cryptbot | f1e81f8fc03025e450dc6d59f86acd9cb55942d3bc94f82c28274e08fc2074f8

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-en-20211104
submitted
17/11/2021, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p3.exe
Size 2.8MB
Sample211117-s1ea2aabdk
SHA256 f1e81f8fc03025e450dc6d59f86acd9cb55942d3bc94f82c28274e08fc2074f8
MD5 25c8d55c8d2ac4fb39dfe3d063304c72
SHA1 bbf395f0d0be607e32cbae78100c212d2f09f3b8
SHA512 3f2d65a9468a7bc72c017577180d015c0df4210775faf8a8474828bfac37d2c497b12f8be538ea1290a35ecbf603b01894e12f13f65b4deead24331137a29ffe
MD5 SHA1 SHA512

Score

10^/10

cryptbot spyware stealer

Malware Config

Extracted

Family

cryptbot

ciplfk33.top
moryow03.top

Attributes

payload_url
http://sahaqz04.top/download.php?file=initis.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Deletes itself 1 IoCs

pid	Process
1480	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	p3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	p3.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1896	timeout.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 1480	472	p3.exe	28
PID 472 wrote to memory of 1480	472	p3.exe	28
PID 472 wrote to memory of 1480	472	p3.exe	28
PID 472 wrote to memory of 1480	472	p3.exe	28
PID 1480 wrote to memory of 1896	1480	cmd.exe	30
PID 1480 wrote to memory of 1896	1480	cmd.exe	30
PID 1480 wrote to memory of 1896	1480	cmd.exe	30
PID 1480 wrote to memory of 1896	1480	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\p3.exe
"C:\Users\Admin\AppData\Local\Temp\p3.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\lidgKMpSD & timeout 4 & del /f /q ""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/472-55-0x0000000075731000-0x0000000075733000-memory.dmp

Download

memory/472-56-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/472-57-0x0000000000380000-0x00000000003C9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads