cryptbot | 052e54df0b86483f84bbff6504e202c36e7bc25885e369e830dd7086fb7c7562

Analysis

max time kernel
449s
max time network
451s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
20-12-2023 01:43

Target

131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe
Size

305KB
MD5

4309f4b4bb455f998d1fdf310cd83484
SHA1

4ee10072d4dff28efcd64d8dcd631760868d644b
SHA256

131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1
SHA512

3d730ec6e3b385a69fa62634f4776e98327bc8f5da6330b109d3de5b37339dcb97cf9bf489c548de23f6ff71b115e921d5179cf2606eba61783851462ba807bf
SSDEEP

6144:zWmk/wokUNpuDoAVUx99rpABXHxjdgwJids6m+8suhyiP:NswuNpQv299rpAVHxJgw0dsp+dTiP

Score

10^/10

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5044 2300 WerFault.exe 131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe

pid	pid_target	process	target process
5044	2300	WerFault.exe	131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe

C:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe
"C:\Users\Admin\AppData\Local\Temp\131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1.exe"
1⤵
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 236
  2⤵
  - Program crash
  PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2300 -ip 2300
1⤵
PID:4476

memory/2300-1-0x0000000002D80000-0x0000000002E80000-memory.dmp

Filesize
1024KB

Download
memory/2300-2-0x0000000002E80000-0x0000000002EC5000-memory.dmp

Filesize
276KB

Download