Analysis
-
max time kernel
299s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
26/03/2025, 10:06
General
-
Target
131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe
-
Size
305KB
-
MD5
4309f4b4bb455f998d1fdf310cd83484
-
SHA1
4ee10072d4dff28efcd64d8dcd631760868d644b
-
SHA256
131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1
-
SHA512
3d730ec6e3b385a69fa62634f4776e98327bc8f5da6330b109d3de5b37339dcb97cf9bf489c548de23f6ff71b115e921d5179cf2606eba61783851462ba807bf
-
SSDEEP
6144:zWmk/wokUNpuDoAVUx99rpABXHxjdgwJids6m+8suhyiP:NswuNpQv299rpAVHxJgw0dsp+dTiP
Malware Config
Extracted
cryptbot
befqlo52.top
mortos05.top
-
payload_url
http://mincir07.top/download.php?file=lv.exe
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exeC:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe bcdedit /c set shutdown /r /f nbios /t 51⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5ce6a2c0028ac5a1fb545a76f5b4a1da1
SHA153a8dcf84e290e2124a67bb158daf430aede2094
SHA25680611d6206741ad20829935f98f58af77f85e4d2096bb35f96a48676f45cb052
SHA512313ad48e372f46ea61fb87b333847a2bc0dee9e557855ebba3dc723c77455e38764de0d2a5b4080aaf37f7ec1f860de28cfd6b14696366bf2c08c48657fa60b5
-
Filesize
7KB
MD59e9f42057b052b08dce3e9b7b6c4196d
SHA1c0fee09a4c1a300f355bd1d252a27712eabf132d
SHA256f2634b71128fac6d337135f7e5749abae86f7b4af5daab224ee74fca49464711
SHA512eaa3f8d2d770bb9a812c0b826cb05928fa77410e33a88f08042d26b5bc470f1173cbf0ca7b43b6ec9dce620dc109d62d4f03a5e0f6eb377a91867ef43a3da570
-
Filesize
51KB
MD5b447c2758dec30d2cb0f8b3d03e77bee
SHA1455a66be91f876d0fd3928a4e29a55ead48479c0
SHA2566e7bf6ed335a940dcbb1c36f4fd5194469c12573182fcab69be0328531b9975d
SHA512b4b1c06177df17d5298d2046c162d5ac37a45183f631c563ddd137f303c2df262ddd842f8876629918d65eeaf0bacba94188e2d8fa93c70aa35ee2560654c927
-
Filesize
46KB
MD5957d10c58dee7fdff4de9047ff22e8a1
SHA1997fda39a4010529f2f14cd6c4514de9fd641dcb
SHA2569ee3931036af02b501d06432406452251ef9d5c50ba94fa6afd51f89e7ae2c8d
SHA51272175cb5e340bcc22a33f31c30efc0b31de484bee4602b49e7d5a441c0ee8bb5e5819ed801969f076f5f953bdbcb5a27912515d110014dde43abbe83435952c9
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
276KB
-
Filesize
39.5MB
-
Filesize
288KB
-
Filesize
39.5MB
-
Filesize
288KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
276KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
1024KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
1024KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
