cryptbot | 0f73f9885dc262aa08acb765fdd226d779265e017ca605da15cb887a2b4b9899

Analysis

max time kernel
122s
max time network
152s
platform
windows10_x64
resource
win10-en-20211208
submitted
27-12-2021 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mixshop_20211227-103528.exe
Size

2.7MB
MD5

5289cac36220c353af14dc3f14faf91a
SHA1

5080eb50ad81a2026d0e155af6149b66b21d2777
SHA256

0f73f9885dc262aa08acb765fdd226d779265e017ca605da15cb887a2b4b9899
SHA512

44225c2abded6d592b5aa33d5dd81b1ba638dd29237ebc6f781ca3d032cb272f36da0447230d32f556556ef201bd27433a48a289c5a65ed9cc49661b20e98d9c

Score

10^/10

cryptbot discovery evasion spyware stealer themida trojan

Malware Config

Extracted

Family

cryptbot

hevbaw12.top

morgki01.top

Attributes

payload_url
http://kyvihm01.top/download.php?file=brunei.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

File.exeDpEditor.exe

pid process

504 File.exe
8 DpEditor.exe

pid	process
504	File.exe
8	DpEditor.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mixshop_20211227-103528.exeFile.exeDpEditor.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mixshop_20211227-103528.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	File.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	File.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mixshop_20211227-103528.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/1108-116-0x0000000000D70000-0x0000000001464000-memory.dmp	themida
behavioral2/memory/1108-117-0x0000000000D70000-0x0000000001464000-memory.dmp	themida
behavioral2/memory/1108-118-0x0000000000D70000-0x0000000001464000-memory.dmp	themida
behavioral2/memory/1108-119-0x0000000000D70000-0x0000000001464000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\File.exe	themida
C:\Users\Admin\AppData\Local\Temp\File.exe	themida
behavioral2/memory/504-141-0x0000000000170000-0x0000000000872000-memory.dmp	themida
behavioral2/memory/504-139-0x0000000000170000-0x0000000000872000-memory.dmp	themida
behavioral2/memory/504-142-0x0000000000170000-0x0000000000872000-memory.dmp	themida
behavioral2/memory/504-143-0x0000000000170000-0x0000000000872000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
behavioral2/memory/8-148-0x00000000012F0000-0x00000000019F2000-memory.dmp	themida
behavioral2/memory/8-149-0x00000000012F0000-0x00000000019F2000-memory.dmp	themida
behavioral2/memory/8-150-0x00000000012F0000-0x00000000019F2000-memory.dmp	themida
behavioral2/memory/8-151-0x00000000012F0000-0x00000000019F2000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

File.exeDpEditor.exemixshop_20211227-103528.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	File.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mixshop_20211227-103528.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

mixshop_20211227-103528.exeFile.exeDpEditor.exe

pid process

1108 mixshop_20211227-103528.exe
504 File.exe
8 DpEditor.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1108	mixshop_20211227-103528.exe
504	File.exe
8	DpEditor.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mixshop_20211227-103528.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mixshop_20211227-103528.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mixshop_20211227-103528.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1160 timeout.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

DpEditor.exe

pid process

8 DpEditor.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

mixshop_20211227-103528.exeFile.exeDpEditor.exe

pid process

1108 mixshop_20211227-103528.exe
1108 mixshop_20211227-103528.exe
504 File.exe
504 File.exe
8 DpEditor.exe
8 DpEditor.exe

pid	process
1160	timeout.exe

pid	process
8	DpEditor.exe

pid	process
1108	mixshop_20211227-103528.exe
1108	mixshop_20211227-103528.exe
504	File.exe
504	File.exe
8	DpEditor.exe
8	DpEditor.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

mixshop_20211227-103528.execmd.exeFile.exe

description	pid	process	target process
PID 1108 wrote to memory of 504	1108	mixshop_20211227-103528.exe	File.exe
PID 1108 wrote to memory of 504	1108	mixshop_20211227-103528.exe	File.exe
PID 1108 wrote to memory of 504	1108	mixshop_20211227-103528.exe	File.exe
PID 1108 wrote to memory of 1892	1108	mixshop_20211227-103528.exe	cmd.exe
PID 1108 wrote to memory of 1892	1108	mixshop_20211227-103528.exe	cmd.exe
PID 1108 wrote to memory of 1892	1108	mixshop_20211227-103528.exe	cmd.exe
PID 1892 wrote to memory of 1160	1892	cmd.exe	timeout.exe
PID 1892 wrote to memory of 1160	1892	cmd.exe	timeout.exe
PID 1892 wrote to memory of 1160	1892	cmd.exe	timeout.exe
PID 504 wrote to memory of 8	504	File.exe	DpEditor.exe
PID 504 wrote to memory of 8	504	File.exe	DpEditor.exe
PID 504 wrote to memory of 8	504	File.exe	DpEditor.exe

C:\Users\Admin\AppData\Local\Temp\mixshop_20211227-103528.exe
"C:\Users\Admin\AppData\Local\Temp\mixshop_20211227-103528.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1108

C:\Users\Admin\AppData\Local\Temp\File.exe
"C:\Users\Admin\AppData\Local\Temp\File.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:504

C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
"C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:8

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\mixshop_20211227-103528.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\File.exe
MD5
1d2a39112767125a8ee84c1b63d070fe

SHA1
f6ae7e6351d8c16cf470d59a481ed053cfc55dd5

SHA256
5f59627da5032edd29bca3798f9d9e67f441bec8a4fc3410360eb9a7bf567386

SHA512
cba766ca4b875dd804d32289e018140fbd0a7ec439188571d05ed4b7ac2f64c11217756e2e42cf85d76abdc2456f08f67fb666aa9d0bdbc73996842f5a1e5efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.exe
MD5
1d2a39112767125a8ee84c1b63d070fe

SHA1
f6ae7e6351d8c16cf470d59a481ed053cfc55dd5

SHA256
5f59627da5032edd29bca3798f9d9e67f441bec8a4fc3410360eb9a7bf567386

SHA512
cba766ca4b875dd804d32289e018140fbd0a7ec439188571d05ed4b7ac2f64c11217756e2e42cf85d76abdc2456f08f67fb666aa9d0bdbc73996842f5a1e5efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\QEDTPT~1.ZIP
MD5
3f2c512d6516ed8cbcb85b2158063095

SHA1
8a74c1d401e51372d312f1ab7da6956fda10af5a

SHA256
8bf78cd812da4dbf9283601862721f4e723dbac7b39ab63de2e21c86430b9bd3

SHA512
9d947c585c9e9dbde63311c96adf237ac7fd8692abc694879418fd89142c269c7d72f363973b9d6acb9dd5b711155418859311ea7072250e448b197ac9e59a0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\SNDUFW~1.ZIP
MD5
38744ac0006e84b71461b1d0733c3365

SHA1
8f079e9c2977d0707d022e76c938ce5c42930ee0

SHA256
cb407badc7f76499f57e3008b26ecb382e518050edafe9d27e2ca7d38f1b5343

SHA512
e41bedb63ec016d0ca2cd900f9d423df7c61a2bd5f368ae99673fce86231cb6b0f8f2bd17948c0332b1ab6ec91fa9d534d10fac0cd5c53ef2697620a4575026a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\_Files\_Chrome\DEFAUL~1.BIN
MD5
09500b419541e759ce53d87e324fe8fc

SHA1
4b882732508d2fc28536f8281c3b58777720c7da

SHA256
f80e7db7d3a06c87f03f5d0a9c7ab592ef05bc4fa5a8ab65c318c8455bd94476

SHA512
45e04f6283559638be00bffaf1a52a52a6998f835d5d40f756806a2323623074cb7ee9f802f4eba7d7523ccf3170f8986f89349ffbc1f2514ce25fdae0114fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\_Files\_Chrome\DEFAUL~1.DB
MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\_Files\_Chrome\DEFAUL~2.DB
MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\_Files\_Chrome\DEFAUL~3.DB
MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\_Files\_INFOR~1.TXT
MD5
62da7f18f1d302af12842760775a74bb

SHA1
3f341062fbaad0e8abafca211d2c0420cb168a38

SHA256
03bb21c8af1ebe31d5c779a8fdc1dd6f3724a00105caf4db7c3bdec2dce1a122

SHA512
3712019af1284c610082227d8124643f3ccc58608b227c4b660b46b8eede1c13f84135d9861030b1a19dfd7064de27b6cac1c881e1a51000e73ef2e4c670960d

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\_Files\_SCREE~1.JPE
MD5
c06e501fed7d086d1ab8b0c2a24eb9d5

SHA1
ded5c044806be3da8d2f52709cc57f60ca1c5c63

SHA256
4aab182e0e9162a346f07c4ae4bdec0747098463ce77794ed9ceb724c2efd6b5

SHA512
dbce7b6270999fbb3fb7c608d044298c9837227f6697f2ac2b8e4942254c9499d2b5aeba6456bb8c14e226c7e69d431986f7098a5040bc1185218e8c4a3b51fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\files_\SCREEN~1.JPG
MD5
c06e501fed7d086d1ab8b0c2a24eb9d5

SHA1
ded5c044806be3da8d2f52709cc57f60ca1c5c63

SHA256
4aab182e0e9162a346f07c4ae4bdec0747098463ce77794ed9ceb724c2efd6b5

SHA512
dbce7b6270999fbb3fb7c608d044298c9837227f6697f2ac2b8e4942254c9499d2b5aeba6456bb8c14e226c7e69d431986f7098a5040bc1185218e8c4a3b51fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\files_\SYSTEM~1.TXT
MD5
62da7f18f1d302af12842760775a74bb

SHA1
3f341062fbaad0e8abafca211d2c0420cb168a38

SHA256
03bb21c8af1ebe31d5c779a8fdc1dd6f3724a00105caf4db7c3bdec2dce1a122

SHA512
3712019af1284c610082227d8124643f3ccc58608b227c4b660b46b8eede1c13f84135d9861030b1a19dfd7064de27b6cac1c881e1a51000e73ef2e4c670960d

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\files_\_Chrome\DEFAUL~1.BIN
MD5
09500b419541e759ce53d87e324fe8fc

SHA1
4b882732508d2fc28536f8281c3b58777720c7da

SHA256
f80e7db7d3a06c87f03f5d0a9c7ab592ef05bc4fa5a8ab65c318c8455bd94476

SHA512
45e04f6283559638be00bffaf1a52a52a6998f835d5d40f756806a2323623074cb7ee9f802f4eba7d7523ccf3170f8986f89349ffbc1f2514ce25fdae0114fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\files_\_Chrome\DEFAUL~1.DB
MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\files_\_Chrome\DEFAUL~2.DB
MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkLXbknWkMC\files_\_Chrome\DEFAUL~3.DB
MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
MD5
1d2a39112767125a8ee84c1b63d070fe

SHA1
f6ae7e6351d8c16cf470d59a481ed053cfc55dd5

SHA256
5f59627da5032edd29bca3798f9d9e67f441bec8a4fc3410360eb9a7bf567386

SHA512
cba766ca4b875dd804d32289e018140fbd0a7ec439188571d05ed4b7ac2f64c11217756e2e42cf85d76abdc2456f08f67fb666aa9d0bdbc73996842f5a1e5efa

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
MD5
1d2a39112767125a8ee84c1b63d070fe

SHA1
f6ae7e6351d8c16cf470d59a481ed053cfc55dd5

SHA256
5f59627da5032edd29bca3798f9d9e67f441bec8a4fc3410360eb9a7bf567386

SHA512
cba766ca4b875dd804d32289e018140fbd0a7ec439188571d05ed4b7ac2f64c11217756e2e42cf85d76abdc2456f08f67fb666aa9d0bdbc73996842f5a1e5efa

Download Submit
memory/8-144-0x0000000000000000-mapping.dmp

Download
memory/8-151-0x00000000012F0000-0x00000000019F2000-memory.dmp

Filesize
7.0MB

Download
memory/8-150-0x00000000012F0000-0x00000000019F2000-memory.dmp

Filesize
7.0MB

Download
memory/8-149-0x00000000012F0000-0x00000000019F2000-memory.dmp

Filesize
7.0MB

Download
memory/8-148-0x00000000012F0000-0x00000000019F2000-memory.dmp

Filesize
7.0MB

Download
memory/8-147-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/504-139-0x0000000000170000-0x0000000000872000-memory.dmp

Filesize
7.0MB

Download
memory/504-141-0x0000000000170000-0x0000000000872000-memory.dmp

Filesize
7.0MB

Download
memory/504-142-0x0000000000170000-0x0000000000872000-memory.dmp

Filesize
7.0MB

Download
memory/504-143-0x0000000000170000-0x0000000000872000-memory.dmp

Filesize
7.0MB

Download
memory/504-140-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/504-120-0x0000000000000000-mapping.dmp

Download
memory/1108-115-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1108-116-0x0000000000D70000-0x0000000001464000-memory.dmp

Filesize
7.0MB

Download
memory/1108-117-0x0000000000D70000-0x0000000001464000-memory.dmp

Filesize
7.0MB

Download
memory/1108-118-0x0000000000D70000-0x0000000001464000-memory.dmp

Filesize
7.0MB

Download
memory/1108-119-0x0000000000D70000-0x0000000001464000-memory.dmp

Filesize
7.0MB

Download
memory/1160-138-0x0000000000000000-mapping.dmp

Download
memory/1892-123-0x0000000000000000-mapping.dmp

Download