Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:42
Static task
static1
Behavioral task
behavioral1
Sample
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe
Resource
win7-20241010-en
General
-
Target
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe
-
Size
4.2MB
-
MD5
e44fb60a2cfd998fee51e42e436fc4b5
-
SHA1
24edb01b49d8a6cc4533a8ada342be18c0ad13f9
-
SHA256
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9
-
SHA512
4c1169f81b3e272e8db65264226f977bd24216cc558aac28036d827e3e64b484c7b8251ff80ce8094df4137ca1c3fc2a6c4b1813191e6cd91d2d15cc0f2e2293
-
SSDEEP
98304:0Fjad1G+OLu0LP2vD2NuxY2dTpA6IjitYebn:0JKs+OLu0bUxY6dnmiqs
Malware Config
Signatures
-
Cryptbot family
-
Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
Processes:
resource yara_rule behavioral1/memory/1700-12-0x0000000069CC0000-0x000000006A71B000-memory.dmp family_cryptbot_v3 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe -
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Processes:
chrome.exechrome.exechrome.exechrome.exepid process 2476 chrome.exe 1724 chrome.exe 2440 chrome.exe 380 chrome.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe -
Executes dropped EXE 2 IoCs
Processes:
service123.exeservice123.exepid process 2588 service123.exe 1376 service123.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe -
Loads dropped DLL 4 IoCs
Processes:
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exeservice123.exeservice123.exepid process 1700 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe 1700 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe 2588 service123.exe 1376 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exepid process 1700 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3068 1700 WerFault.exe 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exechrome.exepid process 1700 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe 1724 chrome.exe 1724 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1724 chrome.exe Token: SeShutdownPrivilege 1724 chrome.exe Token: SeShutdownPrivilege 1724 chrome.exe Token: SeShutdownPrivilege 1724 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe 1724 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exechrome.exedescription pid process target process PID 1700 wrote to memory of 1724 1700 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe chrome.exe PID 1700 wrote to memory of 1724 1700 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe chrome.exe PID 1700 wrote to memory of 1724 1700 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe chrome.exe PID 1700 wrote to memory of 1724 1700 84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe chrome.exe PID 1724 wrote to memory of 2116 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2116 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2116 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2652 1724 chrome.exe ctfmon.exe PID 1724 wrote to memory of 2652 1724 chrome.exe ctfmon.exe PID 1724 wrote to memory of 2652 1724 chrome.exe ctfmon.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2144 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 1776 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 1776 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 1776 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe PID 1724 wrote to memory of 2500 1724 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe"C:\Users\Admin\AppData\Local\Temp\84363c685284008ab2c536946d3dd1b69bcbc1636754d6181b16611003760cb9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6a19758,0x7fef6a19768,0x7fef6a197783⤵PID:2116
-
-
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1396,i,17713725804246247356,11980371891533227103,131072 /prefetch:23⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1040 --field-trial-handle=1396,i,17713725804246247356,11980371891533227103,131072 /prefetch:83⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1396,i,17713725804246247356,11980371891533227103,131072 /prefetch:83⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1396,i,17713725804246247356,11980371891533227103,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1396,i,17713725804246247356,11980371891533227103,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:2440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1496 --field-trial-handle=1396,i,17713725804246247356,11980371891533227103,131072 /prefetch:23⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3004 --field-trial-handle=1396,i,17713725804246247356,11980371891533227103,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:2476
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 9642⤵
- Program crash
PID:3068
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:408
-
C:\Windows\system32\taskeng.exetaskeng.exe {D394FDDF-BEF7-4A1C-8391-63C5EBAD662C} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]1⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
177KB
MD523cf9692aa3e3744a532e0eac0c00ad5
SHA1cf329a934589c7e98d53483571b8077ba919bd1d
SHA256933031ee1722badfd9548cc9d357655d06799b125517dce4374eb5747c189785
SHA51250261448f973eae16c600939eab1f4f2341b784777d3ee786b38b5a53ec58d39ea996461e31d6bcd638dff5dde9c50f621718785a4f475d621a0a2b1baf74a53
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e