Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-12-2024 12:27
General
-
Target
InterVpn/bin/InterVpn/vruns.exe
-
Size
2.1MB
-
MD5
1490ea3019282b9fd5825bfd6f73b1cf
-
SHA1
fa2c9a028db4dd83fa80fef8c90ca2bf34dc881d
-
SHA256
8f01777956479851c4c5dd06845ba0d4561b2a085472460447d10b46d4b89487
-
SHA512
bdf82235c3a3b94360c4e2507c6adb07d1731fff16b9d9038f9faed34ee55d60b70d9ca24a2f2baba7fcd4c95716d52590ed62a7802c068a8ae35d5213dfaced
-
SSDEEP
49152:pqDYHrp6q7Mgk+fSdHspFpgmDHI/LiVN955NjxvtEpAL7Mc:4aPfSdMT1DGgNjxlEp3
Malware Config
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\InterVpn\bin\InterVpn\vruns.exe"C:\Users\Admin\AppData\Local\Temp\InterVpn\bin\InterVpn\vruns.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD5cadc7176449b1ef7d75c247c7d248b41
SHA13262d7ebfe5735d499e092504c41d39fb51ade31
SHA256edd1379685f9c0c83b7f870591d940432648d231a666d934dd22ea1a6c690f36
SHA51267321a6d375c18a26a433051980bd868c17cef922473b43e219ec3bb94e22b05c622d3f272150252b4cb8a5d1470b5302a200d08c4d675eaec5581421a9c72cf
-
Filesize
3B
MD5ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA157218c316b6921e2cd61027a2387edc31a2d9471
SHA256f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
SHA51237c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
-
Filesize
1KB
MD5840d2d6b948b719f58ba12c34efe042b
SHA1f8908da3bed9cf997199b08d891ab2dba241a267
SHA256c9769c9043e4881a2375f5fc8ff35642151d9cce920138494fcd77a3715baaf1
SHA512afa22a75870d831b7f866dc7b8f01dca90a3eb066e330b0f5267e6c79143bd4f845b55a7472447ce2609bbafa8147a7d6b94f2c5fee03c099309aa98dd7bbdc6
-
Filesize
515KB
MD5011d3f1632778aa7540822e4f35f7292
SHA10dc96b03617d6fc97dd7ae9bf6b19a0a75d1919c
SHA256109850c0a38a91c6101d823f0ff0605e7020fbad6177809797396b285e00b9a1
SHA5128b2d01aeb77e8a9e0da016c9cc113519654d94cf5c41ab2a021789168963696631d8189191aff3a92b6a2438da5d13266f04c0db3dd8ba9ca2ac3f86f7204467
-
Filesize
92KB
MD50040f587d31c3c0be57da029997f9978
SHA1d4729f8ed094797bd54ea8a9987aaa7058e7eaa2
SHA256a285e3bc24d218869afd114c236f0aafebeba96d4105ddd379ae31f03b26079b
SHA5123e4ffca2ff979b5f91a0c8d5d1fa52f0ab47ff63e50b1cc5e7708c4ba8359ee8505a9259f329da5733048e953f0778af73ce76735b481d558dd05a2cb45a5977
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
356KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
8KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB