Overview
overview
10Static
static
6D02D012970...94.exe
windows7-x64
1D02D012970...94.exe
windows10-2004-x64
1DBm0yQwt.exe.ViR.exe
windows7-x64
10DBm0yQwt.exe.ViR.exe
windows10-2004-x64
10ca6ec46ee9...52.apk
android-9-x86
8ca6ec46ee9...52.apk
android-10-x64
8ca6ec46ee9...52.apk
android-11-x64
8calc.exe
windows10-2004-x64
5ccc71c83c8...B3.exe
windows7-x64
7ccc71c83c8...B3.exe
windows10-2004-x64
10ccc71c83c8...68.exe
windows7-x64
7ccc71c83c8...68.exe
windows10-2004-x64
3cd2d085998...-0.dll
windows7-x64
8cd2d085998...-0.dll
windows10-2004-x64
8cdffb7e75b...ss.exe
windows7-x64
3cdffb7e75b...ss.exe
windows10-2004-x64
3cf7382c25a...c9.exe
windows7-x64
6cf7382c25a...c9.exe
windows10-2004-x64
3cgi19-alpt...e_.exe
windows7-x64
7cgi19-alpt...e_.exe
windows10-2004-x64
7chrst.exe
windows7-x64
3chrst.exe
windows10-2004-x64
3ci05l2a.exe
windows7-x64
ci05l2a.exe
windows10-2004-x64
cl.exe
windows7-x64
7cl.exe
windows10-2004-x64
7clean.exe
windows7-x64
3clean.exe
windows10-2004-x64
3coinvault.exe
windows7-x64
9coinvault.exe
windows10-2004-x64
6com_loader.exe
windows7-x64
3com_loader.exe
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:41
Behavioral task
behavioral1
Sample
D02D012970AA164CAD15C757D7E52994.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
D02D012970AA164CAD15C757D7E52994.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
DBm0yQwt.exe.ViR.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
DBm0yQwt.exe.ViR.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral6
Sample
ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral7
Sample
ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
calc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
cgi19-alptsevs-h555.exe_.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
cgi19-alptsevs-h555.exe_.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
chrst.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
chrst.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
ci05l2a.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
ci05l2a.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
cl.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
cl.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
clean.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
clean.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
coinvault.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
coinvault.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
com_loader.exe
Resource
win7-20241023-en
Behavioral task
behavioral32
Sample
com_loader.exe
Resource
win10v2004-20241007-en
General
-
Target
cl.exe
-
Size
236KB
-
MD5
748ec019c171f22b8384195742967c51
-
SHA1
e3fefcbd3c432ac85d046a7ab27d2b0114ae658a
-
SHA256
b082e82311a6e8416b1823122959ea368316a936aa6ca667c032d300f76effaf
-
SHA512
a2bbef3dacdac5d5cf65f71f97c663b8731e2f2dbd9d923076e3551b68fce33157b961bd4709bfd6ccb1c5c807c453a8bae209538093dfe4c0662fb7e074ddc3
-
SSDEEP
6144:6741oQa1cxp/UWD9xgYxY68hX7Ph0ht7LRhU/a:v1uOp8J2Y68hLPhZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2800 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2816 wincl.exe -
Loads dropped DLL 2 IoCs
pid Process 2520 cl.exe 2520 cl.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\wincl = "C:\\Users\\Admin\\AppData\\Roaming\\WinCL\\wincl.exe" cl.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wincl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2520 cl.exe 2816 wincl.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2816 2520 cl.exe 31 PID 2520 wrote to memory of 2816 2520 cl.exe 31 PID 2520 wrote to memory of 2816 2520 cl.exe 31 PID 2520 wrote to memory of 2816 2520 cl.exe 31 PID 2520 wrote to memory of 2800 2520 cl.exe 32 PID 2520 wrote to memory of 2800 2520 cl.exe 32 PID 2520 wrote to memory of 2800 2520 cl.exe 32 PID 2520 wrote to memory of 2800 2520 cl.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\cl.exe"C:\Users\Admin\AppData\Local\Temp\cl.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Roaming\WinCL\wincl.exe"C:\Users\Admin\AppData\Roaming\WinCL\wincl.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Roaming\1.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
167B
MD543cc03e4b5ddb283fa10abfc8d09e5a7
SHA1acb4ac7841a8fd9f1ec0321d47ece0217198d6c7
SHA25624bb870ceb6fdcaffea19dcc11bc0b08b79115ee14478f54fd72ffde75b37033
SHA512dee8f946d12655a9eef3226a8e1d3ff0eff4e8e96d0cf6c1fdc08e140f1e04f87c610979cc729de6aeac9bd667f08faf06a46308eb0bb3b40b74d271315d23e0
-
Filesize
236KB
MD5748ec019c171f22b8384195742967c51
SHA1e3fefcbd3c432ac85d046a7ab27d2b0114ae658a
SHA256b082e82311a6e8416b1823122959ea368316a936aa6ca667c032d300f76effaf
SHA512a2bbef3dacdac5d5cf65f71f97c663b8731e2f2dbd9d923076e3551b68fce33157b961bd4709bfd6ccb1c5c807c453a8bae209538093dfe4c0662fb7e074ddc3