Analysis
-
max time kernel
295s -
max time network
294s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
-
submitted
26/03/2025, 10:06
General
-
Target
131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe
-
Size
305KB
-
MD5
4309f4b4bb455f998d1fdf310cd83484
-
SHA1
4ee10072d4dff28efcd64d8dcd631760868d644b
-
SHA256
131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1
-
SHA512
3d730ec6e3b385a69fa62634f4776e98327bc8f5da6330b109d3de5b37339dcb97cf9bf489c548de23f6ff71b115e921d5179cf2606eba61783851462ba807bf
-
SSDEEP
6144:zWmk/wokUNpuDoAVUx99rpABXHxjdgwJids6m+8suhyiP:NswuNpQv299rpAVHxJgw0dsp+dTiP
Malware Config
Extracted
cryptbot
befqlo52.top
mortos05.top
-
payload_url
http://mincir07.top/download.php?file=lv.exe
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exeC:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe bcdedit /c set shutdown /r /f nbios /t 51⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD559d4bf15c11f039887c3ef4566a9560f
SHA18a6d382e6b47a01d461d51b62f0818333f48dbc9
SHA256fc013982ba6b0e96f52d78cb7c8d814656bac09eaff9575587d988b6e6000527
SHA512f74b34fc04583a16e9a965dc5e17fe58e17beede8212a3192a469201e450be365011a981dcd6368efa2f29333ecae94c112a55c25b9ab0b2e46d3006f03ebc87
-
Filesize
1KB
MD5143cae921d6a4a19e659f6ff41e987fd
SHA14847743cb7f427cd9415ecb45961471299acf462
SHA2563bec68ed05a222d532b14bed9a024392d6dd78b9e106b9579362636abc7d122d
SHA512eb489e66b36b6e6c6d918ba3daf6538afd53377b34ad356b6645f8fa3f890c2b3a6bf09127a0c397f0286ac9dd9f60da301afafb349cd5e153d1dc373e522e96
-
Filesize
8KB
MD52b79f7d8178fd0fc6ce7f4c97261e504
SHA1950e80dd7d4c9f4d67784055a25d4992d8d25faf
SHA256821edaf470cce0de26b0e9d4d1b5f1278f618eb3cb8650fe9e1cf1009aee8731
SHA51200a0a82269de18fc8a80316a25b7c5b0c99559947c0d5cd998dd7a22551784b68ebca8113790bf67debe3eeddef69e6c87c1941e9db11340a591666c6b2413db
-
Filesize
248KB
MD518cde505fb8a082d6fcb1c6942531db0
SHA1094a410d225e575b3ffbddee0adfc498f57d0eac
SHA2567b0e00fe0f93339a62576eb2bec199745a572333eb043f538025025796c94e2a
SHA512895149ae22d4ee7809cabb969c9bd77879e8231accabea69b2be9f14661c69eff4b7770dd507dc6b29d7dc71491820438ce496eb9a85f031e98da42cb80269d9
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
276KB
-
Filesize
39.5MB
-
Filesize
288KB
-
Filesize
39.5MB
-
Filesize
288KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
1024KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
1024KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
276KB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB
-
Filesize
39.5MB