Analysis
-
max time kernel
94s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 01:01
Behavioral task
behavioral1
Sample
3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe
Resource
win7-20240903-en
General
-
Target
3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe
-
Size
7.6MB
-
MD5
0a711206f96133c8d28cd99b5910d705
-
SHA1
a100de5f4dc7a8faf50a5f6292f088c22e943303
-
SHA256
3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46
-
SHA512
03e63875a95e9d18d67635388611862a6694278038134a0e4ab8b23c43a41774b33f3dcc38181bd4af6491b66a7f91b478820b1bc7b14d31e42f20779b9a506a
-
SSDEEP
49152:Kucd9+zV4r7CLX0vDLhfFoGiux88wMKowWrpAXa9UWsnmWPh/pU02KbbgcPyzJsL:KumEwCLofapuG8nKjGGXx/qKxyz2
Malware Config
Extracted
cryptbot
Signatures
-
Cryptbot family
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4124 3024 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3024 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe 3024 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe 3024 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe 3024 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe 3024 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe 3024 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe 3024 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe 3024 3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe"C:\Users\Admin\AppData\Local\Temp\3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe"1⤵
- Enumerates VirtualBox registry keys
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 9322⤵
- Program crash
PID:4124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3024 -ip 30241⤵PID:2912
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesthttpbin.orgIN AResponsehttpbin.orgIN A98.85.100.80httpbin.orgIN A34.226.108.155
-
Remote address:8.8.8.8:53Requesthttpbin.orgIN AAAAResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AAAAResponse
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request80.100.85.98.in-addr.arpaIN PTRResponse80.100.85.98.in-addr.arpaIN PTRec2-98-85-100-80 compute-1 amazonawscom
-
Remote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AAAAResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AAAAResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AAAAResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AAAAResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AResponse
-
Remote address:8.8.8.8:53Requesthome.sevkx17vs.topIN AAAAResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
98.85.100.80:443httpbin.orgtls3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe1.5kB 6.4kB 14 15
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
160 B 250 B 2 2
DNS Request
httpbin.org
DNS Request
httpbin.org
DNS Response
98.85.100.8034.226.108.155
-
8.8.8.8:53home.sevkx17vs.topdns3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe174 B 290 B 2 2
DNS Request
home.sevkx17vs.top
DNS Request
home.sevkx17vs.top
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
71 B 125 B 1 1
DNS Request
80.100.85.98.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
74.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53home.sevkx17vs.topdns3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe174 B 290 B 2 2
DNS Request
home.sevkx17vs.top
DNS Request
home.sevkx17vs.top
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:53home.sevkx17vs.topdns3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe174 B 290 B 2 2
DNS Request
home.sevkx17vs.top
DNS Request
home.sevkx17vs.top
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
8.8.8.8:53home.sevkx17vs.topdns3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe174 B 290 B 2 2
DNS Request
home.sevkx17vs.top
DNS Request
home.sevkx17vs.top
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
148 B 128 B 2 1
DNS Request
172.214.232.199.in-addr.arpa
DNS Request
172.214.232.199.in-addr.arpa
-
8.8.8.8:53home.sevkx17vs.topdns3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe174 B 290 B 2 2
DNS Request
home.sevkx17vs.top
DNS Request
home.sevkx17vs.top
-
8.8.8.8:53home.sevkx17vs.topdns3e8ce55b21c44c397fe6080de6dec506f468c011c05808a72e8d8a64af090a46.exe174 B 290 B 2 2
DNS Request
home.sevkx17vs.top
DNS Request
home.sevkx17vs.top
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa