cryptbot | 9a980946ffc1330c3ef36e44443f43ae8d608003d349e8d7580c982eb2fa3a96

Analysis

max time kernel
9s
max time network
12s
platform
windows7_x64
resource
win7v20210410
submitted
10-06-2021 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

639f69d9579aa0f1c83aa5bd9f1f71bd.exe
Size

773KB
MD5

639f69d9579aa0f1c83aa5bd9f1f71bd
SHA1

32707ad055e7c906a2ed1b3cc6b90466507511df
SHA256

9a980946ffc1330c3ef36e44443f43ae8d608003d349e8d7580c982eb2fa3a96
SHA512

16fb6457902878fb0694a87f2fc7b5df27309cef144e7838599c056bd50f5fcc45e2b8daca65bc8e25f5a109f8edfb0d57fe55cf9f57021205b58114dacaca89

Score

10^/10

cryptbot spyware stealer

Malware Config

Extracted

Family

cryptbot

olmyad42.top

morsen04.top

Attributes

payload_url
http://vamcrq06.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/752-60-0x0000000001D30000-0x0000000001E11000-memory.dmp	family_cryptbot
behavioral1/memory/752-61-0x0000000000400000-0x00000000004E5000-memory.dmp	family_cryptbot

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

639f69d9579aa0f1c83aa5bd9f1f71bd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	639f69d9579aa0f1c83aa5bd9f1f71bd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	639f69d9579aa0f1c83aa5bd9f1f71bd.exe

C:\Users\Admin\AppData\Local\Temp\639f69d9579aa0f1c83aa5bd9f1f71bd.exe
"C:\Users\Admin\AppData\Local\Temp\639f69d9579aa0f1c83aa5bd9f1f71bd.exe"
1⤵
- Checks processor information in registry
PID:752

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-59-0x0000000076661000-0x0000000076663000-memory.dmp

Filesize
8KB

Download
memory/752-60-0x0000000001D30000-0x0000000001E11000-memory.dmp

Filesize
900KB

Download
memory/752-61-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download