Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 23:13
General
-
Target
2991d580a9894fd67ead96e52ae559f3c1692fcf6e4bae4b857734b9f4344483.exe
-
Size
2.7MB
-
MD5
e79bd7a1ea4413bfebd391b86f54893c
-
SHA1
e965a062e9eadfb2d3121362942310cfd32f3afb
-
SHA256
2991d580a9894fd67ead96e52ae559f3c1692fcf6e4bae4b857734b9f4344483
-
SHA512
e85f61470100ee3c9d0bb80fd7d71757c6c4e41268f0ea05d392873a2aca4d3515a288baa11c33274383c17bb9b34d0d9e05d55b4959f5017a9981c00b4a1c1e
-
SSDEEP
49152:MNPPzVce7Xp9pbK3oRVZPDEb4jf/fFeIKnGQ+Z+/u4ae8aMSSKtarkgjP2jx:MNDVcebprK4RVZAqXfFeznGgahSLt2Yx
Malware Config
Extracted
cryptbot
veotdm61.top
morizu06.top
-
payload_url
http://tynpdi08.top/download.php?file=loungy.exe
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 20 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2991d580a9894fd67ead96e52ae559f3c1692fcf6e4bae4b857734b9f4344483.exe"C:\Users\Admin\AppData\Local\Temp\2991d580a9894fd67ead96e52ae559f3c1692fcf6e4bae4b857734b9f4344483.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD579961bbbf967e683838a6eae48edaf61
SHA17bc02e6fa64dc702da075d4fc1c90805a5b85e6d
SHA256e9f8776de043e783f051900cd8c5deec90b2790a06640f6f2587fbe12643f730
SHA5120511901f3d21d9d679ae3ef67801ae23f59b3b797d64ff4bc19035d7bbce3aa8120b3ef38540e6bcdb1267450e2e5a4041138647b36457a1c6cc99e79a852b18
-
Filesize
1KB
MD5300b2c2888c6977f73f8ed9a6cd8a63a
SHA1d0aa17a6b4b5cd3fdec0f51820ac3b164cbc60f1
SHA25641f800db4326ca6c40c0619b99b5bd09b3b39d9a76554bac3d2ead2a821ac7ee
SHA51269430f9a50cc9c61dfa4838f652a0bffafe9fed9ae4be7fc7a9a539d4991dd006d96710d70421436b73b38c2681f4bfb9a9f7938a8994b0d3e595e33352c9e25
-
Filesize
1KB
MD5d5544d21d9c6be12c48b5f6566f4d70c
SHA11bbf29f2c891b57f82d8a375c20d744c3cf85335
SHA2567d577749c1d91a1b414f2e085d2010755df650266e407fa0f9e1927c9e4d9270
SHA5123e37e37db262b6f7baeaf554516cf42d34d0fd5fd5a7ce9ab0719e8dd1cef38187150d4d514260315d33ca10fd702e2952ea5f03dd0f0f39dfd618f75e2b1443
-
Filesize
4KB
MD5ebc60ccc8b3f468a344460eb3f1f0f0c
SHA1cd6f6d9aafaf9efa51a62ef38b5be815bb422d30
SHA25625e2e77cf120935c49594ec5913d05ffd88a2811cdd1c40edbbff7cd50197922
SHA512d975b339c7628bfd5a7d75e8b48d9c14452658e652e8a5deec314dec60d990992979d9f17b082b0fd50dd6bb5f92b65c5366c0efe68dbae57f95cb501af3ed40
-
Filesize
53KB
MD540884bc60fccd1c9b0f73ad3a245c681
SHA1fee63392b8042a8ac7e6f2283a7204b5fd668518
SHA2561e4ada20fd8a2eb3e5f024c277a50c2b9327353dae2e0191ff57c91a8207de6e
SHA5126e2b4bde8d2656854ba41817159e1ea5d807b88439b24a7e0fa2cc1c0dcb1eb2c4d0c96b2547199f7e7581bf7a89fac92344e37ce5c552ee41b666a757a87580
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
