cryptbot | 192ea5280a05d8d5fb39c4834befe628a396e4cd5a898ebb3967466b4295774f

General

Target

file_2.exe
Size

2.5MB
MD5

9176db54f9eec97d7900bb5e5aa97d62
SHA1

d58d81ee1e2eb302f8c059e3f02a2c1b3a880889
SHA256

192ea5280a05d8d5fb39c4834befe628a396e4cd5a898ebb3967466b4295774f
SHA512

aa38e8b75cfcca6fd1989717510d6ce04847fd492c8da236dbb11a4cd9ee14539d5955acd43b98ccbcd2c49dea33b38ffd02d306109cb76861ea2d4c94d55769

Score

10^/10

cryptbot evasion spyware stealer themida trojan

Malware Config

Extracted

Family

cryptbot

C2

hevahu32.top

morypd03.top

Attributes

payload_url
http://kyrpbr04.top/download.php?file=orrery.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file_2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file_2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file_2.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

880 cmd.exe

pid	process
880	cmd.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1692-55-0x0000000000D00000-0x000000000138A000-memory.dmp	themida
behavioral1/memory/1692-56-0x0000000000D00000-0x000000000138A000-memory.dmp	themida
behavioral1/memory/1692-57-0x0000000000D00000-0x000000000138A000-memory.dmp	themida
behavioral1/memory/1692-58-0x0000000000D00000-0x000000000138A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

file_2.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file_2.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

file_2.exe

pid process

1692 file_2.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file_2.exe

pid	process
1692	file_2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file_2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file_2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file_2.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

664 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

file_2.exe

pid process

1692 file_2.exe

pid	process
664	timeout.exe

pid	process
1692	file_2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

file_2.execmd.exe

description	pid	process	target process
PID 1692 wrote to memory of 880	1692	file_2.exe	cmd.exe
PID 1692 wrote to memory of 880	1692	file_2.exe	cmd.exe
PID 1692 wrote to memory of 880	1692	file_2.exe	cmd.exe
PID 1692 wrote to memory of 880	1692	file_2.exe	cmd.exe
PID 880 wrote to memory of 664	880	cmd.exe	timeout.exe
PID 880 wrote to memory of 664	880	cmd.exe	timeout.exe
PID 880 wrote to memory of 664	880	cmd.exe	timeout.exe
PID 880 wrote to memory of 664	880	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\file_2.exe
"C:\Users\Admin\AppData\Local\Temp\file_2.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\ooXPgIvJflnfb & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\file_2.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\SysWOW64\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:664

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-60-0x0000000000000000-mapping.dmp

Download
memory/880-59-0x0000000000000000-mapping.dmp

Download
memory/1692-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1692-55-0x0000000000D00000-0x000000000138A000-memory.dmp

Filesize
6.5MB

Download
memory/1692-56-0x0000000000D00000-0x000000000138A000-memory.dmp

Filesize
6.5MB

Download
memory/1692-57-0x0000000000D00000-0x000000000138A000-memory.dmp

Filesize
6.5MB

Download
memory/1692-58-0x0000000000D00000-0x000000000138A000-memory.dmp

Filesize
6.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads