cryptbot | 0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133

Analysis

max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28/05/2022, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe
Size 1.8MB
Sample220528-av7raaeedq
SHA256 0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133
MD5 638983588b31575a8b27afcc5cfc18d2
SHA1 10a28ef3350cb9b469ed02029663be595294572a
SHA512 3be67bb70eb2e9f06b383544ae5f0a570f4cb134f72eeaa206952ea4e4fc34447266f384661445f90d2965464cb695b1f7eac08201b95490fa4b3ab6c1178274
MD5 SHA1 SHA512

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

cinvvv14.top
morsxd01.top

Attributes

payload_url
http://binsas01.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2004-147-0x0000000004890000-0x0000000004CC3000-memory.dmp	family_cryptbot
behavioral2/memory/2004-148-0x0000000004890000-0x0000000004CC3000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
4356	Uccelli.exe.com
2004	Uccelli.exe.com

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Uccelli.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Uccelli.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4264	PING.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 3936	944	0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe	82
PID 944 wrote to memory of 3936	944	0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe	82
PID 944 wrote to memory of 3936	944	0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe	82
PID 944 wrote to memory of 3656	944	0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe	84
PID 944 wrote to memory of 3656	944	0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe	84
PID 944 wrote to memory of 3656	944	0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe	84
PID 3656 wrote to memory of 4608	3656	cmd.exe	86
PID 3656 wrote to memory of 4608	3656	cmd.exe	86
PID 3656 wrote to memory of 4608	3656	cmd.exe	86
PID 4608 wrote to memory of 4392	4608	cmd.exe	87
PID 4608 wrote to memory of 4392	4608	cmd.exe	87
PID 4608 wrote to memory of 4392	4608	cmd.exe	87
PID 4608 wrote to memory of 4356	4608	cmd.exe	88
PID 4608 wrote to memory of 4356	4608	cmd.exe	88
PID 4608 wrote to memory of 4356	4608	cmd.exe	88
PID 4608 wrote to memory of 4264	4608	cmd.exe	91
PID 4608 wrote to memory of 4264	4608	cmd.exe	91
PID 4608 wrote to memory of 4264	4608	cmd.exe	91
PID 4356 wrote to memory of 2004	4356	Uccelli.exe.com	92
PID 4356 wrote to memory of 2004	4356	Uccelli.exe.com	92
PID 4356 wrote to memory of 2004	4356	Uccelli.exe.com	92

C:\Users\Admin\AppData\Local\Temp\0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe
"C:\Users\Admin\AppData\Local\Temp\0369c702f727e52c53161518048c5b1c2e85fd20562f54fca6a782e29424e133.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\at.exe
  "C:\Windows\System32\at.exe"
  2⤵
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe < Molle.aif
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^oeyrUzeDfaslSmWTzcxknRporAQbpbhPnyHLSVvOhDOLIsGxZVNftKIdTXqxCExRtBMMSkqbYFXUebAMTvnhJYLOv$" Invece.aif
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\Uccelli.exe.com
      Uccelli.exe.com X
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\Uccelli.exe.com
        
        C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\Uccelli.exe.com X
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2004
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:4264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ama.aif

Path C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\Ama.aif
Size 887KB
SHA256 c759e97ee00cec92b14f691439172da76ce905dad78e39f0527f5eec709c84e1
MD5 01adb5490f18b2b15edcde34ede58f3e
SHA1 13211e23943c47debb46678552e5d8f1bcb142d0
SHA512 ade7b623a631eae5bd71a8abbce710a265b4f01dde93ce04b7e8647567fc653d1858fd9b6822062b502d999604aa99092eb5c3390c5330ea46899b9cfe75e677
SSDEEP 24576:JSxy4epmbKEU/5LEh3u5VwmCQehaJBa4e:AxKmbZU/BC3kV3nJBah
MD5 SHA1 SHA512 SSDEEP

Submit Download

Invece.aif

Path C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\Invece.aif
Size 921KB
SHA256 eedceebf4e0af02fa335a3d4756d7a0493fd084fb5730462700decb1939c91b5
MD5 23a66b06d1758d74f453d259d091aec9
SHA1 e62ecf19bc007ed233e7a4f6073873245986b458
SHA512 e6747d01ed14732e25bc2121367bbb3d032fe33a9299567aef327e17a91b0ef4caf05a987fb09b2e0af005351ff5588c5791490542b6efe0727d3772e360acf2
SSDEEP 24576:WJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:WC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lacrime.aif

Path C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\Lacrime.aif
Size 683KB
SHA256 970ce8bf7aa3899c1020c393d87c25eab39c0791f98e98e589727d5d2acc3796
MD5 1754121f5594d16266b500442cef005a
SHA1 24bbe2d42b1cbf362451a6f5c185a91b0dece2e6
SHA512 bd54b9491b33a139608249a41406099daecfcb7f43e5cddfe4f209d7ce92e042fd7449c6c77088fdfda239874f075c30a0f2146a510021a5441e7d0368aa1aaf
SSDEEP 12288:+5syqwIVcIkouXeAc3BnNENvT11ZqClHLfrrmmLpE:+yyqwCvqxHdfHPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Molle.aif

Path C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\Molle.aif
Size 116KB
SHA256 353e0d4d5436eb0f47008ed83992bb42119592354f5486905bbb16939905c777
MD5 f8c34ce1512e8920317a7f5d534f946f
SHA1 12f72cae93d429c349d22643fa137f4c1ea2f4c8
SHA512 70975d1413996eeea232c112a444130069fc5de598db424bb43a6816c72a192e75f1a287257aad0043c317625df51d6d6f0e0cf914fe0db34b093601dae08c26
SSDEEP 3072:FYsGrbcxe+LaqM2TAPVuIKr3buuVjZfXYUyVfnBWOkX6gz:ascbcLLvvAPVj6VxXYUyVvBWOUdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uccelli.exe.com

Path C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\Uccelli.exe.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uccelli.exe.com

Path C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\Uccelli.exe.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Roaming\GKTOdmezdWQiv\X
Size 683KB
SHA256 970ce8bf7aa3899c1020c393d87c25eab39c0791f98e98e589727d5d2acc3796
MD5 1754121f5594d16266b500442cef005a
SHA1 24bbe2d42b1cbf362451a6f5c185a91b0dece2e6
SHA512 bd54b9491b33a139608249a41406099daecfcb7f43e5cddfe4f209d7ce92e042fd7449c6c77088fdfda239874f075c30a0f2146a510021a5441e7d0368aa1aaf
SSDEEP 12288:+5syqwIVcIkouXeAc3BnNENvT11ZqClHLfrrmmLpE:+yyqwCvqxHdfHPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2004-147-0x0000000004890000-0x0000000004CC3000-memory.dmp

Download

memory/2004-148-0x0000000004890000-0x0000000004CC3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads