cryptbot | 8fa5bd420dc9825b97ff67dfce099b6c98a1fd81926de89ee11470407cc41d93

General

Target

fcf4eb8bd77e85b3e0af0678858ca534.exe
Size

402KB
MD5

fcf4eb8bd77e85b3e0af0678858ca534
SHA1

6d8858a95b1d560ca7b3eb473e5dc6fc5b85e488
SHA256

8fa5bd420dc9825b97ff67dfce099b6c98a1fd81926de89ee11470407cc41d93
SHA512

590828cd507c2255aa92296d7c846f20750e012b6b871d595d6e4586aa582e6ae7be07311f3e8252fb355456778884aec0a6e39af639afbe103b6fd79b65f72f

Score

10^/10

cryptbot spyware stealer

Malware Config

Extracted

Family

cryptbot

C2

tisqls52.top

mordyk05.top

Attributes

payload_url
http://danwyk16.top/download.php?file=kludge.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1500 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1500	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fcf4eb8bd77e85b3e0af0678858ca534.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fcf4eb8bd77e85b3e0af0678858ca534.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fcf4eb8bd77e85b3e0af0678858ca534.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1652 timeout.exe

pid	process
1652	timeout.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fcf4eb8bd77e85b3e0af0678858ca534.execmd.exe

description	pid	process	target process
PID 1152 wrote to memory of 1500	1152	fcf4eb8bd77e85b3e0af0678858ca534.exe	cmd.exe
PID 1152 wrote to memory of 1500	1152	fcf4eb8bd77e85b3e0af0678858ca534.exe	cmd.exe
PID 1152 wrote to memory of 1500	1152	fcf4eb8bd77e85b3e0af0678858ca534.exe	cmd.exe
PID 1152 wrote to memory of 1500	1152	fcf4eb8bd77e85b3e0af0678858ca534.exe	cmd.exe
PID 1500 wrote to memory of 1652	1500	cmd.exe	timeout.exe
PID 1500 wrote to memory of 1652	1500	cmd.exe	timeout.exe
PID 1500 wrote to memory of 1652	1500	cmd.exe	timeout.exe
PID 1500 wrote to memory of 1652	1500	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\fcf4eb8bd77e85b3e0af0678858ca534.exe
"C:\Users\Admin\AppData\Local\Temp\fcf4eb8bd77e85b3e0af0678858ca534.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\QOHsjxiQpngs & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\fcf4eb8bd77e85b3e0af0678858ca534.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:1652

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-55-0x0000000000288000-0x00000000002AE000-memory.dmp

Filesize
152KB

Download
memory/1152-56-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download
memory/1152-57-0x00000000004F0000-0x0000000000535000-memory.dmp

Filesize
276KB

Download
memory/1152-58-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1500-59-0x0000000000000000-mapping.dmp

Download
memory/1652-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing