cryptbot | c5235a63f916e2de15aaa66e0664c1548caa85c4a56c11fb5e328921bab1f459

General

Target

674a182c0b45ebfd1c4b31536ee4f895.exe
Size

386KB
MD5

674a182c0b45ebfd1c4b31536ee4f895
SHA1

29bd1a4bffc94ff26e6e4d509f0091530e800723
SHA256

c5235a63f916e2de15aaa66e0664c1548caa85c4a56c11fb5e328921bab1f459
SHA512

71a87c877bd329e95ba27ec51d77956d8dc8d3bcbbe70f2e394e2f4f08d3f3748afc3019a0dbd46fa12020e7da330a4aedcf65bd254eedbc672a82b060020370

Score

10^/10

cryptbot spyware stealer

Malware Config

Extracted

Family

cryptbot

C2

daizeu62.top

morqag06.top

Attributes

payload_url
http://liogyl18.top/download.php?file=gowpen.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1548 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1548	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

674a182c0b45ebfd1c4b31536ee4f895.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	674a182c0b45ebfd1c4b31536ee4f895.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	674a182c0b45ebfd1c4b31536ee4f895.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1408 timeout.exe

pid	process
1408	timeout.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

674a182c0b45ebfd1c4b31536ee4f895.execmd.exe

description	pid	process	target process
PID 1668 wrote to memory of 1548	1668	674a182c0b45ebfd1c4b31536ee4f895.exe	cmd.exe
PID 1668 wrote to memory of 1548	1668	674a182c0b45ebfd1c4b31536ee4f895.exe	cmd.exe
PID 1668 wrote to memory of 1548	1668	674a182c0b45ebfd1c4b31536ee4f895.exe	cmd.exe
PID 1668 wrote to memory of 1548	1668	674a182c0b45ebfd1c4b31536ee4f895.exe	cmd.exe
PID 1548 wrote to memory of 1408	1548	cmd.exe	timeout.exe
PID 1548 wrote to memory of 1408	1548	cmd.exe	timeout.exe
PID 1548 wrote to memory of 1408	1548	cmd.exe	timeout.exe
PID 1548 wrote to memory of 1408	1548	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\674a182c0b45ebfd1c4b31536ee4f895.exe
"C:\Users\Admin\AppData\Local\Temp\674a182c0b45ebfd1c4b31536ee4f895.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\AnrOemMf & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\674a182c0b45ebfd1c4b31536ee4f895.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:1408

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-59-0x0000000000000000-mapping.dmp

Download
memory/1548-58-0x0000000000000000-mapping.dmp

Download
memory/1668-54-0x0000000000268000-0x000000000028E000-memory.dmp

Filesize
152KB

Download
memory/1668-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1668-56-0x00000000004F0000-0x0000000000535000-memory.dmp

Filesize
276KB

Download
memory/1668-57-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download

Analysis

Sharing