Analysis
-
max time kernel
297s -
max time network
295s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
-
submitted
26/03/2025, 10:06
General
-
Target
131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe
-
Size
305KB
-
MD5
4309f4b4bb455f998d1fdf310cd83484
-
SHA1
4ee10072d4dff28efcd64d8dcd631760868d644b
-
SHA256
131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1
-
SHA512
3d730ec6e3b385a69fa62634f4776e98327bc8f5da6330b109d3de5b37339dcb97cf9bf489c548de23f6ff71b115e921d5179cf2606eba61783851462ba807bf
-
SSDEEP
6144:zWmk/wokUNpuDoAVUx99rpABXHxjdgwJids6m+8suhyiP:NswuNpQv299rpAVHxJgw0dsp+dTiP
Malware Config
Extracted
cryptbot
befqlo52.top
mortos05.top
-
payload_url
http://mincir07.top/download.php?file=lv.exe
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exeC:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe bcdedit /c set shutdown /r /f nbios /t 51⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD59bc492f7f994106ccb11b2dd5e1c1e3c
SHA1aace84d9edc463e69e5a4cf3fd4a4e0dddfc618f
SHA2560cfafaded8d9eb7d80ddd6f9b9410d6e3684f16e04b37c9a2d43f5464b702201
SHA51256fab7ba816bfa1d5853eedc09e7959a4b52a77135513bc009e90b95c354c687c3ca9f22de1dbc5406ea796e714cf06d8b0e42fca600138d09ae7e732b2eecf0
-
Filesize
5KB
MD5d89ea8811bdd6c1436c2ced14ff1e360
SHA1e82f32029bcab8c3b421157a5969f91ef4c2270d
SHA2567891f6cac64a16a10d80e4c8116bc36b691df691f13f2bf122f73a417fdeb91f
SHA51246eb84e35e1640b710ee1e5ab79f9ffd9c61ece2b0bc0c2475e3f855a789beef40ed90a6e8ebe7899c466a0f34b69a72922ca2ef4a1629ae9c8bc9bd4886c751
-
Filesize
51KB
MD5a1400eee9eeeaffe7dbbcd3f3359c246
SHA1e0972eaec5fd5995baed7687b8be2ea466a9200b
SHA25608091739f5225826946b7c1a0905ef37ba14f7d2136f061e974e0dce90caa370
SHA5129e27bfe01d9399a729dfaf69bf336908efb4a5b7bbedf6258cd77ed14b222823f31735d29c69448b397e422223a456ed5bf2e26d1a0624719cd4c506f2642194
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
276KB
-
Filesize
39.5MB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
1024KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
1024KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
276KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB