cryptbot | 3235b41880fdf5177f9edbf583cc94a519d04676865fc40f001695eeb936c59d

Analysis

max time kernel
96s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2022, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AppSetup.exe
Size 660.1MB
Sample221229-s1ddqsdd37
SHA256 3fc2acfabd3df4ffc195287be2802bb75bb87ce0c9f2797de149c970720b64e0
MD5 3938fb13576dd1813164bbe343d7654e
SHA1 55c3d97479746bbc25fdf757525e96ed511f4f31
SHA512 9d66bb9c6f150541e690842e678c5640ef66a227e5117ae00c586e73392892e5a068d174e8b01ef3ef0e49eb33c09ef1d40c72a86bad238dcabba0753fd165bd
SSDEEP 196608:asF8oTaj3g2guPfSsS0/ct6WzLXzZtM+HDxS0/ctv:terg2guyLN8m/Z2SD0Nt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot evasion spyware stealer themida trojan

Malware Config

Extracted

Family

cryptbot

http://luvyku45.top/gate.php

Attributes

payload_url
http://kihaws05.top/falcon.dat

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	falcon.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DpEditor.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
21	3608	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2948	falcon.exe
4704	DpEditor.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	falcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	falcon.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0008000000022e35-156.dat	themida
behavioral2/files/0x0008000000022e35-158.dat	themida
behavioral2/memory/2948-159-0x0000000000470000-0x0000000000B54000-memory.dmp	themida
behavioral2/memory/2948-160-0x0000000000470000-0x0000000000B54000-memory.dmp	themida
behavioral2/memory/2948-161-0x0000000000470000-0x0000000000B54000-memory.dmp	themida
behavioral2/memory/2948-162-0x0000000000470000-0x0000000000B54000-memory.dmp	themida
behavioral2/memory/2948-163-0x0000000000470000-0x0000000000B54000-memory.dmp	themida
behavioral2/files/0x000c000000022d73-166.dat	themida
behavioral2/memory/2948-168-0x0000000000470000-0x0000000000B54000-memory.dmp	themida
behavioral2/files/0x000c000000022d73-167.dat	themida
behavioral2/memory/4704-170-0x00000000000E0000-0x00000000007C4000-memory.dmp	themida
behavioral2/memory/4704-171-0x00000000000E0000-0x00000000007C4000-memory.dmp	themida
behavioral2/memory/4704-173-0x00000000000E0000-0x00000000007C4000-memory.dmp	themida
behavioral2/memory/4704-174-0x00000000000E0000-0x00000000007C4000-memory.dmp	themida
behavioral2/memory/4704-175-0x00000000000E0000-0x00000000007C4000-memory.dmp	themida
behavioral2/memory/4704-177-0x00000000000E0000-0x00000000007C4000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	falcon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DpEditor.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	aspnet_compiler.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 28 IoCs

pid	Process
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
2948	falcon.exe
4704	DpEditor.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3608 set thread context of 4328	3608	powershell.exe	91

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	aspnet_compiler.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2896	timeout.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4704	DpEditor.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 3608	1048	AppSetup.exe	88
PID 1048 wrote to memory of 3608	1048	AppSetup.exe	88
PID 1048 wrote to memory of 3608	1048	AppSetup.exe	88
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 3608 wrote to memory of 4328	3608	powershell.exe	91
PID 4328 wrote to memory of 3112	4328	aspnet_compiler.exe	92
PID 4328 wrote to memory of 3112	4328	aspnet_compiler.exe	92
PID 4328 wrote to memory of 3112	4328	aspnet_compiler.exe	92
PID 4328 wrote to memory of 1644	4328	aspnet_compiler.exe	94
PID 4328 wrote to memory of 1644	4328	aspnet_compiler.exe	94
PID 4328 wrote to memory of 1644	4328	aspnet_compiler.exe	94
PID 3112 wrote to memory of 2948	3112	cmd.exe	96
PID 3112 wrote to memory of 2948	3112	cmd.exe	96
PID 3112 wrote to memory of 2948	3112	cmd.exe	96
PID 1644 wrote to memory of 2896	1644	cmd.exe	97
PID 1644 wrote to memory of 2896	1644	cmd.exe	97
PID 1644 wrote to memory of 2896	1644	cmd.exe	97
PID 2948 wrote to memory of 4704	2948	falcon.exe	98
PID 2948 wrote to memory of 4704	2948	falcon.exe	98
PID 2948 wrote to memory of 4704	2948	falcon.exe	98

C:\Users\Admin\AppData\Local\Temp\AppSetup.exe
"C:\Users\Admin\AppData\Local\Temp\AppSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe
    3⤵
    - Maps connected drives based on registry
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Roaming\12B322BC556E76E0\falcon.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Users\Admin\AppData\Roaming\12B322BC556E76E0\falcon.exe
        
        C:\Users\Admin\AppData\Roaming\12B322BC556E76E0\falcon.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
        
        "C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: AddClipboardFormatListener
        
        PID:4704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout -t 5 && del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout -t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:2896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

falcon.exe

Path C:\Users\Admin\AppData\Roaming\12B322BC556E76E0\falcon.exe
Size 2.6MB
SHA256 3281a7d3ad7c6e82ce21069bb767369d87e57d5bc69aa0710723a0c236b5e196
MD5 947d7d11d0269105ba7ae9afe06324df
SHA1 50d994724a828a07927c39a6b542b968948ebfe5
SHA512 fc6ba7f9c08be64faa2cfc85085ea72c92259383195a6c7b25d1be580a6b826a8e5b1aa493cbea08b5b0e95b79063cb0174c08f32f041fe8e92048d0c510e7ed
SSDEEP 49152:ofTct17MHYcDbXERvZEf+T5iSgRhA3t98e4O+6T2GlUxtdZJDSgWH9+AM1Rn:Z/7KLEgf+T5SRq3b8e4vG6fwgWdNCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

falcon.exe

Path C:\Users\Admin\AppData\Roaming\12B322BC556E76E0\falcon.exe
Size 2.6MB
SHA256 3281a7d3ad7c6e82ce21069bb767369d87e57d5bc69aa0710723a0c236b5e196
MD5 947d7d11d0269105ba7ae9afe06324df
SHA1 50d994724a828a07927c39a6b542b968948ebfe5
SHA512 fc6ba7f9c08be64faa2cfc85085ea72c92259383195a6c7b25d1be580a6b826a8e5b1aa493cbea08b5b0e95b79063cb0174c08f32f041fe8e92048d0c510e7ed
SSDEEP 49152:ofTct17MHYcDbXERvZEf+T5iSgRhA3t98e4O+6T2GlUxtdZJDSgWH9+AM1Rn:Z/7KLEgf+T5SRq3b8e4vG6fwgWdNCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

DpEditor.exe

Path C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
Size 2.6MB
SHA256 3281a7d3ad7c6e82ce21069bb767369d87e57d5bc69aa0710723a0c236b5e196
MD5 947d7d11d0269105ba7ae9afe06324df
SHA1 50d994724a828a07927c39a6b542b968948ebfe5
SHA512 fc6ba7f9c08be64faa2cfc85085ea72c92259383195a6c7b25d1be580a6b826a8e5b1aa493cbea08b5b0e95b79063cb0174c08f32f041fe8e92048d0c510e7ed
SSDEEP 49152:ofTct17MHYcDbXERvZEf+T5iSgRhA3t98e4O+6T2GlUxtdZJDSgWH9+AM1Rn:Z/7KLEgf+T5SRq3b8e4vG6fwgWdNCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

DpEditor.exe

Path C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
Size 2.6MB
SHA256 3281a7d3ad7c6e82ce21069bb767369d87e57d5bc69aa0710723a0c236b5e196
MD5 947d7d11d0269105ba7ae9afe06324df
SHA1 50d994724a828a07927c39a6b542b968948ebfe5
SHA512 fc6ba7f9c08be64faa2cfc85085ea72c92259383195a6c7b25d1be580a6b826a8e5b1aa493cbea08b5b0e95b79063cb0174c08f32f041fe8e92048d0c510e7ed
SSDEEP 49152:ofTct17MHYcDbXERvZEf+T5iSgRhA3t98e4O+6T2GlUxtdZJDSgWH9+AM1Rn:Z/7KLEgf+T5SRq3b8e4vG6fwgWdNCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-133-0x0000000007D30000-0x00000000082D4000-memory.dmp

Download

memory/1048-134-0x0000000007820000-0x00000000078B2000-memory.dmp

Download

memory/1048-135-0x00000000077C0000-0x00000000077CA000-memory.dmp

Download

memory/1048-132-0x0000000000030000-0x00000000008B0000-memory.dmp

Download

memory/2948-161-0x0000000000470000-0x0000000000B54000-memory.dmp

Download

memory/2948-159-0x0000000000470000-0x0000000000B54000-memory.dmp

Download

memory/2948-163-0x0000000000470000-0x0000000000B54000-memory.dmp

Download

memory/2948-160-0x0000000000470000-0x0000000000B54000-memory.dmp

Download

memory/2948-169-0x0000000077730000-0x00000000778D3000-memory.dmp

Download

memory/2948-168-0x0000000000470000-0x0000000000B54000-memory.dmp

Download

memory/2948-162-0x0000000000470000-0x0000000000B54000-memory.dmp

Download

memory/2948-164-0x0000000077730000-0x00000000778D3000-memory.dmp

Download

memory/3608-139-0x0000000005A60000-0x0000000005A82000-memory.dmp

Download

memory/3608-146-0x0000000007710000-0x000000000772A000-memory.dmp

Download

memory/3608-145-0x0000000007D70000-0x00000000083EA000-memory.dmp

Download

memory/3608-144-0x0000000007670000-0x00000000076E6000-memory.dmp

Download

memory/3608-143-0x0000000006940000-0x0000000006984000-memory.dmp

Download

memory/3608-142-0x0000000006390000-0x00000000063AE000-memory.dmp

Download

memory/3608-141-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Download

memory/3608-140-0x0000000005B00000-0x0000000005B66000-memory.dmp

Download

memory/3608-138-0x0000000005430000-0x0000000005A58000-memory.dmp

Download

memory/3608-137-0x0000000004D10000-0x0000000004D46000-memory.dmp

Download

memory/4328-154-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4328-151-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4328-150-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4328-149-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4328-148-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4704-170-0x00000000000E0000-0x00000000007C4000-memory.dmp

Download

memory/4704-171-0x00000000000E0000-0x00000000007C4000-memory.dmp

Download

memory/4704-172-0x0000000077730000-0x00000000778D3000-memory.dmp

Download

memory/4704-173-0x00000000000E0000-0x00000000007C4000-memory.dmp

Download

memory/4704-174-0x00000000000E0000-0x00000000007C4000-memory.dmp

Download

memory/4704-175-0x00000000000E0000-0x00000000007C4000-memory.dmp

Download

memory/4704-176-0x0000000077730000-0x00000000778D3000-memory.dmp

Download

memory/4704-177-0x00000000000E0000-0x00000000007C4000-memory.dmp

Download