Analysis

  • max time kernel
    92s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 01:41

General

  • Target

    setup_x86_x64_install (23).exe

  • Size

    1.8MB

  • MD5

    961ed865e49001eab634e7f1d49d4865

  • SHA1

    ac28f77d1b75703518ebf6df8cdafa77da9a08aa

  • SHA256

    00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

  • SHA512

    8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

  • SSDEEP

    24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

Malware Config

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 3 IoCs
  • Cryptbot family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install (23).exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install (23).exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cmd < Sommesso.ppt
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Windows\SysWOW64\cmd.exe
        cmd
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4160
        • C:\Windows\SysWOW64\findstr.exe
          findstr /V /R "^ZOQsXtAtHxdyuhsSoVBajbWjbeoOEYrTNLMLtwdlZxVnlJckSKVqpClCSEUVWLmIsbsxAFNuFdaSBbwNGXVTeeJkApTAicggUhuNawKhWPcSpaw$" Apparenze.ppt
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3580
        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com
          Pensieroso.exe.com N
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4964
          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com
            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com N
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:668
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:216
              • C:\Windows\SysWOW64\timeout.exe
                timeout 3
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:3616
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 30
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Apparenze.ppt

    Filesize

    872KB

    MD5

    2caf8e89e6a05bb30057c7c470fdf260

    SHA1

    edb048d2d92046e97b2f991e9dbec16247ee5d8c

    SHA256

    492fcd3db49355cefd9c23e78d0a3c3082037f4d2e6ccaff65c81273255a22e8

    SHA512

    4f0e0f11c989f4030c77e274e919cb10a4b93283591d2e79f8ff4d3d44c0384dead702804abe221b54b32c8eeaa6be845e0d59cac336f6cf9256c95ae3469f3a

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ingranditi.ppt

    Filesize

    663KB

    MD5

    9fef53ec7afd145869f53138338e189f

    SHA1

    17d26e52ca0cb3de7083b5737f7b2a84a483b462

    SHA256

    e2cce7b050bc38ea22285645f3953ea3f9ea7dab11b94da0612ebace7f59eb09

    SHA512

    b434b0839269cdc32edb0aa94b570de2e19761feb0460be7fbbc5ef2250adc09ab138c1a0ab591b89dee06957c3559dbc69af156fa560c30c19d1509be8bbaa4

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Isola.ppt

    Filesize

    894KB

    MD5

    0d1cb8e6cc1623b8a86ecabd84613e0e

    SHA1

    353b60c29f0fb219f6b1f49b112038912ec040c8

    SHA256

    05ebdcbe3983b1f87e69ffcdab45a2692e0248bb6beccbaeebacad4fb1d72bc4

    SHA512

    0af070ec9d3dcac2103f6d259b3d847303c0c14d245f3f6d8a86f81f233fad3048632c8cf43f93d3f53dca974a0ff0a61732686471a24df5d391c025757eda38

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pensieroso.exe.com

    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sommesso.ppt

    Filesize

    325B

    MD5

    1b4d94eb8f5923f889afcbe5caddd449

    SHA1

    c613c7cfe6db911b07760a7767492de829cd37e7

    SHA256

    812f3d792ef7a99472b2aff8ee37c09218aed327036292cea950f27981071885

    SHA512

    6b4f3b1c3afc5acc8252746ea02eb59f1dd5d314439ea86097f3c0144aa13f2b955c77aa1d980a93f2e342393258d3943f14ca7708f303195b66f1fb5cd24c88

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\GOQIUB~1.ZIP

    Filesize

    45KB

    MD5

    f93a699dd5e784a3fc14ab818754e43c

    SHA1

    cc4556aaec16ca927c73524a55e2f7955b62c222

    SHA256

    71870a79eaa026c78aedaa90ba53450e0a06a8646da63cccca4c0aada303e498

    SHA512

    57e3d89370d1e33d807b3deb872d8ac4a0923a6c9c94c6ee653498b3f7f96014cd48c4ffd7e442c2f698ffdb7a37c00e36fddbb87e3d028fc507caf876ad2474

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\VSFMUW~1.ZIP

    Filesize

    45KB

    MD5

    145f4dab42accec717d8e696fb2cd94c

    SHA1

    2c91d6d97c7888189ac6e68c2929010bfd2eea0f

    SHA256

    0715441e468ee8dbb7757fbe0a63290a479c062ce58be96801509785c4508bea

    SHA512

    aebd1a9448a7030e2b9250c7dc751aaa515d7445e139c1dff618c68c6a3df581e973d8e3e793c94916633d94adda5b5355268757d7166da09384fae4ba2340a0

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\_Files\_Information.txt

    Filesize

    3KB

    MD5

    463ac4d1cb7538faf5e2ac4a562a29b9

    SHA1

    d265e1eb8d9cba2d490279e5c0de0ee338053a8b

    SHA256

    0678e2f7737b7d3679df82f55293b18484128b9d8bc4cdb62bf30b9093048238

    SHA512

    a34efc5d80a0b4d7daea19b4f245547e70c579e14d8ea6719ddae98bb840715b0840772b1d9a076df53a9b798296b4a758c2f59760f665d7a90f690f4de650cc

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\_Files\_Information.txt

    Filesize

    7KB

    MD5

    c5fe95e89505dc71c6ca7786b5c9f195

    SHA1

    5eaa6d77606f4c497e61cc235fb7e7b633cfc743

    SHA256

    e3705453b684a81aaa5326f75d411eab8ee69b2660a6c020d4c1eec0c31bc041

    SHA512

    e452990cee4edcd7a197f111378d637a2c73ef12845031e34a1e093a83af2983e383ea1c588fd29fb7b1cf3ebd0539514ae1712f8355dc7a8021dd3c085e5054

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\_Files\_Screen_Desktop.jpeg

    Filesize

    51KB

    MD5

    d100226b9be8e07a30b7cc1a8492a5ae

    SHA1

    1d92d83974ccf58f948a4f63290013e23fbecfed

    SHA256

    4681163441c81b16b87f6382286ebfc39ec153e65d5b0823ece619fc2cde5dc9

    SHA512

    683023bd54599952130750f8fb82e32d7e90602cd8b0e17b835eb0597d0190f1e61a177fc4f029272777b86435ba19a858facd472f3cecf82e7ec5bfd52e49ec

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\files_\system_info.txt

    Filesize

    706B

    MD5

    2b28b8504570241cc216c440a92316cc

    SHA1

    4f64304c34db14d9c5abd2e128793b4b5c2fd7b7

    SHA256

    8e201219594570bfdc587727a1ed260da90efcf771ee5f620d0a6338ce5667cb

    SHA512

    a8fcfd762d39a9f579f566790cbea31fedcbf324c29aae2a92bf48a12a778755c1c9a39d4a9a99daef1bbf80d8b327900fa08188b58cacedfc5b8cdcfdfd1803

  • C:\Users\Admin\AppData\Local\Temp\DSoeZwUtccg\files_\system_info.txt

    Filesize

    7KB

    MD5

    3cb8cb7854d2397e9deab9dcf63071f4

    SHA1

    33882979125660a0c5748fe6b349bd72be69ee49

    SHA256

    115872d44900843d85439816e3f240f3d10401868d408f38a40a7d7150eca05d

    SHA512

    39871bd58b89be81ea403a052f7e65e842218a00310b6b4f1e1ee6c789893ed4f8787435e0d2bc461eecaf948d462c5f4df7f75d9a2a6cfc186a434e27961310

  • memory/668-25-0x0000000004B30000-0x0000000004C15000-memory.dmp

    Filesize

    916KB

  • memory/668-26-0x0000000004B30000-0x0000000004C15000-memory.dmp

    Filesize

    916KB

  • memory/668-24-0x0000000004B30000-0x0000000004C15000-memory.dmp

    Filesize

    916KB

  • memory/668-23-0x0000000004B30000-0x0000000004C15000-memory.dmp

    Filesize

    916KB

  • memory/668-22-0x0000000004B30000-0x0000000004C15000-memory.dmp

    Filesize

    916KB

  • memory/668-21-0x0000000004B30000-0x0000000004C15000-memory.dmp

    Filesize

    916KB