cryptbot | 46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24/05/2022, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe
Size 4.2MB
Sample220524-cndwqsfdbl
SHA256 46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e
MD5 7d14adec56de3bef6a97e287b665f03f
SHA1 48df9561efd1136d36bcff59d3950b9f84215e24
SHA512 d50aa3ccd3fa39c46dacfe47023ea0bba2785a7b2eadba7d511e4b57c33a1a30a3d154a4a848b0b71cce7eb3de977ddf518a36f4b854c2fe82b1d0056beebb0d
MD5 SHA1 SHA512

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Blocklisted process makes network request 2 IoCs

flow	pid	Process
18	3556	WScript.exe
22	3556	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4164	Ambas.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ambas.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ambas.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	Ambas.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2928	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe
4164	Ambas.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ambas.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ambas.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2928	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe
2928	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe
4164	Ambas.exe
4164	Ambas.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe
4164	Ambas.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 4164	2928	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe	90
PID 2928 wrote to memory of 4164	2928	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe	90
PID 2928 wrote to memory of 4164	2928	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe	90
PID 2928 wrote to memory of 3556	2928	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe	91
PID 2928 wrote to memory of 3556	2928	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe	91
PID 2928 wrote to memory of 3556	2928	46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe	91

C:\Users\Admin\AppData\Local\Temp\46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe
"C:\Users\Admin\AppData\Local\Temp\46dab0c679f28261031672beebd9a399edaf9518cc93bce3b77035c1243e0e6e.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928
- C:\ProgramData\Clend\Ambas.exe
  C:\ProgramData\Clend\Ambas.exe
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4164
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\ipras.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:3556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ambas.exe

Path C:\ProgramData\Clend\Ambas.exe
Size 2.0MB
SHA256 42f4091c3f9d63d4ee2c1239a40a7147bac6b2871d332c6b1d5838ca4c6e487d
MD5 c9daf99bcc5a4463bfd18f71fd72ad89
SHA1 3cc2e4d7b5e85ad9f077100791de7f044145561f
SHA512 2744091e27b508a380c85d736e510abaa86a8c9eb9a6f3bc8774dd1d1bb777db97080b18013f5629bdf635748d5b38cbe4e0ecc047331288f0eba4ab37397dae
SSDEEP 49152:zRckFSWy2vEQu0CEJ1e2XTYYU2cGgKqU9bsfOUId:zUOu0y2jjXmKAGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ambas.exe

Path C:\ProgramData\Clend\Ambas.exe
Size 2.0MB
SHA256 42f4091c3f9d63d4ee2c1239a40a7147bac6b2871d332c6b1d5838ca4c6e487d
MD5 c9daf99bcc5a4463bfd18f71fd72ad89
SHA1 3cc2e4d7b5e85ad9f077100791de7f044145561f
SHA512 2744091e27b508a380c85d736e510abaa86a8c9eb9a6f3bc8774dd1d1bb777db97080b18013f5629bdf635748d5b38cbe4e0ecc047331288f0eba4ab37397dae
SSDEEP 49152:zRckFSWy2vEQu0CEJ1e2XTYYU2cGgKqU9bsfOUId:zUOu0y2jjXmKAGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ipras.vbs

Path C:\ProgramData\ipras.vbs
Size 126B
SHA256 a1b0cb16fb2ecd66fccf156024404801ad694056e8a596326c1b27b57d8eabe8
MD5 b802ff9244875f69db2fae0f78e92b10
SHA1 49385a89cd575894a29fbda969b99cc1f5cf8076
SHA512 609856415a7ae2b3e260f945f1c8a8d2a28884c202d37181bea948708918f24b42ae03f17dba1520fddc91b2f7a182b0b8f885f33ea6f81bb3ee4c72e4e9350e
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 717B
SHA256 45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
MD5 54e9306f95f32e50ccd58af19753d929
SHA1 eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA512 8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 7cefc5ac4178421b276a8a26b123c4e699ba886fb7e037147f8d972d87707dc8
MD5 4011d68980a52d9b9a029d051e4331e4
SHA1 6835e33ab2820fbd76727f3939cb0d14a2d18b74
SHA512 9c4953801dece4241aa3a04d989dd63e0c41cd443d7d967c90b12408ef04ee7845fd38f4367094de1fdc5aac576ba581a777732a951d5bc51426229d16fdbd97
MD5 SHA1 SHA512

Submit Download

memory/2928-130-0x0000000077B70000-0x0000000077D13000-memory.dmp

Download

memory/2928-131-0x0000000000400000-0x0000000000B44000-memory.dmp

Download

memory/4164-135-0x0000000077B70000-0x0000000077D13000-memory.dmp

Download

memory/4164-136-0x0000000000EC0000-0x00000000013D1000-memory.dmp

Download