Overview

overview

10

Static

static

10

open-need-...07.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    15-02-2025 15:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    open-need-this-707.exe

  • Size

    8.3MB

  • MD5

    2761863597a1e22c894a88265eb6fdbb

  • SHA1

    3814875979acf7329d70957a208659528a4c83c6

  • SHA256

    cd5fd68c44426d71df9bbd25c62b425932f9c2e1d5fe020e70ee1b73e3af5292

  • SHA512

    2fccf5a720f70a9091ccd31fb1c1f5a5f7d52cf89d0e7fe79028f18c56285d4465cd674f85266dbdceb1ec561dadbc831a2da37fa9a0c3cf3bf7f677d3ebca4b

  • SSDEEP

    98304:pn8Yxk5fQ4RtDc7lIwd9ISwOnSKXyz8Xa:9S5Y0tK6MnnS8G8Xa

Score
10/10
cryptbotadwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

cryptbot

C2

http://home.thrtjj13sr.top/eqlJMJRyIxwLXPguLiyp16

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\open-need-this-707.exe
    "C:\Users\Admin\AppData\Local\Temp\open-need-this-707.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2256
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTE3MzQ3NTEtQTQ2NC00RUEwLTk4Q0QtREZDOTkwOTQzRUE0fSIgdXNlcmlkPSJ7NUYzREM4MzktMUIwRS00MjhELUIxNEQtNzkxMTQyQzJGRUI5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OTNFOENFQkQtNDk1My00NEU4LTgyMTEtRkNDNkMwOTUyNEIxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNCIgaW5zdGFsbGRhdGV0aW1lPSIxNzM5MjcwNDg0IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM3NDE5MzM1MTUwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY5MDY1Nzk4NiIvPjwvYXBwPjwvcmVxdWVzdD4
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:4596
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\MicrosoftEdge_X64_133.0.3065.59.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4020
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff701ef6a68,0x7ff701ef6a74,0x7ff701ef6a80
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:3856
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4728
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff701ef6a68,0x7ff701ef6a74,0x7ff701ef6a80
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4988
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3252
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff718f86a68,0x7ff718f86a74,0x7ff718f86a80
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1136
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4196
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff718f86a68,0x7ff718f86a74,0x7ff718f86a80
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1816
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3388
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff718f86a68,0x7ff718f86a74,0x7ff718f86a80
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Browser Extensions

1
T1176

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

4
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3B8D6548-5BBC-41A0-B0BE-768E9E88C6A1}\EDGEMITMP_1DB98.tmp\setup.exe
    Filesize

    6.8MB

    MD5

    1b3e9c59f9c7a134ec630ada1eb76a39

    SHA1

    a7e831d392e99f3d37847dcc561dd2e017065439

    SHA256

    ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

    SHA512

    c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

    Download Submit

  • C:\Windows\SystemTemp\msedge_installer.log
    Filesize

    72KB

    MD5

    c6f4328b9509f8edd1916dc09cfeb03b

    SHA1

    d78237ae8908d347ee71b08e6ca17b0eb69c2e23

    SHA256

    1da8f90f7efc76a5a4b7b9fe8bda4a5568703bf2b6f1e401cb754ada87f07254

    SHA512

    03ca8eafd1ec03d53f0d5ea8229df59806f501bab7403bfd0446a45ed8c2b6096d8ba573f943a9372a3cfd7a843aa180e88195b1d0d6a7716ac41ec9a21576f6

    Download Submit

  • C:\Windows\SystemTemp\msedge_installer.log
    Filesize

    101KB

    MD5

    960eda9b8a0f4ac19f5bfb22970cc24e

    SHA1

    af657a92450fba6b22e01cf4a7274eac487aba91

    SHA256

    1dc38a939a0b6c3c2ab9d5ccecfba7a6912b298ec37bb285568b88a4a829ba85

    SHA512

    7ce0a83dc179f4e8722716168339665e809f96beaca78cb2ed425306ed90e61bddefe171534aa2c792709941c614e0a3d95412fbbdee936fc4d818d9b1b1ae92

    Download Submit

  • C:\Windows\SystemTemp\msedge_installer.log
    Filesize

    104KB

    MD5

    d7b91df2e84a979b51f91355f9444a11

    SHA1

    d877058d06e9df5e3f5bd61dcdf70b40d38fb283

    SHA256

    e61609a53ad9111d6be0848cbefd2713d1ca3eddef8483fedeab5aa768b9639e

    SHA512

    794a36cfc0aeb006095046e1c971bb315c4e3cf048b5da35db12479fb3c31856fc8376af891ca7137758e24bf3b94694ee5c3e1f57e063915681ff37e6b86f66

    Download Submit

  • C:\Windows\SystemTemp\msedge_installer.log
    Filesize

    105KB

    MD5

    55157175c868bda44aec992c47ffd6db

    SHA1

    19e02e73111d4e1126bb8dd9807019a645912779

    SHA256

    888910bee4816cd64fc94b8dd37fa3d34ef84208f5b6dd361b27ce32d3277645

    SHA512

    7c6f1d441cc6ad71f372c7d2f97562af8a20d22be8c1a96f9113f8659715ff25d0320f3d08563499750aee9221b2be304068c77924e62847c066c529ecb91679

    Download Submit

  • memory/2256-1-0x0000000000150000-0x00000000009B1000-memory.dmp

    Filesize

    8.4MB

    Download

  • memory/2256-2-0x0000000000150000-0x00000000009B1000-memory.dmp

    Filesize

    8.4MB

    Download

  • memory/2256-7-0x0000000000150000-0x00000000009B1000-memory.dmp

    Filesize

    8.4MB

    Download

  • memory/2256-20-0x0000000000150000-0x00000000009B1000-memory.dmp

    Filesize

    8.4MB

    Download

  • memory/2256-64-0x0000000000150000-0x00000000009B1000-memory.dmp

    Filesize

    8.4MB

    Download