cryptbot | a806f8e113496f38ba62684288d9ca209797bb6776030d6834f19070676e31f3

Analysis

max time kernel
35s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c4977f3e2a61cbc7ecdeec43113b0b8.exe
Size 1.5MB
Sample231225-tqa2asdgfk
SHA256 a806f8e113496f38ba62684288d9ca209797bb6776030d6834f19070676e31f3
MD5 2c4977f3e2a61cbc7ecdeec43113b0b8
SHA1 d5621843ee81e14a956dd18f1f2e05e7867d200d
SHA512 a07d19212900d829f9d6f12e10319a431fc5be2b55c3ff480231738cc72229255ad00d38b90f75c81db0f844f91c963874e7d4ee5af0cfa6061dafda037a7666
SSDEEP 24576:JBS3he1qY6VpPuM8fdxg7DAfp5pvN7s89TNpTl82qcDl43YwS2f81w:JBKe4xseip5TF1NH82qcx4Iwk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

ewafve51.top
morexn05.top

Attributes

payload_url
http://winorm07.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 4 IoCs

resource	yara_rule
behavioral2/memory/372-26-0x0000000004520000-0x00000000045C3000-memory.dmp	family_cryptbot
behavioral2/memory/372-27-0x0000000004520000-0x00000000045C3000-memory.dmp	family_cryptbot
behavioral2/memory/372-25-0x0000000004520000-0x00000000045C3000-memory.dmp	family_cryptbot
behavioral2/memory/372-29-0x0000000004520000-0x00000000045C3000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
2604	Oricellari.exe.com
372	Oricellari.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2c4977f3e2a61cbc7ecdeec43113b0b8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Oricellari.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Oricellari.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4864	PING.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 800	3236	2c4977f3e2a61cbc7ecdeec43113b0b8.exe	32
PID 3236 wrote to memory of 800	3236	2c4977f3e2a61cbc7ecdeec43113b0b8.exe	32
PID 3236 wrote to memory of 800	3236	2c4977f3e2a61cbc7ecdeec43113b0b8.exe	32
PID 3236 wrote to memory of 4360	3236	2c4977f3e2a61cbc7ecdeec43113b0b8.exe	31
PID 3236 wrote to memory of 4360	3236	2c4977f3e2a61cbc7ecdeec43113b0b8.exe	31
PID 3236 wrote to memory of 4360	3236	2c4977f3e2a61cbc7ecdeec43113b0b8.exe	31
PID 4360 wrote to memory of 3548	4360	cmd.exe	30
PID 4360 wrote to memory of 3548	4360	cmd.exe	30
PID 4360 wrote to memory of 3548	4360	cmd.exe	30
PID 3548 wrote to memory of 1044	3548	cmd.exe	29
PID 3548 wrote to memory of 1044	3548	cmd.exe	29
PID 3548 wrote to memory of 1044	3548	cmd.exe	29
PID 3548 wrote to memory of 2604	3548	cmd.exe	23
PID 3548 wrote to memory of 2604	3548	cmd.exe	23
PID 3548 wrote to memory of 2604	3548	cmd.exe	23
PID 3548 wrote to memory of 4864	3548	cmd.exe	24
PID 3548 wrote to memory of 4864	3548	cmd.exe	24
PID 3548 wrote to memory of 4864	3548	cmd.exe	24
PID 2604 wrote to memory of 372	2604	Oricellari.exe.com	26
PID 2604 wrote to memory of 372	2604	Oricellari.exe.com	26
PID 2604 wrote to memory of 372	2604	Oricellari.exe.com	26

C:\Users\Admin\AppData\Local\Temp\2c4977f3e2a61cbc7ecdeec43113b0b8.exe
"C:\Users\Admin\AppData\Local\Temp\2c4977f3e2a61cbc7ecdeec43113b0b8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Accorrendo.vsdx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c iGHD
  2⤵
  PID:800

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Oricellari.exe.com
Oricellari.exe.com O
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Oricellari.exe.com
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Oricellari.exe.com O
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:372

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 30
1⤵
- Runs ping.exe
PID:4864

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^PDZqcWtnfyFhrjfahThQUuhFyPddeeJBrYMfssRxjqYmENUKnZJjZIDJdzVGFNvhvtptmqqWwTDUiNwaUGReavBcxeYYclOmDLrmDPlnZNkutJCD$" Dai.vsdx
1⤵
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd
1⤵
- Suspicious use of WriteProcessMemory
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Accorrendo.vsdx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Accorrendo.vsdx
Size 574B
SHA256 b2cc4707906a81a86b2dfaedcbd12800d849376d1f0607f6d39f6a6be99f9306
MD5 019414866257e33e3b346acd36efcea3
SHA1 45de374644e5fd3885e1c71a51bd5e8e33aa915c
SHA512 172bf2c2ce445c0dad6780a9923cc87c25828657e9939244f65f0bc77155bf9a4dd6b81eaec9de4945b71aad896791acc7ae8e96f3bfba07a486c850b23fcd81
MD5 SHA1 SHA512

Submit Download

Dai.vsdx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dai.vsdx
Size 52KB
SHA256 8c769384367381f0d171a39c10550e8dc986bfce159b7b9d74eab76c6b42a2ed
MD5 e9e5c9858aefb99df115536a4afb2c76
SHA1 61ee51647b61b0931015f0a06115756d227bb5b3
SHA512 4ee0536268277cdbf1d762373e45a5fb60b6668d5c957d44cf1c76f48f38a032cd3ca5aae202f593097226707180eeb51a6e089c0a98e6829640f16fe88a0c63
SSDEEP 768:1cH7ACViIeTxYEhqHGnqA1sojvqt0hDthFb0GuCsuYCV5mhzw4NKCFOsQW+Bfm46:1PCV21YEsmnq7Cv/+/Coc5m+4Xf8O46/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mio.vsdx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mio.vsdx
Size 115KB
SHA256 97e6c5f3c28b9cdc204d4606f5a64a30f058a29745d74c2a276b21cbf55f6bd4
MD5 5894e0ca437bd61954b80a4a66df63b8
SHA1 e79c671aff188819327218d660ee6f45a1f02b50
SHA512 d1550a7e0ae20613f8bede68f50fa941dfd5c417767d2e0db5f8dd662492f1dd7dee31093c3a036840687252ce9c5f150ed290946cac88030ccd9d2862843282
SSDEEP 1536:+zf86VbmjRahJxmWdAHhdhX/whzmhHtyP6h4/MVhsl1ZDYNhSu3sDUaf1hFhsR3v:Of8hVUP50ifxcXZgU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O
Size 32KB
SHA256 0f17c0fcd2bc15a2ed794e9cb7c83fe4222caf78f7875a9430393ce23ba8c6eb
MD5 48186fa6823b99a293a2e0b6cffb468e
SHA1 7fdf1badc68d6b6c803c36752b4ef133672b9db7
SHA512 e1a1db49ca7bc31d7ab33408636e625ef41b76c679d143bea930cc0b000876c95f0fb4bed7cd3e49491753f6624fbc88d233b47f5b56c569bb75a41047a59bfa
SSDEEP 768:+swfo3UHVU9Kj51qdLqsNqJqhVq4qJrV1qlCqWhMq9Px0Urerhryf5mVfsdXQia0:+zf86VbmjRahJxmWdAHhC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oricellari.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Oricellari.exe.com
Size 35KB
SHA256 8ad744006a2f24aa0db1414660d74a18b9e167404fe662e9b6e72ed10d1ce738
MD5 450de867d2c95785d4065be5d4926f76
SHA1 ffc9f89894ae5292149b3fd317edec28c0b7b85e
SHA512 6cd666242aeddb4eef06ba24a4efdb92a32bc90915894fd68bffaa0af26b96d158f311478e4cb7f4410394029e28074c2020ebd88774e830753601df0ab6c50e
SSDEEP 768:mcH7ACViIeTxYEhqHGnqA1sojvqt0hDthFb0GuCsuYCV5mi:mPCV21YEsmnq7Cv/+/Coc5mi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oricellari.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Oricellari.exe.com
Size 8KB
SHA256 5227c7111fdab32d84df7738b47ae2703e2f8444188925a5bd317bb8a5f47625
MD5 b6d7f2ff4427d9e08b1f1f29e4bd61b2
SHA1 cb3b1a0954c06f0f8003393f8a43aafa1653c2a1
SHA512 2689639a0869f881850eb6bd21caadbaab90af6127d7264fcfad94fa8fc9a6b5e04dbfe8cbddcadea2d3b77e8a006913e8fde7737e064b9907f9f8a870578a44
SSDEEP 192:mxaeOqAFDw09CV/2nPvj6DdMP3r1HI5jMlbN+G3ygxZRRCO:mxaHhww+/2nlP3r1WAL3yQZRh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sorso.vsdx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sorso.vsdx
Size 17KB
SHA256 eef3754f9a011ce64e46aa460819be469abd99695a917a11f1d497e654380b72
MD5 c03813065428baa4358e46c4469310c8
SHA1 29c928c9e0eda834f9bd14b249dce38036ca03f9
SHA512 dacc06cfe3b683c75a9609a2e5ed19ed1e800f897502c7db845237e026485a5cbb6a5e3b1d17ed8220f487b2b4320fa0c15b5ac2182a087842d3f817aa728da9
SSDEEP 384:pu2TU5nGTjHDlpYjNOaIHz0vnTQyW/pkynzI7iT6/l:pdI5nEbDlCkT0vnTnynMtl
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\T81tooj6\_Files\_Information.txt
Size 1KB
SHA256 e927e3f944f717a5283471dc578f27359fbe87b6985d9ef0acff820f719bcaf0
MD5 f575e537dee82331c77c627e48082b97
SHA1 89e675952ed10f63188bcff66d069dd1a6dda907
SHA512 79ab2bc3d3a00582ca3d42d5148d5c3dd8a3e865ad95d3a1214fda9c43c9df6c78517641ed4a19780f8fc72f8d1b178b6866dea2e08f91448ef3cc74fd3b7f14
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\T81tooj6\files_\system_info.txt
Size 1KB
SHA256 7cb613864524327f9c38df91b36e820f6ca30a73f7de03de73558829d580a36f
MD5 7fb2fa2449951f2491df471cde8c153d
SHA1 9fea74b449a39458f19c9482813d5c8b654d77f8
SHA512 006adcbb4a1b0bd1ae4f590188cbec4c687084f56dbfe4f0161b5632002e7da3b6bee81c298e719cd4a4303a97c87556004e2b0cc3daae3cbab903be9fdb512e
MD5 SHA1 SHA512

Submit Download

memory/372-24-0x0000000004520000-0x00000000045C3000-memory.dmp

Download

memory/372-26-0x0000000004520000-0x00000000045C3000-memory.dmp

Download

memory/372-27-0x0000000004520000-0x00000000045C3000-memory.dmp

Download

memory/372-25-0x0000000004520000-0x00000000045C3000-memory.dmp

Download

memory/372-29-0x0000000004520000-0x00000000045C3000-memory.dmp

Download

memory/372-22-0x0000000004520000-0x00000000045C3000-memory.dmp

Download

memory/372-23-0x0000000004520000-0x00000000045C3000-memory.dmp

Download

memory/372-21-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Download

memory/372-236-0x0000000004520000-0x00000000045C3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads