Analysis

  • max time kernel
    92s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 01:41

General

  • Target

    setup_x86_x64_install (14).exe

  • Size

    1.8MB

  • MD5

    961ed865e49001eab634e7f1d49d4865

  • SHA1

    ac28f77d1b75703518ebf6df8cdafa77da9a08aa

  • SHA256

    00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

  • SHA512

    8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

  • SSDEEP

    24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

Malware Config

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 3 IoCs
  • Cryptbot family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install (14).exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install (14).exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cmd < Sommesso.ppt
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\SysWOW64\cmd.exe
        cmd
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\findstr.exe
          findstr /V /R "^ZOQsXtAtHxdyuhsSoVBajbWjbeoOEYrTNLMLtwdlZxVnlJckSKVqpClCSEUVWLmIsbsxAFNuFdaSBbwNGXVTeeJkApTAicggUhuNawKhWPcSpaw$" Apparenze.ppt
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5000
        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com
          Pensieroso.exe.com N
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4084
          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com
            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com N
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2784
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1712
              • C:\Windows\SysWOW64\timeout.exe
                timeout 3
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:1268
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 30
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Apparenze.ppt

    Filesize

    872KB

    MD5

    2caf8e89e6a05bb30057c7c470fdf260

    SHA1

    edb048d2d92046e97b2f991e9dbec16247ee5d8c

    SHA256

    492fcd3db49355cefd9c23e78d0a3c3082037f4d2e6ccaff65c81273255a22e8

    SHA512

    4f0e0f11c989f4030c77e274e919cb10a4b93283591d2e79f8ff4d3d44c0384dead702804abe221b54b32c8eeaa6be845e0d59cac336f6cf9256c95ae3469f3a

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ingranditi.ppt

    Filesize

    663KB

    MD5

    9fef53ec7afd145869f53138338e189f

    SHA1

    17d26e52ca0cb3de7083b5737f7b2a84a483b462

    SHA256

    e2cce7b050bc38ea22285645f3953ea3f9ea7dab11b94da0612ebace7f59eb09

    SHA512

    b434b0839269cdc32edb0aa94b570de2e19761feb0460be7fbbc5ef2250adc09ab138c1a0ab591b89dee06957c3559dbc69af156fa560c30c19d1509be8bbaa4

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Isola.ppt

    Filesize

    894KB

    MD5

    0d1cb8e6cc1623b8a86ecabd84613e0e

    SHA1

    353b60c29f0fb219f6b1f49b112038912ec040c8

    SHA256

    05ebdcbe3983b1f87e69ffcdab45a2692e0248bb6beccbaeebacad4fb1d72bc4

    SHA512

    0af070ec9d3dcac2103f6d259b3d847303c0c14d245f3f6d8a86f81f233fad3048632c8cf43f93d3f53dca974a0ff0a61732686471a24df5d391c025757eda38

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com

    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sommesso.ppt

    Filesize

    325B

    MD5

    1b4d94eb8f5923f889afcbe5caddd449

    SHA1

    c613c7cfe6db911b07760a7767492de829cd37e7

    SHA256

    812f3d792ef7a99472b2aff8ee37c09218aed327036292cea950f27981071885

    SHA512

    6b4f3b1c3afc5acc8252746ea02eb59f1dd5d314439ea86097f3c0144aa13f2b955c77aa1d980a93f2e342393258d3943f14ca7708f303195b66f1fb5cd24c88

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\ENYOWX~1.ZIP

    Filesize

    45KB

    MD5

    ff5576a6fec8b769427a18f5d2fe8044

    SHA1

    c00cb5f15195867a976aa1e1207a96cd97d5de68

    SHA256

    6271c6cfa3ed8efab1498241e4c4de4377de09bfb628d6de4af8bf5c0c3b5791

    SHA512

    cf043f3e5f8c8d0f25a68cc81a3d849cb39c8eb9f4e60a9885b23cc7159684a1ebfd1e9d4f0bb9ae4d899d2aa9e12b1da0fad273779822b445d15d6c4880f43c

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\VSFMUW~1.ZIP

    Filesize

    45KB

    MD5

    bae7a08097e09b8713516cfd040f3d4f

    SHA1

    c3cd3a609d98d95a1948f4dfae09d171cdf49e10

    SHA256

    cdafad123d5337b1e59d914a9ec28ab9c1a927c8f6615c81e1567f3926a51138

    SHA512

    cc4de15bfadbca17fe80237dd0358e92e0eb76cc04435e1ae59fd5aed2605a9222405a6ec874418883c94fec0be39297123eac24d952cb78bb8485e1e6fe14a0

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\_Files\_Information.txt

    Filesize

    7KB

    MD5

    8cd68904c6eaaa8f1758af6c4e7f601a

    SHA1

    04aeba1225bc50298f76c0aab20ebc36d1c9502c

    SHA256

    2a66e6bae2201a1a7c50c5ff75ef18285f3c5f5ceb4f9fcfd4358042264c5592

    SHA512

    dc3d6173ac3b01efb2aec26e1fdb392d91dc1d84691d6e977b1911f39568ca208303a36b94fa79dca278fc8cd200028e9f487f3a63ab6923a720efad6c6ea5e5

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\_Files\_Information.txt

    Filesize

    7KB

    MD5

    63e4195e86a58a105b2212ff3f7532d2

    SHA1

    6b4af0d8fb6d863fe40db20ea95690d1ebe9589c

    SHA256

    d7397a162d934bd052f88a314cbfe059876e59ab5b38d268b417e3e84ec2697e

    SHA512

    14669481355c5d900f2889a1c75cad8e75dd98bf58443cefc62b6521a608db4cf0dbbe09d201613919d9b5d688d6d31070947e84db6664f81729ac632c11108f

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\_Files\_Screen_Desktop.jpeg

    Filesize

    50KB

    MD5

    e97d6cb0d00ec3b2a193ab7102512ecb

    SHA1

    88bb4e4cb80fc695fc1701cabc4d00ec4030ed3d

    SHA256

    49f4bd0ffa1b81138bfe3b14e765915323e3101e24bc16213367d68d6a25c28d

    SHA512

    26b0f909be7a2108481a96140550481d675df9ffc7e143369aa479805f8a793f9de35c44934936c961860608e0548d94018199cec64409f2dab6d034ec8665eb

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\files_\system_info.txt

    Filesize

    7KB

    MD5

    03e43072ba7e287d3407bc66882e4766

    SHA1

    4b51c7828a22c4a353258e85fb1314cf4386ea79

    SHA256

    64a1cdc8b59d23092f1e725a3fe02d2b9535c41cf60cc29302dd900d4df5d0d3

    SHA512

    4517aea6f15b0d4693741c41c6cac601a85b4f020309e3932559b73ce5ca0cafad94823d926a00af0ac3ce9106ed9f8249b7573577a87916626dc8ea791501d0

  • memory/2784-25-0x0000000004CD0000-0x0000000004DB5000-memory.dmp

    Filesize

    916KB

  • memory/2784-26-0x0000000004CD0000-0x0000000004DB5000-memory.dmp

    Filesize

    916KB

  • memory/2784-24-0x0000000004CD0000-0x0000000004DB5000-memory.dmp

    Filesize

    916KB

  • memory/2784-23-0x0000000004CD0000-0x0000000004DB5000-memory.dmp

    Filesize

    916KB

  • memory/2784-22-0x0000000004CD0000-0x0000000004DB5000-memory.dmp

    Filesize

    916KB

  • memory/2784-21-0x0000000004CD0000-0x0000000004DB5000-memory.dmp

    Filesize

    916KB