cryptbot | 128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef

Analysis

max time kernel
94s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2022, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe
Size 694KB
Sample221013-pmfp6adfel
SHA256 128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef
MD5 3d1e5706bdb597866e264e523a235905
SHA1 0e29ff9f72c5ba9e7d5d9e91e82855b7c7d550c3
SHA512 3440ab296697e7aedccd1baccaf375323a7647b973828fe5930f399c5e98c6a78d1fed276890ea04cae90d79c7247cf6f70b964dbbc1857e320b90e76a73d1ab
SSDEEP 12288:2DylDSCPNX9dD2G1nvW7mCtGlkWlqWfzUEzhauFln+DBZhUiyD:2QNPSGnvWpklk+dfzUKhRFln+DBj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

nimjso71.top
morzcm07.top

Attributes

payload_url
http://noirki10.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 4 IoCs

resource	yara_rule
behavioral2/memory/4868-133-0x0000000002280000-0x0000000002361000-memory.dmp	family_cryptbot
behavioral2/memory/4868-134-0x0000000000400000-0x00000000004E5000-memory.dmp	family_cryptbot
behavioral2/memory/4868-136-0x0000000002280000-0x0000000002361000-memory.dmp	family_cryptbot
behavioral2/memory/4868-137-0x0000000000400000-0x00000000004E5000-memory.dmp	family_cryptbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5060	4868	WerFault.exe	81

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4684	timeout.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4868	128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe
4868	128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3484	4868	128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe	89
PID 4868 wrote to memory of 3484	4868	128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe	89
PID 4868 wrote to memory of 3484	4868	128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe	89
PID 3484 wrote to memory of 4684	3484	cmd.exe	93
PID 3484 wrote to memory of 4684	3484	cmd.exe	93
PID 3484 wrote to memory of 4684	3484	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe
"C:\Users\Admin\AppData\Local\Temp\128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\128c03aad237a385db3e36801cc3352a5efc61896b9c9590fba576b1edb823ef.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1604
  2⤵
  - Program crash
  PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4868 -ip 4868
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DKBYWN~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\DKBYWN~1.ZIP
Size 44KB
SHA256 7695a58e5924aaf78c4d0b8e4384cd8754d602a76795229157fad457068f6e96
MD5 86abbfaab69bd6f687d5b94ae950d16a
SHA1 a643976dcee4f1a85ae803e721c48c1d547ca91e
SHA512 5b3c4669302d89b1ca8b73db43dcbb03a3020e5a99374537660569bd6422d024e3afe2b07a6ab36bfb5dcb1a07c2b3358a985034abf71a484fc5c59a6fe8d936
SSDEEP 768:4NGtqokvcr2nH0kfhJs9pPisgeNXZBbSTvBrgR9hvgqbjemwlxp3jewmRWwaQ3w:4NG2vcSnHXw9pRpITviR75MlxpgRpw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DyQaRlGd.tmp

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\DyQaRlGd.tmp
Size 20KB
SHA256 531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
MD5 055c8c5c47424f3c2e7a6fc2ee904032
SHA1 5952781d22cff35d94861fac25d89a39af6d0a87
SHA512 c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
SSDEEP 24:TLPErbXaFpEO5bNmISHnCWm06UwcQF5fB:TTErLOpEO5J/Knvm7U1KB
MD5 SHA1 SHA512 SSDEEP

Submit Download

JQELOU~1.TMP

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\JQELOU~1.TMP
Size 88KB
SHA256 94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
MD5 8ee018331e95a610680a789192a9d362
SHA1 e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA512 4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
SSDEEP 192:ESzmZdXLH97TJMbMB2hnnuyPPo6w/1Vumq:ZzmfXz9uhnuyIB/1Vumq
MD5 SHA1 SHA512 SSDEEP

Submit Download

KIvVTOA.tmp

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\KIvVTOA.tmp
Size 20KB
SHA256 531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
MD5 055c8c5c47424f3c2e7a6fc2ee904032
SHA1 5952781d22cff35d94861fac25d89a39af6d0a87
SHA512 c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
SSDEEP 24:TLPErbXaFpEO5bNmISHnCWm06UwcQF5fB:TTErLOpEO5J/Knvm7U1KB
MD5 SHA1 SHA512 SSDEEP

Submit Download

LGCYWQ~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\LGCYWQ~1.ZIP
Size 44KB
SHA256 def6c5d8b1913718694b540e3b15b2547e130ffe3062c3fcfa093286e760df41
MD5 78fcfc4a40ec5d50b8d9bd0328c0c7c8
SHA1 f8fa9bbc881fe57433cf36d9ed282871aa3b3378
SHA512 df320120bbe0efc559a9aefcf64255bc61bd7e3e90d8bd52a486258a34fa3dd255308ea7073f371729d8b3261517c5f53db654046a5237a396daa806524c8805
SSDEEP 768:6BTAOUu79oUHNgDcQxRW+Vwrkrp1Zlz/1VO8bJ7tLZFeqkg6EjXq4zVy6R:6BTAAhHa8+VwruDZlz/1wMtLZJRhy6R
MD5 SHA1 SHA512 SSDEEP

Submit Download

QZIN.tmp

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\QZIN.tmp
Size 88KB
SHA256 94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
MD5 8ee018331e95a610680a789192a9d362
SHA1 e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA512 4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
SSDEEP 192:ESzmZdXLH97TJMbMB2hnnuyPPo6w/1Vumq:ZzmfXz9uhnuyIB/1Vumq
MD5 SHA1 SHA512 SSDEEP

Submit Download

VyHvlQ.tmp

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\VyHvlQ.tmp
Size 40KB
SHA256 b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
MD5 b608d407fc15adea97c26936bc6f03f6
SHA1 953e7420801c76393902c0d6bb56148947e41571
SHA512 cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
SSDEEP 48:2j3WBA+IIYICVEq8MX0D0HSFlNUK6lGNxGt7KLk8s8LKvUf9KVyJ7hU:u2FCn8MZyFlulGNxGt7KLyeymw
MD5 SHA1 SHA512 SSDEEP

Submit Download

_INFOR~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\_Files\_INFOR~1.TXT
Size 6KB
SHA256 ae553008c16e73a8ea380446aeafa2c373fc5b1726c38535979c4229de438e1c
MD5 75a661bbc9109f7f9412c937ec9f510a
SHA1 e9097b890052b649a2db5d9ffac30df7feaccd91
SHA512 f2a5e978ad4263b4f9351fa86c1143ba61a511db5eb06974f0ef86c9f31882cd74423ca9d4d3caeead89c0631c262e934ecf5350597c2c04f137e378e2d1bdcd
SSDEEP 96:syUteBklskGDObHcnmcnm84McYfODRaHzB+6cnhrcn1wcfzSByYs:TCdZ3mzJUbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

_SCREE~1.JPE

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\_Files\_SCREE~1.JPE
Size 50KB
SHA256 b171a917c3766fb2fd0e30d12add7ad4447da2433815fe0f30c2aeae9a6b614b
MD5 76afd96c39b9a2993cce4d87dd95e269
SHA1 4dbe591b2d156a662e1cb6da905ff2446a343bbe
SHA512 d84a62c17705cde9809144d5a82706044bc61347b110d5e494d91fb49b553a5c45529f282300f09efdb3e4f04ad6f637f9cf2b510b0f6c923fc6d2ba26355b25
SSDEEP 1536:lbMoTHlPE+Z6iyy3O/dfYEuEFgYA84MPaDy:WEHlHZ6iyyeJYEu9YA8zPaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCREEN~1.JPG

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\files_\SCREEN~1.JPG
Size 50KB
SHA256 b171a917c3766fb2fd0e30d12add7ad4447da2433815fe0f30c2aeae9a6b614b
MD5 76afd96c39b9a2993cce4d87dd95e269
SHA1 4dbe591b2d156a662e1cb6da905ff2446a343bbe
SHA512 d84a62c17705cde9809144d5a82706044bc61347b110d5e494d91fb49b553a5c45529f282300f09efdb3e4f04ad6f637f9cf2b510b0f6c923fc6d2ba26355b25
SSDEEP 1536:lbMoTHlPE+Z6iyy3O/dfYEuEFgYA84MPaDy:WEHlHZ6iyyeJYEu9YA8zPaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

SYSTEM~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\files_\SYSTEM~1.TXT
Size 6KB
SHA256 fb08025c21e237e58a6170dd5756af6aa44841686ef7dfbda3a4d522b11fe773
MD5 f4dcef1eb90ba1aa86e21f059e337791
SHA1 ffccb28b3760bd39842a30319e64594398106663
SHA512 4d5d96eed142bb5c14e6df0da159f3f9e40cd111eb974039b9be405e62bd2fa603a003286355978908c60426306ce102fbca05d0508b10601984b7b54ab1139d
SSDEEP 96:kYtewkFzeDObHcnmcnm84McYfODRaHzB+6cnhrcn1wcfzSByYs:oZFzR3mzJUbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

uhTSWLta.tmp

Path C:\Users\Admin\AppData\Local\Temp\WZxAPDlLDyP\uhTSWLta.tmp
Size 40KB
SHA256 b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
MD5 b608d407fc15adea97c26936bc6f03f6
SHA1 953e7420801c76393902c0d6bb56148947e41571
SHA512 cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
SSDEEP 48:2j3WBA+IIYICVEq8MX0D0HSFlNUK6lGNxGt7KLk8s8LKvUf9KVyJ7hU:u2FCn8MZyFlulGNxGt7KLyeymw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4868-132-0x00000000007FE000-0x000000000087B000-memory.dmp

Download

memory/4868-137-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

memory/4868-136-0x0000000002280000-0x0000000002361000-memory.dmp

Download

memory/4868-135-0x00000000007FE000-0x000000000087B000-memory.dmp

Download

memory/4868-134-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

memory/4868-133-0x0000000002280000-0x0000000002361000-memory.dmp

Download

memory/4868-152-0x00000000007FE000-0x000000000087B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads