cryptbot | efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc

Analysis

max time kernel
121s
max time network
128s
platform
windows10_x64
resource
win10-en-20211104
submitted
05-12-2021 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

571f12f948ea19e6ed5eec7f3b973344.exe
Size

392KB
MD5

571f12f948ea19e6ed5eec7f3b973344
SHA1

3241f91728f2cae3f372ece53c71307329d93de5
SHA256

efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc
SHA512

dce066b28be786225e50707fe8c8cac1b755c32e0779331e4f1b7676181c4a5ff2db77770675f0ff224dea2df69c34a3c380aa8f17264af9aeb3e0ef3df471be

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

unic14m.top

unic14e.top

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

571f12f948ea19e6ed5eec7f3b973344.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	571f12f948ea19e6ed5eec7f3b973344.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	571f12f948ea19e6ed5eec7f3b973344.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

312 timeout.exe

pid	process
312	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

571f12f948ea19e6ed5eec7f3b973344.execmd.exe

description	pid	process	target process
PID 2724 wrote to memory of 2712	2724	571f12f948ea19e6ed5eec7f3b973344.exe	cmd.exe
PID 2724 wrote to memory of 2712	2724	571f12f948ea19e6ed5eec7f3b973344.exe	cmd.exe
PID 2724 wrote to memory of 2712	2724	571f12f948ea19e6ed5eec7f3b973344.exe	cmd.exe
PID 2712 wrote to memory of 312	2712	cmd.exe	timeout.exe
PID 2712 wrote to memory of 312	2712	cmd.exe	timeout.exe
PID 2712 wrote to memory of 312	2712	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\571f12f948ea19e6ed5eec7f3b973344.exe
"C:\Users\Admin\AppData\Local\Temp\571f12f948ea19e6ed5eec7f3b973344.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\571f12f948ea19e6ed5eec7f3b973344.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\PBMRJA~1.ZIP

MD5
9a0a219c7dfea17b46c92fc5b5d151ff

SHA1
fa75c61e7c078291f705357342e83588c4611b05

SHA256
e7341d7615ec8c5cfef491beeb9fa6386a4c50eb364c7a2ca9f49242bf2f2abb

SHA512
0b76dbd1271cf84a11de4b2a58357d06db4bbfb90398deda9ec50295cc69f263494ddd79bf67a487b7e186827ccac477774d7185fc435cb3649feab0870e0035

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\ZZSCGA~1.ZIP

MD5
dfb806159c27732a6462b37fb27e3e70

SHA1
363f70ddff56ae83267c5a43e63822da81f463da

SHA256
8240a4235e069bb09f3e4ccd0f1189b81956576eb13000a70c845389a473eebf

SHA512
bd7e4ddd0b818ae4addb2b553322a8899c752533b3ff37d4d16d7f2734314c5b5caa3aa27ed70618eeec97d2411d98f3f97e27f496d306867b8cc377206f31ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\_Files\_Chrome\DEFAUL~1.BIN

MD5
b963abf9a7967b3a22da64c9193fc932

SHA1
0831556392b56c00b07f04deb5474c4202c545e8

SHA256
6c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5

SHA512
64514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\_Files\_Chrome\DEFAUL~1.DB

MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\_Files\_Chrome\DEFAUL~2.DB

MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\_Files\_Chrome\DEFAUL~3.DB

MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\_Files\_Files\FINDGR~1.TXT

MD5
cd4a4ea86924117509db155bf6d28bf0

SHA1
2eb2893b966c0a2b0162d75a94d4ae7d85bd143e

SHA256
6ed6735add919b30f4774fdc1832347e3bfc5640d38392f8d767fe214b7ea74a

SHA512
04af23478bb382efc5117e16186354f4ffc2de72a51a1658cd95c0df05cb4000bbfa3b13f9bcd3429acccaa9ec4cfb2296dd110b3fbc686851d2ffddba493b2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\_Files\_INFOR~1.TXT

MD5
bd966054a9eedbd6a02f003e5ae22ccd

SHA1
236964c90fbd53bbbdc9c6867e97cadb82b4bb92

SHA256
deada5579e8f582b33ea6fa5ee811010f44c82511e26b9dd4f5b7553009b341a

SHA512
48d592caaad6aefeb63b988ae03c4a2501f2912e5c446f6456779be89add14c467b53dcaa392bff870e182a79639431e00b8a49ed66263462a5ac676a310aa13

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\_Files\_SCREE~1.JPE

MD5
3652f1e835c78b30eb5f3d993928bce9

SHA1
93672aede4930e0e333e70ef2e9ba88675cf84a7

SHA256
bfa2b9fa1abea08974292719c06e587f1f27e3c0e2be151f713d91b2692caa65

SHA512
8e3c4d92a2ff9f6823cbfd7a35972e440e8d1e6a96a22f0593f6be5edc8bbf4bd6823333feb14449ea27303c768071ccffa3da36fd97c6ca4ffecf82861d5536

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\files_\SCREEN~1.JPG

MD5
3652f1e835c78b30eb5f3d993928bce9

SHA1
93672aede4930e0e333e70ef2e9ba88675cf84a7

SHA256
bfa2b9fa1abea08974292719c06e587f1f27e3c0e2be151f713d91b2692caa65

SHA512
8e3c4d92a2ff9f6823cbfd7a35972e440e8d1e6a96a22f0593f6be5edc8bbf4bd6823333feb14449ea27303c768071ccffa3da36fd97c6ca4ffecf82861d5536

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\files_\SYSTEM~1.TXT

MD5
bd966054a9eedbd6a02f003e5ae22ccd

SHA1
236964c90fbd53bbbdc9c6867e97cadb82b4bb92

SHA256
deada5579e8f582b33ea6fa5ee811010f44c82511e26b9dd4f5b7553009b341a

SHA512
48d592caaad6aefeb63b988ae03c4a2501f2912e5c446f6456779be89add14c467b53dcaa392bff870e182a79639431e00b8a49ed66263462a5ac676a310aa13

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\files_\_Chrome\DEFAUL~1.BIN

MD5
b963abf9a7967b3a22da64c9193fc932

SHA1
0831556392b56c00b07f04deb5474c4202c545e8

SHA256
6c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5

SHA512
64514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\files_\_Chrome\DEFAUL~1.DB

MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\files_\_Chrome\DEFAUL~2.DB

MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\files_\_Chrome\DEFAUL~3.DB

MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVPgXfoZfgRYP\files_\files\FINDGR~1.TXT

MD5
cd4a4ea86924117509db155bf6d28bf0

SHA1
2eb2893b966c0a2b0162d75a94d4ae7d85bd143e

SHA256
6ed6735add919b30f4774fdc1832347e3bfc5640d38392f8d767fe214b7ea74a

SHA512
04af23478bb382efc5117e16186354f4ffc2de72a51a1658cd95c0df05cb4000bbfa3b13f9bcd3429acccaa9ec4cfb2296dd110b3fbc686851d2ffddba493b2e

Download Submit
memory/312-138-0x0000000000000000-mapping.dmp

Download
memory/2712-121-0x0000000000000000-mapping.dmp

Download
memory/2724-118-0x00000000006D9000-0x00000000006FF000-memory.dmp

Filesize
152KB

Download
memory/2724-120-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2724-119-0x0000000002060000-0x00000000020A7000-memory.dmp

Filesize
284KB

Download