cryptbot | 03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639

General

Target
03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe
Size 1.8MB
Sample221130-qdr79sfe6t
SHA256 03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639
MD5 9151f925ec8251a5230a376a465e33ba
SHA1 f812a5fc70fb81eb30dbca95566424dcab5f2846
SHA512 f3ae3a51f623d5a3cbf33c87a206baf9bf3fefab749530375568af6ae7e030f61d7facf25c546f4c96d1f6bf0442480bea565bf2048ea05400f0af4dbc91b4d5
SSDEEP 49152:A5+hFd+AxZ7zbhOcboW8WJRY5Dzni7gqNLj5+EuzJlGJ1ZJ:A5aFcAzbhO5W1Icb5+EylY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

C2

lorearsa57.top

Attributes

payload_url
http://petrosct05.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 2 IoCs

resource	yara_rule
behavioral2/memory/2000-148-0x0000000000010000-0x0000000000443000-memory.dmp	family_cryptbot
behavioral2/memory/2000-149-0x0000000000010000-0x0000000000443000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
2224	Tutto.com
2000	Tutto.com

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Tutto.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Tutto.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4100	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2000	Tutto.com
2000	Tutto.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3156	4996	03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe	81
PID 4996 wrote to memory of 3156	4996	03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe	81
PID 4996 wrote to memory of 3156	4996	03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe	81
PID 4996 wrote to memory of 4852	4996	03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe	83
PID 4996 wrote to memory of 4852	4996	03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe	83
PID 4996 wrote to memory of 4852	4996	03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe	83
PID 4852 wrote to memory of 928	4852	cmd.exe	85
PID 4852 wrote to memory of 928	4852	cmd.exe	85
PID 4852 wrote to memory of 928	4852	cmd.exe	85
PID 928 wrote to memory of 2120	928	cmd.exe	86
PID 928 wrote to memory of 2120	928	cmd.exe	86
PID 928 wrote to memory of 2120	928	cmd.exe	86
PID 928 wrote to memory of 2224	928	cmd.exe	87
PID 928 wrote to memory of 2224	928	cmd.exe	87
PID 928 wrote to memory of 2224	928	cmd.exe	87
PID 928 wrote to memory of 4100	928	cmd.exe	88
PID 928 wrote to memory of 4100	928	cmd.exe	88
PID 928 wrote to memory of 4100	928	cmd.exe	88
PID 2224 wrote to memory of 2000	2224	Tutto.com	89
PID 2224 wrote to memory of 2000	2224	Tutto.com	89
PID 2224 wrote to memory of 2000	2224	Tutto.com	89

C:\Users\Admin\AppData\Local\Temp\03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe
"C:\Users\Admin\AppData\Local\Temp\03aeb3e3965f46894185970bf8e834b97707a02e5d611d7f667ab6ab48302639.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo bQczn
  2⤵
  PID:3156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Mostra.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^RVglSIfMtVBUqNfquemCPieSggpdrGYNsANKUXhlTfaArKJoYBjHjokKTvWDmZJbXNDAZEyoPfJAOCOD$" Osservava.adts
      4⤵
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\eYXdJJLjcy\Tutto.com
      Tutto.com Ami.accdr
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\eYXdJJLjcy\Tutto.com
        
        C:\Users\Admin\AppData\Local\Temp\eYXdJJLjcy\Tutto.com Ami.accdr
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:2000
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:4100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

3

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ami.accdr

Path C:\Users\Admin\AppData\Local\Temp\eYXdJJLjcy\Ami.accdr
Size 542KB
SHA256 9cc4b651df8ef2936df820a81b6d868d5922feb8516f6d136e5e04c681703ea9
MD5 d326616be191ccc098559f868c253943
SHA1 50c3c830a72b63e2f964f6c937a34665a6ae2e7f
SHA512 358717fb2748309d4255f6d89d20b0ea2ae22e13ad4b7a98a976ca3af61bb3dff7380fe549b5d8edf8f5043d06ac829cc419369402fa1076004fced2b03237b5
SSDEEP 6144:dNLxJBd4FeaWvE5XWmRwpp73RPMyfoT4oUxGCOYz/pazmjhkBiXqM2ycmwm09fQX:dNdHd44yXWzusocOYNazwhNTwm0ZNU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Assorto.accdr

Path C:\Users\Admin\AppData\Local\Temp\eYXdJJLjcy\Assorto.accdr
Size 888KB
SHA256 b27ecb5f829e86f9cb2abbf5b2add0beda712248c02a8391dd1227707f3f6f51
MD5 5508dcb1f645fa4175e8c770eab66055
SHA1 634b20b654f083dabcb73e470ca49bd45234768d
SHA512 3bfa15ca3c238ff2c920d7d724e948070f95f1736709da50e2c9f6eec5932b7910e65358685a42819fffadef25adfbabe105592f0c7c7cde9e4d92dcca30f498
SSDEEP 24576:xub9hK2KLGtwB+yrmIuIbayA+8oi1VsMq+JI06:xk9wB+yrSyMo4VXqQw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mostra.tmp

Path C:\Users\Admin\AppData\Local\Temp\eYXdJJLjcy\Mostra.tmp
Size 106KB
SHA256 1a210cd255e66e485adf61c22cb619d30540003979dd97d95cd8fdee340fb194
MD5 f3c5db8e4fc91a516b9fe4c34d6a1c38
SHA1 41311990caf89708337739f1d6fccc244be51af5
SHA512 1130a5fcbba71d6e192e46eb44196d2f77fda3cb3333a047b07aec2e374b25930ae853343f3e14bab7beed07e594b2688b5e0945cb15bb8912ebeace523e5d7e
SSDEEP 3072:4Al0HdrWsKYJQimeCzMh8j6TzwPDmAR0SJjT:q9qsKY2LeCwc6T8rmAR0oH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Osservava.adts

Path C:\Users\Admin\AppData\Local\Temp\eYXdJJLjcy\Osservava.adts
Size 921KB
SHA256 95198cb75b6da4d22cf6b73650c48bd4c434b3a7f191fec901c5fc586edae8b8
MD5 827e9cf87e9740bba996f8861722b1f2
SHA1 d1a0f5f16ba05ca73211d277945dd4f729cdd613
SHA512 ae8eb75873c91e824bab382a00aa18a65d5d73ae8419d27fc8f00c1ad1d735c86dd193bb853236810d4a1a7593ddfc0abcf83f1ca1edc1217892a8c535415123
SSDEEP 24576:jJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:jC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tutto.com

Path C:\Users\Admin\AppData\Local\Temp\eYXdJJLjcy\Tutto.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tutto.com

Path C:\Users\Admin\AppData\Local\Temp\eYXdJJLjcy\Tutto.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2000-148-0x0000000000010000-0x0000000000443000-memory.dmp

Download

memory/2000-149-0x0000000000010000-0x0000000000443000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads