Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 22:34
General
-
Target
file.exe
-
Size
2.6MB
-
MD5
801e7993452aba2a57ecc6258323a42f
-
SHA1
269b38bc8080210f48c7418c80950d5e510e53fe
-
SHA256
8a5f6619791694385d6e684913ce6bb67351aa45c0f8e11e47c4856dbc57fae9
-
SHA512
cf311410d38f2d3b821b7a48616b36a1729f1448fc8137eaa4e71ad511a0dd34460132f3512534420a436fef8c95b63ee5458d194e3295fa3824ef1f2aed10bc
-
SSDEEP
49152:Fk/epguhlPHbm8/rJN3kXBdNvOlJ18IpzMRHWtpglbIhZOW9hCjuW5OhgIn:FCeicTm4FaxmvtYR2MlbpMhCaW4hVn
Malware Config
Extracted
cryptbot
kotbri22.top
moruzj02.top
-
payload_url
http://okavor03.top/download.php?file=acaboa.exe
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 21 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
662KB
MD5a295ebc78f291e86350ed3f24c93ad2e
SHA16278625abf4b7caaeb876c80c6979ebb2d3e4da9
SHA256c994377a576a2c6c3c23167eb516a39584c3dd6565cc158aa2f57dfe18f27ac6
SHA5128df77ca9f099bae1ec39c5a3777d3d1d7bbd23b34ebb93e94b962b0ac8c6a0c0f0ec14fa8b5f38fff1449132fec0481762413d7f421e4ab7d60a22c217e17ae2
-
Filesize
1KB
MD589e5d06414594a422ec78a3d907b3c9b
SHA1fc11593ebac88bcfdbe7b31a597e2bd2d393cea8
SHA256df6e0a46bff7b3c9e99bd334bdb05412472ed0aaeba4f5df70c2c647f7c5c2b9
SHA51266e78c4c448237025d13e120364101ed679db1abefa01a4d6f1843abc55fbb89af3b404048a345e813a4254a867564f61ca49c8b2c2ba9010a2ea4839d491d4f
-
Filesize
4KB
MD545698a34d01d990d33e7cc48b795f489
SHA15bd7960df68dea5fac2d4cec965c302d05a42d52
SHA25627470659f11481069527b993d5d1f05008eee7a60c18fff6361c7439a56c5f59
SHA5120f31f1bbe33b2b3306ea04fbc15c6b2bd3b847a021ac4dfe4e5a67b788fb952f958fed2575746416f3d092cc1990402b6ea340c6245fb7446bc8dc9cc5445c66
-
Filesize
53KB
MD5b36c6ebd7b0d1372ec5bb69d07116687
SHA1eaf7a7ea9dcb06ef203a0c8cfeb17aa77c9b0476
SHA25676de6f45bbc6eeb97d2df872b86bba6a234dc3e65b44658caa04e771ff93dd1f
SHA512ffc733162f78c4af62cd6e36862d28fe0a9882ee00a7add6b5873462dc4ed35cb7c2ca176099e2270dbc6b386e984333da0d7c689352adad5858de654795db9d
-
Filesize
718KB
MD5af845be5ca4db5f314be7e7fba52e5c9
SHA16b47093afb0f15eec15d0bd29ef74a786f9b9114
SHA256212b26ea27aa8d65d881b64a0b3f7615ce055c8fbc136d44dd04b3459ca514fb
SHA51200ca6e74df8d28e688387b524e29b679dc18348e12c9235c701d6f17102e08767f61e311751cca016c5e95c06d7c67a4daf3e44eb71184b140c6f87aca67a517
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
