Extracted

• • Target

    file.exe

  • Size

    5KB

  • MD5

    72025394a2450241bce7df7e305cd07b

  • SHA1

    018b6c066c915ba37616661f86c09e453d58fd66

  • SHA256

    69b153cd6176d790d2aae37ccc5600bde475a0eca6d1f6f531a1e040d44bccd1

  • SHA512

    80b6dd62149a49cb849a148b4d5501765302f21696056d91789ba46a18aa8ecc7fb6f14569787dae716a975327d2fbb518212ab0de195588ff568da60e816fa2

  • SSDEEP

    48:6iHpgJkhMKfgrJ/J4KK4SRcMnZbECSaM7/ttOuliL/qXSfbNtm:TH+zCgdinZbq/Z0LxzNt

  Score

  10^/10

  cryptbotsocks5systemzbotnetdefense_evasiondiscoveryevasionexecutionspywarestealertrojan

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Detect Socks5Systemz Payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

    botnetsocks5systemz

  • Windows security bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops Chrome extension

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2