cryptbot | cb751923695b52f799d7c20ca696069059187258021c9d8f8035e83180e8087d

General

Target

._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe
Size

1.8MB
MD5

afe2eeb9c39fe0aaf3b98b1a570fd77c
SHA1

ca42099bfeafd1a5c79180e0b406679eb5cae47d
SHA256

cb751923695b52f799d7c20ca696069059187258021c9d8f8035e83180e8087d
SHA512

0a15dc447ab97a2129c3d4fddac9b1f6473e5108275053961baf0f4a36a78b50583ee675a1753a300ac9a90cf01447353ca69bba845aa7a78294b1e381969243
SSDEEP

49152:t5+hFlevtNUzY7WawmPzyxMAqpDHd5h419Pu0hO/k5:t5aFlevtw9uzCMdBf4xVhOY

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

C2

abruszgy25.top

Attributes

payload_url
http://petroscd11.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 2 IoCs

resource	yara_rule
behavioral2/memory/4476-148-0x0000000000200000-0x0000000000633000-memory.dmp	family_cryptbot
behavioral2/memory/4476-149-0x0000000000200000-0x0000000000633000-memory.dmp	family_cryptbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe

Executes dropped EXE 2 IoCs

pid	Process
2164	Negli.com
4476	Negli.com

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Negli.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Negli.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4100	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4476	Negli.com
4476	Negli.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4124	4856	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	81
PID 4856 wrote to memory of 4124	4856	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	81
PID 4856 wrote to memory of 4124	4856	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	81
PID 4856 wrote to memory of 4884	4856	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	83
PID 4856 wrote to memory of 4884	4856	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	83
PID 4856 wrote to memory of 4884	4856	._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe	83
PID 4884 wrote to memory of 4300	4884	cmd.exe	85
PID 4884 wrote to memory of 4300	4884	cmd.exe	85
PID 4884 wrote to memory of 4300	4884	cmd.exe	85
PID 4300 wrote to memory of 3136	4300	cmd.exe	86
PID 4300 wrote to memory of 3136	4300	cmd.exe	86
PID 4300 wrote to memory of 3136	4300	cmd.exe	86
PID 4300 wrote to memory of 2164	4300	cmd.exe	87
PID 4300 wrote to memory of 2164	4300	cmd.exe	87
PID 4300 wrote to memory of 2164	4300	cmd.exe	87
PID 4300 wrote to memory of 4100	4300	cmd.exe	88
PID 4300 wrote to memory of 4100	4300	cmd.exe	88
PID 4300 wrote to memory of 4100	4300	cmd.exe	88
PID 2164 wrote to memory of 4476	2164	Negli.com	89
PID 2164 wrote to memory of 4476	2164	Negli.com	89
PID 2164 wrote to memory of 4476	2164	Negli.com	89

C:\Users\Admin\AppData\Local\Temp\._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_b6b7ba4c887c5bbacb8643b62f29b951.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo XtGExU
  2⤵
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Altezza.mpeg
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^lAbNkOShiVjJRNtfJIzMjyQMVxTwAkDFIexxkoUhUizBsGTCjfGOnbgtJLRQUQNVsHqPaJtBNyRtMfcfBsOlFPukNdKmdratxbpJFrpDlyqzFlaxdCfD$" Seguente.mp3
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com
      Negli.com Uno.pptx
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com
        
        C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com Uno.pptx
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:4476
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:4100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

3

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Altezza.mpeg

Filesize
108KB

MD5
2a844be752dd3f88eb8fde52cc17eb93

SHA1
16566b1e6de6c561163bd70a78d0b5e3e80ecd8c

SHA256
ab34e814b57599376c9fecdc4204c82673bb2b17d5fe9d1f4d3de3e1eecf08c1

SHA512
a98fcdb9be93342539cd6c356f89ffaba14d6b9c8ad3b4436897ea4bbf5c2f373e7708d32edf216a5892849c1946f18767b0142c234a5036d319d601bcfd293c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Negli.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Osi.accdb

Filesize
888KB

MD5
3e4a7482443e38011d4aaa0d47df63a4

SHA1
8357eedda93630634d0b06398354ac17a2f7e68f

SHA256
fb5be8cdcdad4a8b8879fbe39b7b6547219e1c0b1e087ff49c5c82b20cab74e9

SHA512
e12413b37ef61090d5a542d9ad85db6383d8a3c437d0e7e2582fcb4944e9c47f7e126ffc4fceeedfa60eb47802668874cb5317f3f9b22ee9849650eb1bc6825e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Seguente.mp3

Filesize
921KB

MD5
dff7a2df04830caeefb707eb16347978

SHA1
b246254d21482c383097d0dc5a0073d64a7b99b7

SHA256
421b0ef0e2d2a87b9afe1bcd7b3a3ca0eda311ee4a3a93c4d72e7c18acf5c490

SHA512
96ae714f2be8166f19ff3a3c9a250e0b12b0fa02b29e0d1f305e74e3f8d88e0f7c9a9b63a37add2caab72cf28c42cb1126098ce91348ca5de86d8a7e9a8611a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\LuUMABtmHExLGJjQG\Uno.pptx

Filesize
696KB

MD5
a23ec366a0caa4e8a15e9c890076ac93

SHA1
a4d0cedc500237fcde5e616931ab10e5909cd789

SHA256
8872a4b96f95e298893f6242c993ad18d59d8ecdbb5addec72ce3c94caf0d9c5

SHA512
f63ccd65ffb1a23d2cebff458a6d4c7c706f8673f74c97d92d46676546b99780d92c778b7ff070d88caffd9ab4d47df69e279e8223be5b2f6802aad7c43ad286

Download Submit
memory/4476-148-0x0000000000200000-0x0000000000633000-memory.dmp

Filesize
4.2MB

Download
memory/4476-149-0x0000000000200000-0x0000000000633000-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads