cryptbot | f3b4f47ab6b09e0b090c6fb6f6145774485e2d043d373ed2971034bf6cd9f420

General

Target

e55422d97015ca9945114cebaeba4cbf.exe
Size

2.7MB
MD5

e55422d97015ca9945114cebaeba4cbf
SHA1

671d3c900b4aa7b4568e8a4c61a49075fc74484b
SHA256

f3b4f47ab6b09e0b090c6fb6f6145774485e2d043d373ed2971034bf6cd9f420
SHA512

9453ae884da5d039fa0ca4fc33216b1ca02d2b40831edf534d7fde16a01c045f1c49ae7935ab317cd6f515e21a9a22ee14cbf3a068627b03e334cdc115603f6f

Score

10^/10

cryptbot evasion spyware stealer themida trojan

Malware Config

Extracted

Family

cryptbot

C2

dainfe42.top

morvtu04.top

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e55422d97015ca9945114cebaeba4cbf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e55422d97015ca9945114cebaeba4cbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e55422d97015ca9945114cebaeba4cbf.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

960 cmd.exe

pid	process
960	cmd.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/972-56-0x00000000010E0000-0x00000000017D3000-memory.dmp	themida
behavioral1/memory/972-57-0x00000000010E0000-0x00000000017D3000-memory.dmp	themida
behavioral1/memory/972-59-0x00000000010E0000-0x00000000017D3000-memory.dmp	themida
behavioral1/memory/972-58-0x00000000010E0000-0x00000000017D3000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e55422d97015ca9945114cebaeba4cbf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e55422d97015ca9945114cebaeba4cbf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

e55422d97015ca9945114cebaeba4cbf.exe

pid process

972 e55422d97015ca9945114cebaeba4cbf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
972	e55422d97015ca9945114cebaeba4cbf.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e55422d97015ca9945114cebaeba4cbf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e55422d97015ca9945114cebaeba4cbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	e55422d97015ca9945114cebaeba4cbf.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1172 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e55422d97015ca9945114cebaeba4cbf.exe

pid process

972 e55422d97015ca9945114cebaeba4cbf.exe

pid	process
1172	timeout.exe

pid	process
972	e55422d97015ca9945114cebaeba4cbf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e55422d97015ca9945114cebaeba4cbf.execmd.exe

description	pid	process	target process
PID 972 wrote to memory of 960	972	e55422d97015ca9945114cebaeba4cbf.exe	cmd.exe
PID 972 wrote to memory of 960	972	e55422d97015ca9945114cebaeba4cbf.exe	cmd.exe
PID 972 wrote to memory of 960	972	e55422d97015ca9945114cebaeba4cbf.exe	cmd.exe
PID 972 wrote to memory of 960	972	e55422d97015ca9945114cebaeba4cbf.exe	cmd.exe
PID 960 wrote to memory of 1172	960	cmd.exe	timeout.exe
PID 960 wrote to memory of 1172	960	cmd.exe	timeout.exe
PID 960 wrote to memory of 1172	960	cmd.exe	timeout.exe
PID 960 wrote to memory of 1172	960	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\e55422d97015ca9945114cebaeba4cbf.exe
"C:\Users\Admin\AppData\Local\Temp\e55422d97015ca9945114cebaeba4cbf.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\lXVXSlRC & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\e55422d97015ca9945114cebaeba4cbf.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:1172

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-60-0x0000000000000000-mapping.dmp

Download
memory/972-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/972-56-0x00000000010E0000-0x00000000017D3000-memory.dmp

Filesize
6.9MB

Download
memory/972-57-0x00000000010E0000-0x00000000017D3000-memory.dmp

Filesize
6.9MB

Download
memory/972-59-0x00000000010E0000-0x00000000017D3000-memory.dmp

Filesize
6.9MB

Download
memory/972-58-0x00000000010E0000-0x00000000017D3000-memory.dmp

Filesize
6.9MB

Download
memory/1172-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads