Analysis

  • max time kernel
    141s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 13:24

General

  • Target

    CrocodilePhysics.exe

  • Size

    85.8MB

  • MD5

    5bd3c6cd1d892ec5206a163616a23b6c

  • SHA1

    66d1f2eb178f37351895a494f694430737fcb0d3

  • SHA256

    38c3cc0b2ea9943aab04ba749131dd536f9c13cd8e1569ac0a320ba6fd2f5586

  • SHA512

    3127276949c2b84f97ff6aecce41c9ba99849996ad8514b84af0578fc28ab007c61f28e752bca290dc24e9ddee3992a11836f792a50a213a3f5bc85079500fcd

  • SSDEEP

    1572864:zVMIQqbKa5/UQq06oKj9KAyFxKPBnM1l9zeDfjyxExcNbeM9zeDfjyxExcNbe7:zGIQqbKa5/UQq06oKj9KAyFuBMXsDfx3

Malware Config

Signatures

  • Detects Strela Stealer payload 8 IoCs
  • Strela stealer

    An info stealer targeting mail credentials first seen in late 2022.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrocodilePhysics.exe
    "C:\Users\Admin\AppData\Local\Temp\CrocodilePhysics.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1928-0-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/1928-5-0x0000000001D80000-0x0000000001EDA000-memory.dmp

    Filesize

    1.4MB

  • memory/1928-6-0x0000000001D80000-0x0000000001EDA000-memory.dmp

    Filesize

    1.4MB

  • memory/1928-4-0x0000000001D80000-0x0000000001EDA000-memory.dmp

    Filesize

    1.4MB

  • memory/1928-3-0x0000000001D80000-0x0000000001EDA000-memory.dmp

    Filesize

    1.4MB

  • memory/1928-2-0x0000000001D80000-0x0000000001EDA000-memory.dmp

    Filesize

    1.4MB

  • memory/1928-1-0x0000000001D80000-0x0000000001EDA000-memory.dmp

    Filesize

    1.4MB

  • memory/1928-7-0x0000000001D80000-0x0000000001EDA000-memory.dmp

    Filesize

    1.4MB

  • memory/1928-9-0x0000000001D80000-0x0000000001EDA000-memory.dmp

    Filesize

    1.4MB

  • memory/1928-14-0x0000000076F90000-0x0000000076FA0000-memory.dmp

    Filesize

    64KB

  • memory/1928-15-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-16-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/1928-19-0x0000000002540000-0x00000000029ED000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-21-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-43-0x0000000010000000-0x0000000010469000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-23-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-47-0x0000000010000000-0x0000000010469000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-53-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-59-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-63-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-24-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-25-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-26-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-27-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-28-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-29-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-30-0x0000000002540000-0x00000000025BB000-memory.dmp

    Filesize

    492KB

  • memory/1928-32-0x000000007C3A0000-0x000000007C41B000-memory.dmp

    Filesize

    492KB

  • memory/1928-33-0x0000000002540000-0x0000000002596000-memory.dmp

    Filesize

    344KB

  • memory/1928-35-0x000000007C340000-0x000000007C396000-memory.dmp

    Filesize

    344KB

  • memory/1928-38-0x000000007C3A0000-0x000000007C41B000-memory.dmp

    Filesize

    492KB

  • memory/1928-39-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-374-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-373-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-375-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-372-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-70-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-1932-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1931-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1930-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1929-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1928-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1927-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1926-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1925-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1924-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-69-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-68-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-67-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-66-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-65-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-64-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-62-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-1936-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1935-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1934-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1933-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-61-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-60-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-58-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-57-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-56-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-55-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-54-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-52-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-50-0x0000000002690000-0x0000000002862000-memory.dmp

    Filesize

    1.8MB

  • memory/1928-49-0x0000000010000000-0x0000000010469000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-48-0x0000000010000000-0x0000000010469000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-46-0x0000000010000000-0x0000000010469000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-45-0x0000000010000000-0x0000000010469000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-44-0x0000000010000000-0x0000000010469000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-41-0x0000000002690000-0x0000000002AF9000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-40-0x0000000039D00000-0x000000003A1AD000-memory.dmp

    Filesize

    4.7MB

  • memory/1928-1939-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1938-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1937-0x0000000076F90000-0x0000000076FA0000-memory.dmp

    Filesize

    64KB

  • memory/1928-1955-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1954-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1956-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1958-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1959-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1960-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1966-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1965-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1964-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1963-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1962-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1961-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1967-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1968-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1969-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1970-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-1971-0x0000000076F90000-0x00000000770A0000-memory.dmp

    Filesize

    1.1MB

  • memory/1928-2014-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB