cryptbot | 958bf791886caad7744fe007df2e3134e1f0260b9c86bbc87d42a42ca69c87ff

Analysis

max time kernel
122s
max time network
169s
platform
windows7_x64
resource
win7v20210410
submitted
10-06-2021 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5f23f8aba4d574b840365ac6d03bc64.exe
Size

771KB
MD5

d5f23f8aba4d574b840365ac6d03bc64
SHA1

2b97cb3bc8135ec8ea649ff01cbe5614a89cdd26
SHA256

958bf791886caad7744fe007df2e3134e1f0260b9c86bbc87d42a42ca69c87ff
SHA512

d97c0835fa5a8500846ae7805644bb4d47907515e93b3e1929c0943a8873f3d405027b5175905c652e3ddfeb36f8232ecb34d98808a55b9b78ca1cdf18917af4

Score

10^/10

cryptbot spyware stealer

Malware Config

Extracted

Family

cryptbot

olmyad42.top

morsen04.top

Attributes

payload_url
http://vamcrq06.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2024-60-0x00000000004F0000-0x00000000005D1000-memory.dmp	family_cryptbot
behavioral1/memory/2024-61-0x0000000000400000-0x00000000004E5000-memory.dmp	family_cryptbot

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d5f23f8aba4d574b840365ac6d03bc64.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d5f23f8aba4d574b840365ac6d03bc64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d5f23f8aba4d574b840365ac6d03bc64.exe

C:\Users\Admin\AppData\Local\Temp\d5f23f8aba4d574b840365ac6d03bc64.exe
"C:\Users\Admin\AppData\Local\Temp\d5f23f8aba4d574b840365ac6d03bc64.exe"
1⤵
- Checks processor information in registry
PID:2024

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-59-0x0000000076A81000-0x0000000076A83000-memory.dmp

Filesize
8KB

Download
memory/2024-60-0x00000000004F0000-0x00000000005D1000-memory.dmp

Filesize
900KB

Download
memory/2024-61-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download