General

  • Target

    51190e0dc5495766f83213fd34009af5.exe

  • Size

    2MB

  • Sample

    220920-s2f61shbcn

  • MD5

    51190e0dc5495766f83213fd34009af5

  • SHA1

    69d9b3995105cdfb7a86f3bbf9386ef214fb1290

  • SHA256

    af0403b7c12d7b7fa9c487eb4a6e68705e9247abf7bc542f77168bd4ed3408fb

  • SHA512

    fc5e535f3329e5042546b7f491a652152293bfeafedef2e06e0eba5706a16cc946c64f130d34879be6de6a740ae520fc65143910e29ab5bb3f48ffb63a8a5b28

  • SSDEEP

    24576:YoqqcSy2wbUXoArd8SFErUYZ+uNrLFW5CPNWqo0N4IJpsqbMFGf0gAF0NPHyO034:CqcJdiq+WZdgGf6RuyVJi

Malware Config

Extracted

Family

cryptbot

C2

http://dixuip12.top/gate.php

Attributes
payload_url
http://luedil01.top/bhutan.dat

Targets

    • Target

      51190e0dc5495766f83213fd34009af5.exe

    • Size

      2MB

    • MD5

      51190e0dc5495766f83213fd34009af5

    • SHA1

      69d9b3995105cdfb7a86f3bbf9386ef214fb1290

    • SHA256

      af0403b7c12d7b7fa9c487eb4a6e68705e9247abf7bc542f77168bd4ed3408fb

    • SHA512

      fc5e535f3329e5042546b7f491a652152293bfeafedef2e06e0eba5706a16cc946c64f130d34879be6de6a740ae520fc65143910e29ab5bb3f48ffb63a8a5b28

    • SSDEEP

      24576:YoqqcSy2wbUXoArd8SFErUYZ+uNrLFW5CPNWqo0N4IJpsqbMFGf0gAF0NPHyO034:CqcJdiq+WZdgGf6RuyVJi

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

                Privilege Escalation

                  Tasks