Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
26/03/2025, 06:54
General
-
Target
131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe
-
Size
305KB
-
MD5
4309f4b4bb455f998d1fdf310cd83484
-
SHA1
4ee10072d4dff28efcd64d8dcd631760868d644b
-
SHA256
131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1
-
SHA512
3d730ec6e3b385a69fa62634f4776e98327bc8f5da6330b109d3de5b37339dcb97cf9bf489c548de23f6ff71b115e921d5179cf2606eba61783851462ba807bf
-
SSDEEP
6144:zWmk/wokUNpuDoAVUx99rpABXHxjdgwJids6m+8suhyiP:NswuNpQv299rpAVHxJgw0dsp+dTiP
Malware Config
Extracted
cryptbot
befqlo52.top
mortos05.top
-
payload_url
http://mincir07.top/download.php?file=lv.exe
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe"C:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5f25a5d549fc360578609992d3cac7ad8
SHA14884775d2aa065e03ab170f50e01f80b89bcfdd2
SHA256e505418208764e423d4d0a09bfd5bbdc43c1a74f7548e900cb82e3fb9b685214
SHA51271dbd5972bffeb7e8155ba56dc6fbf66ce201cb4e2e9ed2ccec70c871b5bd2cf2cc8561f08a2dc74e3c218252977eb25ec9c335badd27b7839d943611e3c965c
-
Filesize
54KB
MD5789e859bb99579f208be6ccb7907daed
SHA1f0ec5230b5e0f93cc0572aa7acdd7606ba42bfcb
SHA256dba07b2efdc87d3bd97143c864ed77467fc137320e5caef9a3fae72eff55f146
SHA512a35634ea66723e40be137949a7a06bb3135c3242876bf1dc9b17296f0bd489d41a6c339a6476a9b12d24e5cc66d90fbaa161747cc255aae1532cd13513f029a5
-
Filesize
49KB
MD53eabae1d5360617aaa4c0e1f40f56d41
SHA10fc17c159c111250880b0f613f91b7b1359d7f94
SHA2563e44572acd03eb56f67005e8a2ea3b38cb3d873bb106ee18f3a6721fbdb1262a
SHA5121fc056c9b3ebfeb3b5547ee06213cc9628804fa137f9ebf5f2db3f37c266e17902c46bca788ec309374b3b7996f80076767682b34aeda668bb54fdb20d44512c
-
Filesize
1024KB
-
Filesize
39.5MB
-
Filesize
1024KB
-
Filesize
276KB
-
Filesize
39.5MB
-
Filesize
288KB
-
Filesize
39.5MB
-
Filesize
276KB
-
Filesize
39.5MB
-
Filesize
288KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
