2460 taskeng.exe service123.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe"C:\Users\Admin\AppData\Local\Temp\9f373cdee6065d01164210c338948684703fcf966adab402175117dba115b85f.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"2⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1724
-
C:\Windows\system32\taskeng.exetaskeng.exe {0A35FC49-CF70-4C16-8980-4FB6795641BD} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.1MB
MD55776392593245c0f7ffa5d05e0538b4d
SHA1e03291fc3ec8c72dd2f75d016b9829a33f2bfcc0
SHA256f4b64977aa021edf0d72c5f93f927115f6370876b21219ad303179230db6b1c2
SHA512f933ce9ffacfa0826eed707c1c96c54343d87c123b4a5fe6dd910cdb69c8f4e5e8ee6e373af4d6622c4b05b7abeeca822a15e97cf74c083dbbaf194a976d059c
-
Filesize
6.3MB
MD5cb2bd11ed77164148a475693db0b02f2
SHA1884a752c92c0f93c7aa2c00aa8c19684ee7b4c50
SHA256192378774c53b5285cffe591b070bfd303fabf2d6acdc96792b10d1233142494
SHA51218fd7141e7c44d0e8111dc12a6764a926db4fd7a701c13bbf3d9c76b063478274dfab87951966a585a050a96e33c20858f59d629ce27374a9c0e450aacfef1c5