General
- Target CrowControl.exe
- Size 76.5MB
- Sample260831-e3kzpsxsb1
- SHA256 5c31b4005f44be2d8bebbb4d22265bde91fdd3428f4105e8569e4f37e5d5cedf
- MD5 d4e45f2b4e8b93927ef12146269b1a2b
- SHA1 d7e2fb12b6401f48e20e937eae6042106eaede4f
- SHA512 81f09eea5943ed5fe38abb7ab7d0d7a527993ea06288a1354df2cb826b4a091a8989f6cdb384115d7878adb713910b6db98b891bf1ca8f811b0662ea276cb37b
- SSDEEP 1572864:ZKXzjvUMOtMW6Q+dy2J0f0/rBdsG7bpip0WWdiIkK4cNpZ7yQq5qq:QXPUX2dQI5BB7tE0WGN4cvZyQgqq
- TLSH T1C70833058A16569FE28DA737F2E2D91F3BD3244B8756C1C92BD00D478B6B1C9DE78C22
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
CrowControl.exe
Resource
win10ltsc2021-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
CrowControl.exe
Resource
win11-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target CrowControl.exe
- Size 76.5MB
- SHA256 5c31b4005f44be2d8bebbb4d22265bde91fdd3428f4105e8569e4f37e5d5cedf
- MD5 d4e45f2b4e8b93927ef12146269b1a2b
- SHA1 d7e2fb12b6401f48e20e937eae6042106eaede4f
- SHA512 81f09eea5943ed5fe38abb7ab7d0d7a527993ea06288a1354df2cb826b4a091a8989f6cdb384115d7878adb713910b6db98b891bf1ca8f811b0662ea276cb37b
- SSDEEP 1572864:ZKXzjvUMOtMW6Q+dy2J0f0/rBdsG7bpip0WWdiIkK4cNpZ7yQq5qq:QXPUX2dQI5BB7tE0WGN4cvZyQgqq
- TLSH T1C70833058A16569FE28DA737F2E2D91F3BD3244B8756C1C92BD00D478B6B1C9DE78C22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1