cryptbot | 04c7a8fc8e75fa2a6f788b3c92cd46d6d99a517add2f875d9fdf8b4377d54acf

Analysis

max time kernel
150s
max time network
145s
platform
windows10_x64
resource
win10v20210410
submitted
31/05/2021, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88e0aec3a6fafc199feb2171cb04a634.exe
Size 1.7MB
Sample210531-m5r227f85e
SHA256 04c7a8fc8e75fa2a6f788b3c92cd46d6d99a517add2f875d9fdf8b4377d54acf
MD5 88e0aec3a6fafc199feb2171cb04a634
SHA1 66621986e07fa188ca06665b6a06587ef721cd8c
SHA512 7da1dfa392e516ef2f087eaf562f92dc8908036f4173eeeb604b860eee8ba13a4459774cd2416ac7d1330e45e90b12e2f44207eeec733c0e3fa7cc2e21d01868
MD5 SHA1 SHA512

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
4052	Parlato.exe.com
188	Parlato.exe.com
2488	RFDcyh.exe
3936	vpn.exe
2984	4.exe
1764	Subito.exe.com
1788	Subito.exe.com
804	SmartClock.exe
1460	bpkmreth.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe

Loads dropped DLL 3 IoCs

pid	Process
2488	RFDcyh.exe
2088	rundll32.exe
2088	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	RFDcyh.exe
File created	C:\Program Files (x86)\foler\olader\acledit.dll	RFDcyh.exe
File created	C:\Program Files (x86)\foler\olader\acppage.dll	RFDcyh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Parlato.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Parlato.exe.com
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Subito.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Subito.exe.com

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2300	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	Subito.exe.com

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3956	PING.EXE
3952	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
804	SmartClock.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
188	Parlato.exe.com
188	Parlato.exe.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2464	3016	88e0aec3a6fafc199feb2171cb04a634.exe	75
PID 3016 wrote to memory of 2464	3016	88e0aec3a6fafc199feb2171cb04a634.exe	75
PID 3016 wrote to memory of 2464	3016	88e0aec3a6fafc199feb2171cb04a634.exe	75
PID 2464 wrote to memory of 2792	2464	cmd.exe	77
PID 2464 wrote to memory of 2792	2464	cmd.exe	77
PID 2464 wrote to memory of 2792	2464	cmd.exe	77
PID 2792 wrote to memory of 2284	2792	cmd.exe	79
PID 2792 wrote to memory of 2284	2792	cmd.exe	79
PID 2792 wrote to memory of 2284	2792	cmd.exe	79
PID 2792 wrote to memory of 4052	2792	cmd.exe	80
PID 2792 wrote to memory of 4052	2792	cmd.exe	80
PID 2792 wrote to memory of 4052	2792	cmd.exe	80
PID 2792 wrote to memory of 3956	2792	cmd.exe	81
PID 2792 wrote to memory of 3956	2792	cmd.exe	81
PID 2792 wrote to memory of 3956	2792	cmd.exe	81
PID 4052 wrote to memory of 188	4052	Parlato.exe.com	82
PID 4052 wrote to memory of 188	4052	Parlato.exe.com	82
PID 4052 wrote to memory of 188	4052	Parlato.exe.com	82
PID 188 wrote to memory of 1504	188	Parlato.exe.com	86
PID 188 wrote to memory of 1504	188	Parlato.exe.com	86
PID 188 wrote to memory of 1504	188	Parlato.exe.com	86
PID 1504 wrote to memory of 2488	1504	cmd.exe	88
PID 1504 wrote to memory of 2488	1504	cmd.exe	88
PID 1504 wrote to memory of 2488	1504	cmd.exe	88
PID 2488 wrote to memory of 3936	2488	RFDcyh.exe	89
PID 2488 wrote to memory of 3936	2488	RFDcyh.exe	89
PID 2488 wrote to memory of 3936	2488	RFDcyh.exe	89
PID 2488 wrote to memory of 2984	2488	RFDcyh.exe	90
PID 2488 wrote to memory of 2984	2488	RFDcyh.exe	90
PID 2488 wrote to memory of 2984	2488	RFDcyh.exe	90
PID 3936 wrote to memory of 740	3936	vpn.exe	91
PID 3936 wrote to memory of 740	3936	vpn.exe	91
PID 3936 wrote to memory of 740	3936	vpn.exe	91
PID 740 wrote to memory of 1348	740	cmd.exe	93
PID 740 wrote to memory of 1348	740	cmd.exe	93
PID 740 wrote to memory of 1348	740	cmd.exe	93
PID 1348 wrote to memory of 2160	1348	cmd.exe	94
PID 1348 wrote to memory of 2160	1348	cmd.exe	94
PID 1348 wrote to memory of 2160	1348	cmd.exe	94
PID 1348 wrote to memory of 1764	1348	cmd.exe	95
PID 1348 wrote to memory of 1764	1348	cmd.exe	95
PID 1348 wrote to memory of 1764	1348	cmd.exe	95
PID 1764 wrote to memory of 1788	1764	Subito.exe.com	96
PID 1764 wrote to memory of 1788	1764	Subito.exe.com	96
PID 1764 wrote to memory of 1788	1764	Subito.exe.com	96
PID 188 wrote to memory of 3144	188	Parlato.exe.com	97
PID 188 wrote to memory of 3144	188	Parlato.exe.com	97
PID 188 wrote to memory of 3144	188	Parlato.exe.com	97
PID 1348 wrote to memory of 3952	1348	cmd.exe	98
PID 1348 wrote to memory of 3952	1348	cmd.exe	98
PID 1348 wrote to memory of 3952	1348	cmd.exe	98
PID 3144 wrote to memory of 2300	3144	cmd.exe	100
PID 3144 wrote to memory of 2300	3144	cmd.exe	100
PID 3144 wrote to memory of 2300	3144	cmd.exe	100
PID 2984 wrote to memory of 804	2984	4.exe	101
PID 2984 wrote to memory of 804	2984	4.exe	101
PID 2984 wrote to memory of 804	2984	4.exe	101
PID 1788 wrote to memory of 1460	1788	Subito.exe.com	103
PID 1788 wrote to memory of 1460	1788	Subito.exe.com	103
PID 1788 wrote to memory of 1460	1788	Subito.exe.com	103
PID 1788 wrote to memory of 1984	1788	Subito.exe.com	104
PID 1788 wrote to memory of 1984	1788	Subito.exe.com	104
PID 1788 wrote to memory of 1984	1788	Subito.exe.com	104
PID 1460 wrote to memory of 2088	1460	bpkmreth.exe	105

C:\Users\Admin\AppData\Local\Temp\88e0aec3a6fafc199feb2171cb04a634.exe
"C:\Users\Admin\AppData\Local\Temp\88e0aec3a6fafc199feb2171cb04a634.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Fibra.dif
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^bWoWTGLaNuqAwjagBffPgelFSBVkrIDNgNRArpZnBZcEJKTUhByuVhnxMDtaKmfyDhkhcRkadQgfHFWoHwYBCbRwfvOAyHNwKdwcmGmcdNQyZpNuHVKJBNCyvpXYrKjIrjE$" Cheope.dif
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Parlato.exe.com
      Parlato.exe.com O
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Parlato.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Parlato.exe.com O
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:188
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\RFDcyh.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\RFDcyh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RFDcyh.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Fina.pdf
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^PTaQUHsswdKSMiIsfCPEpDoeOIRStnozZXYFKKXvthvySBXRyJEGOOjkKdejQnhCidSPoeGFFamWurphLqNcUCFlKMVxILGFZUXBIoIreZwcfd$" Dici.pdf
        11⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Subito.exe.com
        
        Subito.exe.com S
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Subito.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Subito.exe.com S
        12⤵
        Executes dropped EXE
        Checks processor information in registry
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\bpkmreth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bpkmreth.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\BPKMRE~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\bpkmreth.exe
        14⤵
        Loads dropped DLL
        
        PID:2088
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\guhbcnhi.vbs"
        13⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 30
        11⤵
        Runs ping.exe
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
        8⤵
        Executes dropped EXE
        Drops startup file
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
        
        "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:804
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\fJxnMoFyP & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Parlato.exe.com"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:2300
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:3956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/188-127-0x00000000010F0000-0x00000000010F1000-memory.dmp

Download

memory/804-166-0x00000000004C0000-0x00000000004E6000-memory.dmp

Download

memory/804-167-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1460-176-0x0000000000400000-0x0000000000B14000-memory.dmp

Download

memory/1460-175-0x0000000002D80000-0x0000000003487000-memory.dmp

Download

memory/1460-177-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/2088-182-0x00000000046C0000-0x0000000004C85000-memory.dmp

Download

memory/2984-164-0x0000000000460000-0x000000000050E000-memory.dmp

Download

memory/2984-165-0x0000000000400000-0x000000000045E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads