cryptbot | dd59504ed58f376ab5066cffac84314a3a5fc20485eceb7bef7f4ff6825af087

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d01724c79d4700a856904f0d23d5f61.exe
Size 1.5MB
Sample240128-nnfacabedq
SHA256 dd59504ed58f376ab5066cffac84314a3a5fc20485eceb7bef7f4ff6825af087
MD5 7d01724c79d4700a856904f0d23d5f61
SHA1 9ba2d3d971e9c3d67123fd59982cd345fc9b91c6
SHA512 21293b61e166bd5085964c04684f03fffb6e1e8f7b806c3971dede0249cfe4058a6a24996662d06fc519d7b501c12ceb7809f898d951ed1b8dd6b64c2d6faf36
SSDEEP 24576:+OrhocsyM/9jjIiGs1lUxqLER4Q6sfDHyMDuaz+nBdC5rTowSkoYd2vIkIRjQM9s:PwyM/lp7Y4Q5SMDuazGBdCt7roglvfIc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

haiwpj11.top
morhas01.top

Attributes

payload_url
http://zelcax01.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral1/memory/2772-28-0x0000000003B50000-0x0000000003BF3000-memory.dmp	family_cryptbot
behavioral1/memory/2772-29-0x0000000003B50000-0x0000000003BF3000-memory.dmp	family_cryptbot
behavioral1/memory/2772-30-0x0000000003B50000-0x0000000003BF3000-memory.dmp	family_cryptbot
behavioral1/memory/2772-31-0x0000000003B50000-0x0000000003BF3000-memory.dmp	family_cryptbot
behavioral1/memory/2772-251-0x0000000003B50000-0x0000000003BF3000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
2740	Vestita.exe.com
2772	Vestita.exe.com

Loads dropped DLL 2 IoCs

pid	Process
2316	cmd.exe
2740	Vestita.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7d01724c79d4700a856904f0d23d5f61.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Vestita.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Vestita.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2676	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2772	Vestita.exe.com
2772	Vestita.exe.com

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 3040	1916	7d01724c79d4700a856904f0d23d5f61.exe	28
PID 1916 wrote to memory of 3040	1916	7d01724c79d4700a856904f0d23d5f61.exe	28
PID 1916 wrote to memory of 3040	1916	7d01724c79d4700a856904f0d23d5f61.exe	28
PID 1916 wrote to memory of 3040	1916	7d01724c79d4700a856904f0d23d5f61.exe	28
PID 1916 wrote to memory of 2616	1916	7d01724c79d4700a856904f0d23d5f61.exe	29
PID 1916 wrote to memory of 2616	1916	7d01724c79d4700a856904f0d23d5f61.exe	29
PID 1916 wrote to memory of 2616	1916	7d01724c79d4700a856904f0d23d5f61.exe	29
PID 1916 wrote to memory of 2616	1916	7d01724c79d4700a856904f0d23d5f61.exe	29
PID 2616 wrote to memory of 2316	2616	cmd.exe	31
PID 2616 wrote to memory of 2316	2616	cmd.exe	31
PID 2616 wrote to memory of 2316	2616	cmd.exe	31
PID 2616 wrote to memory of 2316	2616	cmd.exe	31
PID 2316 wrote to memory of 2652	2316	cmd.exe	32
PID 2316 wrote to memory of 2652	2316	cmd.exe	32
PID 2316 wrote to memory of 2652	2316	cmd.exe	32
PID 2316 wrote to memory of 2652	2316	cmd.exe	32
PID 2316 wrote to memory of 2740	2316	cmd.exe	33
PID 2316 wrote to memory of 2740	2316	cmd.exe	33
PID 2316 wrote to memory of 2740	2316	cmd.exe	33
PID 2316 wrote to memory of 2740	2316	cmd.exe	33
PID 2316 wrote to memory of 2676	2316	cmd.exe	34
PID 2316 wrote to memory of 2676	2316	cmd.exe	34
PID 2316 wrote to memory of 2676	2316	cmd.exe	34
PID 2316 wrote to memory of 2676	2316	cmd.exe	34
PID 2740 wrote to memory of 2772	2740	Vestita.exe.com	35
PID 2740 wrote to memory of 2772	2740	Vestita.exe.com	35
PID 2740 wrote to memory of 2772	2740	Vestita.exe.com	35
PID 2740 wrote to memory of 2772	2740	Vestita.exe.com	35

C:\Users\Admin\AppData\Local\Temp\7d01724c79d4700a856904f0d23d5f61.exe
"C:\Users\Admin\AppData\Local\Temp\7d01724c79d4700a856904f0d23d5f61.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\dllhost.exe
  dllhost.exe
  2⤵
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Col.accdt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^wKJdkHKtYHetzazAdPKwuHyHpsxosmLqrhbfScdnhJibZYaBcKDDNHRxFwuUhCNmWwquUrIVmkOvAIIkZSMGVijvveKQfvkLWHBXYjHseItBTxUWaUUxPuEOPDJRzRGeqeASiLhNkxEjrKDwiN$" Affonda.accdt
      4⤵
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vestita.exe.com
      Vestita.exe.com x
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vestita.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vestita.exe.com x
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:2772
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 30
      4⤵
      Runs ping.exe
      PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\CwkFSdA\_Files\_Information.txt
Size 8KB
SHA256 07eb5d91b68cc599d103ad498a83791db0c278c1b11cb32cc2b09fe399f64c37
MD5 f68b41c907bc54d829af5f3e5b7dfe48
SHA1 0ea376f1c45d6921d5fd7d7e9572afe77c525730
SHA512 e0b4d7e8bbb0111ce4f95e7885951e3ffe4c8c88496b5567ba0c75078c8baa62dfba80669db484632e944caa2baae7748b427a59bb02a02bbecc1ea5b0fe5105
SSDEEP 192:wBw93BUGdGGh8GBG1GoGHGwGrGFjG9GXGaGQGtGYGKbe:wBY3BUGdG+8GBG1GoGHGwGrGFjG9GXGc
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\CwkFSdA\_Files\_Screen_Desktop.jpeg
Size 46KB
SHA256 3f75e9b5caf5c354182df4709a563db2d4df7521d2e6e50d663ca74c433e9d3b
MD5 c1732fb0aa86c2830249577297e02573
SHA1 555d3a7a43ddc6cda71cd552fc141135ffac1bb1
SHA512 c39bb37cff7ca0814d92f5b8690f29daa84651c7a9527f941b42781a32eb732b32b27af28a8cb07856f8a5e1efdf6aa86846f6d3b4ba7e641642a700d16ee98e
SSDEEP 768:lnXsRO9kz4XfkU9jOIHbZ380WKajt9mQx4ex5C7ETaGnoJX1XEsFf1Cu+:ln4mXfkFI35Ut9mK5cETaGnoJpVFf1C9
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\CwkFSdA\files_\system_info.txt
Size 7KB
SHA256 82f5e3ffce2c53053114cfab4d298f45706e99f3e8d6b81edd476ae1ef13bbe0
MD5 c8eae52cf92f26f392211397e1ca2cdb
SHA1 9571cefa0b6cb41b9ffd5af307b3daf0f9dcb377
SHA512 60f2f67941174bd86c0e1101769b6de552ff16a9ddf2c045ba0b01408879f29104cb228a3742d305f274d18f72eaa1fb4fc87a53fb56cc0cf44c6bfa32d37bab
SSDEEP 192:zKs93BUGdGGh8GBG1GoGHGwGrGFjG9GXGaGQGtGYG/:zKM3BUGdG+8GBG1GoGHGwGrGFjG9GXGO
MD5 SHA1 SHA512 SSDEEP

Submit Download

piKffxAIELq.zip

Path C:\Users\Admin\AppData\Local\Temp\CwkFSdA\piKffxAIELq.zip
Size 39KB
SHA256 4486e7c87c2c21b6ec2acabb6da8fafbb96f2d504f2f0d43b6f18fa905d734ba
MD5 4560e3dabed1d9286e887b5344d63384
SHA1 3fb93862478c9ab9d8d0d6f7f89b255ff2ef2e86
SHA512 b14b213eb70ff29ca2b4adabc1d969c5c8c7341379c98560f87b696ec8d1844135818bfa5cdcc961eee6d54d59dbc7181fa1c0316b2ab0d2cb28acb19fa52321
SSDEEP 768:xViFgl2mDai8fKty8lO2Dz/7K7uUzmIACcrYYkKd6qYR/B09O:Die2mWryw8lDz/7uuUyIAXr39cqYoU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Affonda.accdt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Affonda.accdt
Size 872KB
SHA256 32c081ae603c6e7f089246aa168fc229983a6265956ec218592c295b6ffbeaae
MD5 63d3d0ac4a9b4a455666535c60387b90
SHA1 e9538d745342d11d2dc60c15ce744f11845e883d
SHA512 21c3c754a1e2d6ee80f7e0358e50a520fb688f0758b11d9a8a9fd19a6b940ff9e2d9cf26c6405b4c06eab24d4def638ade2df8ecd893fbfd9646f761d5b3193b
SSDEEP 12288:lpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:lT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Col.accdt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Col.accdt
Size 601B
SHA256 cabe3e1fa3eaed6ed13da83971c02369a5b22d759e9bb0c3b6f8a4d15bb7f999
MD5 d06bc75da92c4c6ce4363a7ad45ab7ee
SHA1 44887202bf4eb8bd09e88c256bcd347ba02a2fb1
SHA512 eea6ba1ce356354fd025db0f64a2e67a4f06b73d5945bf53421fd412ac1cbf9067330365f469c7e1b0f22c7abba04032715aacd1a391b560efc2add6a943b515
MD5 SHA1 SHA512

Submit Download

Orlo.accdt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Orlo.accdt
Size 19KB
SHA256 39457f9eb2789bc1f72275a9d0d5520adca9358ca288304340e472d684fb4e61
MD5 ac889bae19739499836316de21f65311
SHA1 9ed3882761b13d3c88212d5255827b6543025797
SHA512 771e3dbe6ed008eb338fc388a0059cb596bd1cbfdde00a2c8c749ecb59fc4d86774ef146f0a80d0c635f4f30c6a4cddac2d5de7099673b8fdce05b0fb4b677d6
SSDEEP 384:YeqTYYRQ5wOXS0iQqLt8uBoBJ+DzYU7RpH7t+zx498gck8nWqy:Fc7G5wOXS0CeuBoX+fYGR3+zCWgQnWN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vedrei.accdt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vedrei.accdt
Size 296KB
SHA256 bc70c87f188e2f294142dcf6dd4ca24d10a1f50b5590088ed5e807a152f02571
MD5 9650b7551cadf722e208707aae93fe47
SHA1 554a10e87935f30120138d5b56ad58e758984155
SHA512 2adf523bef0a48af3cfe9dd6cbaa8f5ba6cbf1dc2d79b8ab08490ddea3a4ea24775f846b783188be5046c2c41e94a14a3d4494a1bbbdc3684e00c9a2d8087620
SSDEEP 6144:hyiK1yT9z4Dm/stHF3ryo7gBl0WexJQ59xHTg39j7eW7wmLKiHi:hrK1kh4Dm/stHprZ7gBYQ59xER7eW7wF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vestita.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vestita.exe.com
Size 75KB
SHA256 0283c2c36f975e496a8427858b61469b8232ac8e53b9ddcb6d106c12e972fb75
MD5 4b876e0664ad7ccd2770a7162b67fa8a
SHA1 bb1891186f686f5b87892345c2b8a76a60c793c0
SHA512 cbc21b9b83608935857a4bc104d1262d6337758378471e2e2b65afc56f034b1920125e0d02d090467f9fbab2ba6ff0cf5fde9adf0af873809e14ea09ef13993a
SSDEEP 1536:mPCV21YEsmnq7Cv/+/Coc5m+4Xf8O46895LmNpRGDox2S2:6CV26MqgQTc5F446iYNpK5S2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vestita.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vestita.exe.com
Size 49KB
SHA256 d9f1cf51af977be40a2c5a3562fb367184af1a2491441555ff058fa299f0df22
MD5 8ff0a472f250c532c44cceeb41b2a80b
SHA1 6161d199506575bd5910d0a489a8a97af1136571
SHA512 a12b92bc24394de3e2a12967b1edfce1432854c2d5024e48ae2ded2bbf2bc3b86b72e99c7a1c2bc01e20eacacd6689448131daca7e6bd2755ac1345af6d62718
SSDEEP 768:mcH7ACViIeTxYEhqHGnqA1sojvqt0hDthFb0GuCsuYCV5mhzw4NKCFOsQW+Bfm4f:mPCV21YEsmnq7Cv/+/Coc5m+4Xf8O4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vestita.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vestita.exe.com
Size 22KB
SHA256 96c64565b4df690d8d4ca27703a60ad78ebf61570442219073a681f0b1f5815a
MD5 ef9d2de342f59a871670d2e9afb81ff4
SHA1 eefda812b4f02b8b6fc74340278e2faa53dfcb79
SHA512 270ca38d8afee8b83a5d0e9cfd42dd7149799cf4f9da7e8d7783f09895081857a819880f5bdc2ffa89ac045a3e750ed169a1a21705514754b24edfe5c4ccd426
SSDEEP 384:mxaHhww+/2nlP3r1WAL3yQZRMdTQmYwim12sBk4Ef6hI/JmqAhL+kRG+SojvqMpE:mcH7ACViIeTxYEhqHGnqA1sojvqt0W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x
Size 54KB
SHA256 2819d03ffef657b2a8f4adbdefc379e404c52fe865998e2ffcb578d019e14702
MD5 33954a0ffd865d4e601bdb9e7ab99efa
SHA1 af022c9bdd37b838ec43b04981ff40e7a58170dd
SHA512 170cf372ecb754032ff171b21359d098869a1a819e95bafbdfad9c8ffc6b30b0b65a3f2cd7e1b3860c4e314e96d1db82cf14708aacbc1cb4e38f4810e7189dbd
SSDEEP 1536:hKlgNJncqgLA2G5ntUfSNU+KAJJPRpMnoc:hygzcJA2G5ntUfSNUTAPzIV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vestita.exe.com

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\Vestita.exe.com
Size 73KB
SHA256 9aeb652392b319581eced54553483e9b12c4c6017f042d47d0b44846cca0244a
MD5 1368864cffa3367388921a67c9544737
SHA1 eb4c9288ef452800f4e90ad9e918db62ac01af51
SHA512 e50301e16935b34b841d3aa15ac21737fdc5db23a3506f637c71abd587153ac1db68836bf36ad839e77c909650a75b928bc06fc76dd417066a2f983084fdeee6
SSDEEP 1536:mPCV21YEsmnq7Cv/+/Coc5m+4Xf8O46895LmNpRGDox2l:6CV26MqgQTc5F446iYNpK5l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vestita.exe.com

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\Vestita.exe.com
Size 31KB
SHA256 0f134d1b5d1f13a9a50d96cbc91494e34699a2330dfa6c5dc7fff8f6d707916a
MD5 2a032b274086c4ad4d7db32796c8c8f0
SHA1 a7081e50ae37308e79c95c8fabfd26f4c7eceda3
SHA512 08238ae5345cb10a9d691192774ffcbba15ffe1fdfde7437fddcd2bcb9b8ac78e5fcd811a83d31eeae890bc3e1ef9dff91ef9ce2ade028388d3c498edcf72d92
SSDEEP 768:mcH7ACViIeTxYEhqHGnqA1sojvqt0hDthFb0GuCsuYCc:mPCV21YEsmnq7Cv/+/CoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2772-26-0x0000000003B50000-0x0000000003BF3000-memory.dmp

Download

memory/2772-29-0x0000000003B50000-0x0000000003BF3000-memory.dmp

Download

memory/2772-30-0x0000000003B50000-0x0000000003BF3000-memory.dmp

Download

memory/2772-31-0x0000000003B50000-0x0000000003BF3000-memory.dmp

Download

memory/2772-32-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/2772-28-0x0000000003B50000-0x0000000003BF3000-memory.dmp

Download

memory/2772-27-0x0000000003B50000-0x0000000003BF3000-memory.dmp

Download

memory/2772-25-0x0000000003B50000-0x0000000003BF3000-memory.dmp

Download

memory/2772-251-0x0000000003B50000-0x0000000003BF3000-memory.dmp

Download

memory/2772-24-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/2772-253-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads