cryptbot | efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc

Analysis

max time kernel
122s
max time network
125s
platform
windows10_x64
resource
win10-en-20211104
submitted
05-12-2021 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe
Size

392KB
MD5

571f12f948ea19e6ed5eec7f3b973344
SHA1

3241f91728f2cae3f372ece53c71307329d93de5
SHA256

efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc
SHA512

dce066b28be786225e50707fe8c8cac1b755c32e0779331e4f1b7676181c4a5ff2db77770675f0ff224dea2df69c34a3c380aa8f17264af9aeb3e0ef3df471be

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

unic14m.top

unic14e.top

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3996 timeout.exe

pid	process
3996	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.execmd.exe

description	pid	process	target process
PID 2672 wrote to memory of 1260	2672	efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe	cmd.exe
PID 2672 wrote to memory of 1260	2672	efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe	cmd.exe
PID 2672 wrote to memory of 1260	2672	efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe	cmd.exe
PID 1260 wrote to memory of 3996	1260	cmd.exe	timeout.exe
PID 1260 wrote to memory of 3996	1260	cmd.exe	timeout.exe
PID 1260 wrote to memory of 3996	1260	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe
"C:\Users\Admin\AppData\Local\Temp\efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\wmyEtWbip & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:3996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\HYKJSI~1.ZIP

MD5
e57d4681a2cead3fc8184984e3f0dc99

SHA1
4c1e09998971dc8873d8255776e183a7477cc45c

SHA256
a4b530bdfef5f557a82c183880298f5137793c387370ec909df582925ee115f7

SHA512
ea9d785ec7bcb3a4aec2783531691289d264c02fcd8b5cca1f567811396c50ea055a09d4ebdf068e4fd36593d1f1f12c18eafb1a91f9848574830965cf880ff1

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\SIDVOM~1.ZIP

MD5
7cb947a8bbd352620f90498e7ff4cbae

SHA1
68d9109fd049f5268ab69df42e2fc25b3174193c

SHA256
cc1a528cb612ff110088b059ad8f7c29a4324172d9b8901b601176aaa95f36c6

SHA512
917082301fa823f45401493855c0045c7d70c320c085ab3083e27994e9bbeac18484275d5544bcaf0b1f0035d47101f07d4a6ed492a65f17d1ab183336c5da95

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_Chrome\DEFAUL~1.BIN

MD5
b963abf9a7967b3a22da64c9193fc932

SHA1
0831556392b56c00b07f04deb5474c4202c545e8

SHA256
6c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5

SHA512
64514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_Chrome\DEFAUL~1.DB

MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_Chrome\DEFAUL~2.DB

MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_Chrome\DEFAUL~3.DB

MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_INFOR~1.TXT

MD5
bfca6baaa9c355c562cdc65a3f1e310f

SHA1
b6b2bfd2cc4aa131670715fe51edf212424feedc

SHA256
496bdcf1381cc1150627c8d7415bec06ea9438d83221c5c787536b87b526f8bc

SHA512
38074e4ca3e38889973b180ab72946fe2a88ccdf62aff74431b66a8702b6a57bc8b8ca5a1567a752b2f5af6b7100cd9cfd40cebdb89922ba13b8061579588826

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\_Files\_SCREE~1.JPE

MD5
e57aeea98b5034068cd4784f5c34a6be

SHA1
3ef3de4ee894a1d8858af1c9199bcebaceb6b380

SHA256
5eb333818a37acc7c1477548a57a5fedfc31dd995865c1ed07d6b4be2f0200e7

SHA512
f85b0eac9fad857b2d2c31b4114001bba5f34dfe29bb4c4adc13be573eda41bc056f35d01d1d0a5477786a6ba47d1a6dd4a14dc01f26323ce7d733b8d83e701c

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\SCREEN~1.JPG

MD5
e57aeea98b5034068cd4784f5c34a6be

SHA1
3ef3de4ee894a1d8858af1c9199bcebaceb6b380

SHA256
5eb333818a37acc7c1477548a57a5fedfc31dd995865c1ed07d6b4be2f0200e7

SHA512
f85b0eac9fad857b2d2c31b4114001bba5f34dfe29bb4c4adc13be573eda41bc056f35d01d1d0a5477786a6ba47d1a6dd4a14dc01f26323ce7d733b8d83e701c

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\SYSTEM~1.TXT

MD5
bfca6baaa9c355c562cdc65a3f1e310f

SHA1
b6b2bfd2cc4aa131670715fe51edf212424feedc

SHA256
496bdcf1381cc1150627c8d7415bec06ea9438d83221c5c787536b87b526f8bc

SHA512
38074e4ca3e38889973b180ab72946fe2a88ccdf62aff74431b66a8702b6a57bc8b8ca5a1567a752b2f5af6b7100cd9cfd40cebdb89922ba13b8061579588826

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\_Chrome\DEFAUL~1.BIN

MD5
b963abf9a7967b3a22da64c9193fc932

SHA1
0831556392b56c00b07f04deb5474c4202c545e8

SHA256
6c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5

SHA512
64514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\_Chrome\DEFAUL~1.DB

MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\_Chrome\DEFAUL~2.DB

MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmyEtWbip\files_\_Chrome\DEFAUL~3.DB

MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
memory/1260-121-0x0000000000000000-mapping.dmp

Download
memory/2672-118-0x0000000000629000-0x000000000064F000-memory.dmp

Filesize
152KB

Download
memory/2672-120-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2672-119-0x00000000021B0000-0x00000000021F7000-memory.dmp

Filesize
284KB

Download
memory/3996-136-0x0000000000000000-mapping.dmp

Download