Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2024 22:18

General

  • Target

    576fc63980d3db3e2bbada7b11b7ff8585b18fa42e01cce219551799e0335510.exe

  • Size

    4.6MB

  • MD5

    d75d7dce371da77f30f35288b8ff37f3

  • SHA1

    03a63127e19682acb329a4abfffb031311854c00

  • SHA256

    576fc63980d3db3e2bbada7b11b7ff8585b18fa42e01cce219551799e0335510

  • SHA512

    4fe86c0d0d2022f1986c786e882127dda583cfb7be9df7313db9b982bd8aad1f1b8919d0e0c883c1793768e2c7c6f3a9aeb138ace7264c887f69870ce14970fb

  • SSDEEP

    98304:IGEqCZgN7219sQrtQwPWD9pEof9RvcScw2cepvi6yvSVj9QYO:IGEqC4K1uQxQwu9Rvc1li6ny

Malware Config

Extracted

Family

cryptbot

C2

verf04.info

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\576fc63980d3db3e2bbada7b11b7ff8585b18fa42e01cce219551799e0335510.exe
    "C:\Users\Admin\AppData\Local\Temp\576fc63980d3db3e2bbada7b11b7ff8585b18fa42e01cce219551799e0335510.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Program Files (x86)\Glary\Utilities\Settings\Install.exe
      "C:\Program Files (x86)\Glary\Utilities\Settings\Install.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2288
    • C:\Program Files (x86)\Glary\Utilities\Settings\Notepad2.exe
      "C:\Program Files (x86)\Glary\Utilities\Settings\Notepad2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2824
    • C:\Program Files (x86)\Glary\Utilities\Settings\util.exe
      "C:\Program Files (x86)\Glary\Utilities\Settings\util.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Glary\Utilities\Settings\util.exe

    Filesize

    2.3MB

    MD5

    1a399301e1eb1821088776166420c80e

    SHA1

    317bfecd99d6b0d7415173b55781deb4afc428b8

    SHA256

    69344b8a53d189c7640d0ada5f74b5febcd7b06e5aa5c4fc01a7c676ec986b67

    SHA512

    679e7e6c777287303e64d9c3b1d6d23fab2331708a17ba922746db240e25c35a60418f65302c294b851d2cf095cb6b5f174e3b300e74664c54df2349561992fe

  • C:\ProgramData\eAq5KB1m7vgKU\172773668.txt

    Filesize

    150B

    MD5

    cadc7176449b1ef7d75c247c7d248b41

    SHA1

    3262d7ebfe5735d499e092504c41d39fb51ade31

    SHA256

    edd1379685f9c0c83b7f870591d940432648d231a666d934dd22ea1a6c690f36

    SHA512

    67321a6d375c18a26a433051980bd868c17cef922473b43e219ec3bb94e22b05c622d3f272150252b4cb8a5d1470b5302a200d08c4d675eaec5581421a9c72cf

  • C:\ProgramData\eAq5KB1m7vgKU\1h8rHEEuM1eUXtN.zip

    Filesize

    47KB

    MD5

    4e7766f259e510ffcdd6b559a9f67e62

    SHA1

    960d186218cf2be570cc2b494653a7a5c2a4b1cd

    SHA256

    4e1fea1ccb4ccb53bc3509b92f8e6cfb01e2a36eb6f5671aaf1e68c069f96ed2

    SHA512

    5a4e53cf2b68de8d0ab20592ecea5cd8e1c2191ca9cc253528282cf07021ebffda9c0a9a8c4c639ecd151aa8cd4690d49e3b2002f768b33452a3a22e971424a7

  • C:\ProgramData\eAq5KB1m7vgKU\Files\Browsers\_FilePasswords.txt

    Filesize

    3B

    MD5

    ecaa88f7fa0bf610a5a26cf545dcd3aa

    SHA1

    57218c316b6921e2cd61027a2387edc31a2d9471

    SHA256

    f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

    SHA512

    37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

  • \Program Files (x86)\Glary\Utilities\Settings\Install.exe

    Filesize

    2.1MB

    MD5

    f59df95a5f1760ed6d213f5ad70c0510

    SHA1

    697dd19671251ed102d92cb730e7854a7611a53f

    SHA256

    2ee4567751ec4fca4a9390b4743625bee298955cc2cb6375341d673ef0003ab5

    SHA512

    f553f4053bae6236fd093be86240883b12b9457860e1249707cc4d6212a2fb953d31836106b3c1e8be3fb23de1c3835fb0aaa2e93d0e39422a03e4fc1e75f194

  • \Program Files (x86)\Glary\Utilities\Settings\Notepad2.exe

    Filesize

    693KB

    MD5

    b60d390ba42c0109ee38de2e0ca56e1a

    SHA1

    735a4eb61fe695c9bd2c9961f5fa41ac5a73d833

    SHA256

    9ac61841c5a9716c04d632f9d107a17e94af751573a50b9d2c1d5ce26e32b477

    SHA512

    97d17a96a5773f2c8c78a1b985e75314c0ad8a5d9188b6e3d327b1445c04b15b99bd1697b8b12e4f3e56d040e5570f9e7b938e4d67cacca03a947093a082dc24

  • \Users\Admin\AppData\Local\Temp\nsjAE98.tmp\UAC.dll

    Filesize

    14KB

    MD5

    adb29e6b186daa765dc750128649b63d

    SHA1

    160cbdc4cb0ac2c142d361df138c537aa7e708c9

    SHA256

    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    SHA512

    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

  • memory/1656-36-0x0000000002E50000-0x00000000033C3000-memory.dmp

    Filesize

    5.4MB

  • memory/1656-10-0x0000000002E50000-0x000000000337B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-150-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-145-0x00000000013D0000-0x00000000018FB000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-35-0x00000000013D0000-0x00000000018FB000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-187-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-184-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-139-0x00000000013D0000-0x00000000018FB000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-138-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-180-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-177-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-157-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-173-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-143-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-147-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-170-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-24-0x00000000013D0000-0x00000000018FB000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-23-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-166-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-153-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-163-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2288-160-0x00000000008E0000-0x0000000000E0B000-memory.dmp

    Filesize

    5.2MB

  • memory/2712-158-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-33-0x0000000001460000-0x00000000019D3000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-161-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-154-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-164-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-151-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-168-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-148-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-171-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-174-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-144-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-178-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-140-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-141-0x0000000001460000-0x00000000019D3000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-181-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-32-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-185-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-34-0x0000000001460000-0x00000000019D3000-memory.dmp

    Filesize

    5.4MB

  • memory/2712-188-0x0000000000400000-0x0000000000973000-memory.dmp

    Filesize

    5.4MB