cryptbot | 82a634123b202b7960b6cc3b52125352a2006e40cc2ccf3d62c1519191981e71

General

Target

fc0701924aed7be6e65f20c16d222ef6.exe
Size

392KB
MD5

fc0701924aed7be6e65f20c16d222ef6
SHA1

c04d8dee265d5ed32f30f9bf466b6d2676dae4eb
SHA256

82a634123b202b7960b6cc3b52125352a2006e40cc2ccf3d62c1519191981e71
SHA512

eea30d68123f94587d324a58a31f51bba985bd2750607a8615f370cd2c79b73ace4ea7ec00a3e6a009118064169859f150cf5e489d587454cbaa2b0f42234aee

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

C2

unic12m.top

unic12e.top

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fc0701924aed7be6e65f20c16d222ef6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fc0701924aed7be6e65f20c16d222ef6.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1916	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 452	3380	fc0701924aed7be6e65f20c16d222ef6.exe	69
PID 3380 wrote to memory of 452	3380	fc0701924aed7be6e65f20c16d222ef6.exe	69
PID 3380 wrote to memory of 452	3380	fc0701924aed7be6e65f20c16d222ef6.exe	69
PID 452 wrote to memory of 1916	452	cmd.exe	71
PID 452 wrote to memory of 1916	452	cmd.exe	71
PID 452 wrote to memory of 1916	452	cmd.exe	71

C:\Users\Admin\AppData\Local\Temp\fc0701924aed7be6e65f20c16d222ef6.exe
"C:\Users\Admin\AppData\Local\Temp\fc0701924aed7be6e65f20c16d222ef6.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\rikIfNPY & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\fc0701924aed7be6e65f20c16d222ef6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:1916

Network

DNS

time.windows.com

Remote address:

8.8.8.8:53

Request

time.windows.com

IN A

Response

time.windows.com

IN CNAME

twc.trafficmanager.net

twc.trafficmanager.net

IN A

20.101.57.9
DNS

unic12m.top

fc0701924aed7be6e65f20c16d222ef6.exe

Remote address:

8.8.8.8:53

Request

unic12m.top

IN A

Response

unic12m.top

IN A

5.188.38.39
POST

http://unic12m.top/index.php

fc0701924aed7be6e65f20c16d222ef6.exe

Remote address:

5.188.38.39:80

Request

POST /index.php HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36
Host: unic12m.top
Content-Length: 1611925
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Sun, 05 Dec 2021 10:54:45 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
DNS

unic12e.top

fc0701924aed7be6e65f20c16d222ef6.exe

Remote address:

8.8.8.8:53

Request

unic12e.top

IN A

Response

unic12e.top

IN A

5.188.38.39
POST

http://unic12e.top/index.php

fc0701924aed7be6e65f20c16d222ef6.exe

Remote address:

5.188.38.39:80

Request

POST /index.php HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36
Host: unic12e.top
Content-Length: 1611908
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Sun, 05 Dec 2021 10:54:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding

52.109.8.21:443

322 B
7
5.188.38.39:80

http://unic12m.top/index.php

http

fc0701924aed7be6e65f20c16d222ef6.exe

1.7MB
36.1kB
1112
785

HTTP Request

POST http://unic12m.top/index.php

HTTP Response

200
5.188.38.39:80

http://unic12e.top/index.php

http

fc0701924aed7be6e65f20c16d222ef6.exe

1.7MB
24.2kB
1111
588

HTTP Request

POST http://unic12e.top/index.php

HTTP Response

200

8.8.8.8:53

time.windows.com

dns

62 B
114 B
1
1

DNS Request

time.windows.com

DNS Response

20.101.57.9
20.101.57.9:123

time.windows.com

ntp

76 B
1
8.8.8.8:53

unic12m.top

dns

fc0701924aed7be6e65f20c16d222ef6.exe

57 B
73 B
1
1

DNS Request

unic12m.top

DNS Response

5.188.38.39
8.8.8.8:53

unic12e.top

dns

fc0701924aed7be6e65f20c16d222ef6.exe

57 B
73 B
1
1

DNS Request

unic12e.top

DNS Response

5.188.38.39

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-115-0x00000000007D9000-0x00000000007FF000-memory.dmp

Filesize
152KB

Download
memory/3380-117-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3380-116-0x00000000006E0000-0x0000000000727000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.