Windows
Analysis Report
AppSetup.exe
Overview
General Information
Detection
Cryptbot
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected Cryptbot
Yara detected CryptbotV2
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Hides threads from debuggers
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect sandboxes and other dynamic analysis tools (window names)
Self deletion via cmd or bat file
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Found C&C like URL pattern
Tries to evade analysis by execution special instruction (VM detection)
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
PE file contains section with special chars
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the installation date of Windows
Internet Provider seen in connection with other malware
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Entry point lies outside standard sections
Creates a DirectInput object (often for capturing keystrokes)
Is looking for software installed on the system
Queries information about the installed CPU (vendor, model number etc)
Queries the product ID of Windows
Sample file is different than original file name gathered from version info
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
PE file contains an invalid checksum
Drops PE files
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Creates a process in suspended mode (likely to inject code)
Classification
- System is w10x64
AppSetup.exe (PID: 4908 cmdline:
C:\Users\u ser\Deskto p\AppSetup .exe MD5: AC6538187DC00E537682C8439EDECD02) cmd.exe (PID: 5276 cmdline:
"C:\Window s\System32 \cmd.exe" /c C:\User s\user\App Data\Roami ng\31A8B1A 9C8493D8F\ isotac.exe MD5: F3BDBE3BB6F734E357235F4D5898582D) conhost.exe (PID: 4780 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) isotac.exe (PID: 1952 cmdline:
C:\Users\u ser\AppDat a\Roaming\ 31A8B1A9C8 493D8F\iso tac.exe MD5: D3807676A1CA921785102367C6BD838F) DpEditor.exe (PID: 5484 cmdline:
C:\Users\u ser\AppDat a\Roaming\ NCH Softwa re\DrawPad \DpEditor. exe MD5: D3807676A1CA921785102367C6BD838F) cmd.exe (PID: 1116 cmdline:
C:\Windows \System32\ cmd.exe" / c timeout -t 5 && de l "C:\User s\user\Des ktop\AppSe tup.exe MD5: F3BDBE3BB6F734E357235F4D5898582D) conhost.exe (PID: 5012 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) timeout.exe (PID: 1788 cmdline:
timeout - t 5 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)
- cleanup
{"C2 list": ["http://trenio65.top/gate.php"], "ChromeExt": "true", "HistoryEdge": "false", "HistoryChrome": "false", "Desktop": "true", "Files": "false", "CookiesOpera": "false", "EdgeDB": "true", "Opera": "false", "Chrome": "false", "Screenshot": "true", "CookiesFirefox": "false", "HistoryFirefox": "false", "Info": "true", "CookiesChrome": "false", "CookiesEdge": "false", "ChromeDB": "true", "FirefoxDB": "true", "EdgeExt": "true", "Wallet": "true", "HistoryOpera": "false", "Edge": "false", "Firefox": "false", "NTFS": "true", "PasswordFile": "_AllPasswords.txt", "InfoFile": "_Information.txt", "EdgeDBFolder": "_Edge", "ChromeDBFolder": "_Chrome", "DesktopFolder": "_Desktop", "UserAgent": "", "UAC": "true", "ExternalDownload": "http://yepugi08.top/isotac.dat", "DeleteAfterEnd": "true", "FirefoxDBFolder": "_Firefox", "ScreenFile": "$CREEN.PNG", "Prefix": "mrd-", "MessageAfterEnd": "false", "HistoryFile": "_AllHistory.txt", "FilesFolder": "_Files", "CookiesFile": "_AllCookies.txt", "Anti": "false", "WalletFolder": "_Wallet"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_CryptbotV2 | Yara detected CryptbotV2 | Joe Security | ||
JoeSecurity_CryptbotV2 | Yara detected CryptbotV2 | Joe Security | ||
JoeSecurity_CryptbotV2 | Yara detected CryptbotV2 | Joe Security | ||
JoeSecurity_CryptbotV2 | Yara detected CryptbotV2 | Joe Security | ||
JoeSecurity_CryptbotV2 | Yara detected CryptbotV2 | Joe Security | ||
Click to see the 4 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_CryptbotV2 | Yara detected CryptbotV2 | Joe Security |
⊘No Sigma rule has matched
Timestamp: | 192.168.2.3171.22.30.17949703802017930 02/12/23-00:10:13.688745 |
SID: | 2017930 |
Source Port: | 49703 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 192.168.2.3171.22.30.17949703802022985 02/12/23-00:10:13.688745 |
SID: | 2022985 |
Source Port: | 49703 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 192.168.2.38.8.8.857840532023883 02/12/23-00:10:13.635837 |
SID: | 2023883 |
Source Port: | 57840 |
Destination Port: | 53 |
Protocol: | UDP |
Classtype: | Potentially Bad Traffic |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | ||
Source: | ReversingLabs: |
Source: | Avira: | ||
Source: | Avira: |
Source: | Malware Configuration Extractor: |
Source: | Static PE information: |
Source: | HTTPS traffic detected: |
Source: | Static PE information: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Networking |
---|
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: |
Source: | HTTP traffic detected: |
Source: | URLs: |
Source: | ASN Name: |
Source: | JA3 fingerprint: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | IP Address: | ||
Source: | IP Address: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: |