cryptbot | f2a7cc00ce9933490e51df2d5df9e7b0b2165c73297a9fa8a99fbf51b85926b8

Analysis

max time kernel
9s
max time network
11s
platform
windows7_x64
resource
win7v20210410
submitted
27-05-2021 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a4c96515b10859b7053a4f717b61608.exe
Size

737KB
MD5

1a4c96515b10859b7053a4f717b61608
SHA1

ba141d261cf8ee1f33cfb0c4c820d840850e781b
SHA256

f2a7cc00ce9933490e51df2d5df9e7b0b2165c73297a9fa8a99fbf51b85926b8
SHA512

c0743b15628637e403072d291d099d919382e05cb701a601ebac5703adf4c78b064918ec3050c122862c1e5fc6933123309028881c6e49d7b42c1a94200835d0

Score

10^/10

cryptbot spyware stealer

Malware Config

Extracted

Family

cryptbot

geowqr42.top

morckp04.top

Attributes

payload_url
http://rogaow06.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1100-61-0x0000000001EA0000-0x0000000001F81000-memory.dmp	family_cryptbot
behavioral1/memory/1100-62-0x0000000000400000-0x00000000004E5000-memory.dmp	family_cryptbot

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1a4c96515b10859b7053a4f717b61608.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1a4c96515b10859b7053a4f717b61608.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1a4c96515b10859b7053a4f717b61608.exe

C:\Users\Admin\AppData\Local\Temp\1a4c96515b10859b7053a4f717b61608.exe
"C:\Users\Admin\AppData\Local\Temp\1a4c96515b10859b7053a4f717b61608.exe"
1⤵
- Checks processor information in registry
PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-60-0x00000000757D1000-0x00000000757D3000-memory.dmp

Filesize
8KB

Download
memory/1100-61-0x0000000001EA0000-0x0000000001F81000-memory.dmp

Filesize
900KB

Download
memory/1100-62-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download