cryptbot | b3c673f83a5acafdea6d995ee24e6a180f5123cccf8d4d30f6e3b51cadbabd95

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/01/2024, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8434835aa84653edea3d33e1b5b31b98.exe
Size 1.5MB
Sample240131-mtbcxaadd5
SHA256 b3c673f83a5acafdea6d995ee24e6a180f5123cccf8d4d30f6e3b51cadbabd95
MD5 8434835aa84653edea3d33e1b5b31b98
SHA1 4b172c6d0e1de7723c3f1f0657a485e0e498f289
SHA512 a10a54ef6d95a89cbc6008216f7f80da554b90ac8de839f19ac367b293a0fca0c0aa10b4fe8851387f34a4cc605f4039e82dc0676ab33f44bf4567e863a7b5d8
SSDEEP 24576:VEHC0rfWIHRL9KPqs4+2Bjo6Ln30ovGO4P5rIxtiwF+cVrO8CDXlQi:L0jJHqPqsnUU6L30qGOgrIiwFq1Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

ewaqfe45.top
morjau04.top

Attributes

payload_url
http://winhaf05.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral1/memory/2696-28-0x0000000003990000-0x0000000003A33000-memory.dmp	family_cryptbot
behavioral1/memory/2696-29-0x0000000003990000-0x0000000003A33000-memory.dmp	family_cryptbot
behavioral1/memory/2696-30-0x0000000003990000-0x0000000003A33000-memory.dmp	family_cryptbot
behavioral1/memory/2696-31-0x0000000003990000-0x0000000003A33000-memory.dmp	family_cryptbot
behavioral1/memory/2696-252-0x0000000003990000-0x0000000003A33000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
2720	Vigilanza.exe.com
2696	Vigilanza.exe.com

Loads dropped DLL 2 IoCs

pid	Process
2816	cmd.exe
2720	Vigilanza.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8434835aa84653edea3d33e1b5b31b98.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Vigilanza.exe.com
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Vigilanza.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2120	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2696	Vigilanza.exe.com
2696	Vigilanza.exe.com

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2684	2060	8434835aa84653edea3d33e1b5b31b98.exe	28
PID 2060 wrote to memory of 2684	2060	8434835aa84653edea3d33e1b5b31b98.exe	28
PID 2060 wrote to memory of 2684	2060	8434835aa84653edea3d33e1b5b31b98.exe	28
PID 2060 wrote to memory of 2684	2060	8434835aa84653edea3d33e1b5b31b98.exe	28
PID 2060 wrote to memory of 2744	2060	8434835aa84653edea3d33e1b5b31b98.exe	30
PID 2060 wrote to memory of 2744	2060	8434835aa84653edea3d33e1b5b31b98.exe	30
PID 2060 wrote to memory of 2744	2060	8434835aa84653edea3d33e1b5b31b98.exe	30
PID 2060 wrote to memory of 2744	2060	8434835aa84653edea3d33e1b5b31b98.exe	30
PID 2744 wrote to memory of 2816	2744	cmd.exe	32
PID 2744 wrote to memory of 2816	2744	cmd.exe	32
PID 2744 wrote to memory of 2816	2744	cmd.exe	32
PID 2744 wrote to memory of 2816	2744	cmd.exe	32
PID 2816 wrote to memory of 2804	2816	cmd.exe	33
PID 2816 wrote to memory of 2804	2816	cmd.exe	33
PID 2816 wrote to memory of 2804	2816	cmd.exe	33
PID 2816 wrote to memory of 2804	2816	cmd.exe	33
PID 2816 wrote to memory of 2720	2816	cmd.exe	34
PID 2816 wrote to memory of 2720	2816	cmd.exe	34
PID 2816 wrote to memory of 2720	2816	cmd.exe	34
PID 2816 wrote to memory of 2720	2816	cmd.exe	34
PID 2816 wrote to memory of 2120	2816	cmd.exe	35
PID 2816 wrote to memory of 2120	2816	cmd.exe	35
PID 2816 wrote to memory of 2120	2816	cmd.exe	35
PID 2816 wrote to memory of 2120	2816	cmd.exe	35
PID 2720 wrote to memory of 2696	2720	Vigilanza.exe.com	36
PID 2720 wrote to memory of 2696	2720	Vigilanza.exe.com	36
PID 2720 wrote to memory of 2696	2720	Vigilanza.exe.com	36
PID 2720 wrote to memory of 2696	2720	Vigilanza.exe.com	36

C:\Users\Admin\AppData\Local\Temp\8434835aa84653edea3d33e1b5b31b98.exe
"C:\Users\Admin\AppData\Local\Temp\8434835aa84653edea3d33e1b5b31b98.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Gtzfc
  2⤵
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Pei.ppt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^DidKbftvVuhjtIjhvGxQLRsfIoTuzxuQWgyrEowyLLOhkyfZbLwLRoSMQqwgvYrBZvfQCpIgFfyZerrCTTJIacZOvzjEuMJNIhhPPmbheNyBrSJMWmcCgcoE$" Ora.ppt
      4⤵
      PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com
      Vigilanza.exe.com s
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com s
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:2696
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 30
      4⤵
      Runs ping.exe
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Avidamente.ppt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Avidamente.ppt
Size 634KB
SHA256 a8be42294884fb494bd3d44603371255a520b55ee30d34e21ace1ccca72ff3d0
MD5 efe5b0ff3cb167100450c2faf42f1f2d
SHA1 7a95bdd97b025c7f934edcf4312589b6c212b09b
SHA512 05720ab0b8ed75254e0e6d2d2221e075455e334d5165ecb64ff5ded2466e4f719b087010ab1a55c0906bacde6ce43baa170b2c779b6cf38ae48b93d8d76a7497
SSDEEP 12288:romeoyJJT4ZqTrfw+gsclHJqSw5JSUdRtMpQQJaVqbOYHRtZFhMdlF1n:roeyP4ITrI4tSwZGwVAO6dDUlFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lui.ppt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Lui.ppt
Size 720KB
SHA256 b04112121c607ad479f40eabe9282aab7f9dcf3d4673b1847a0123d3fa715cb2
MD5 64310fce58e4078f3b5b5c1ba9369913
SHA1 f75ed0acd4b758c5050b930f80088d4f18761338
SHA512 b0861feb2136c82ed83aa9a2f22f50d576a912565f934ef4c90d9138c7023e7f251ee24d39a9acf787adab8df39cfd91a0bd71e2dc31609852cf5eb34330abac
SSDEEP 12288:7YA+tUh1tQIfmejLZ0AZ8KESU7730XAE72FuBvM3j:PvLmcl0oAG2FSvwj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ora.ppt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ora.ppt
Size 872KB
SHA256 907abc210326d5ec912d4cb3959d03c5b4232a2d5ccb2822edced5ceb8b15125
MD5 ca71fed93b16d5375c0bd068692e2872
SHA1 7d8e2a63e008865e85de92a21aa9c9c9511f01c2
SHA512 773d3c0294745e9e8dc0fe9b7c4f137a96eb1d3e2a4b5afa367a8fd68c75bcb3cd278940f5e5f4e28cdbf51de2487349b18fb096b1a13fa9732e024c8f75721e
SSDEEP 12288:zpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:zT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pei.ppt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pei.ppt
Size 425B
SHA256 fae8f12d0ae7dd390313c53cb2832dad08ba04e95a95f176926fd74c4fa087e7
MD5 785225bc18fe9f16d8a675ab73e5e5a9
SHA1 fdb2a2c005d479941069946e3227778fb310de99
SHA512 40d8f0897d2473a4ab3ba3de4d0025525f0d00ab7af94698816bf47b3cf5a7ed5656f9106f209805bc65f6e4f9cc4a85bf72cd244b059b79818d36961064e493
MD5 SHA1 SHA512

Submit Download

Fbp3pDQgiq4sR.zip

Path C:\Users\Admin\AppData\Local\Temp\krG47nhLb4\Fbp3pDQgiq4sR.zip
Size 39KB
SHA256 96b8b6f1fc25ca7b6011b247ff23f571de1a88e1e907f43847a8a6b001e4b42f
MD5 85fa53aa9e2e976a7ae9ac15f03af293
SHA1 4bb6c2e8896a84e40e3f7ca0697ff877fa62bea6
SHA512 926f67f34e82dd2eee27c6bd85ae3f6f13b453807ec8397a18472e42ba8538d8dce3017bfa852a7f42bff1e023181112140874e56c6e5738c2cb76236557a32b
SSDEEP 768:JVM1dMA1Of/yTrRh2RKbsQwwQ+R1qRKZg7CSgVWF7gOduBznpj+hM+xvy:JV8dMoOfK3/2gsXLM1qAZv67gX1YMOvy
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\krG47nhLb4\_Files\_Information.txt
Size 8KB
SHA256 057a4d81679b60e4519a52ff69971bf0cbc4341fe1205a38f7f19732aed34c95
MD5 9364c6ae55c956963e9cee08985dbcd9
SHA1 31cb01cb2849007d06bf2baebf66bf6834cfea3e
SHA512 6a6edf799195136603d285c2efa39768fa588bd0511c77cf9740a2fc1a1d5ca06d25b5f838fe61117d1c6d581b480b8863d1d4bb7319c66853d6023be4a1495e
SSDEEP 192:p8w93BUGdGGh8GBG1GoGHGwGrGFjG9GXGaGQGtGYGKbe:p8Y3BUGdG+8GBG1GoGHGwGrGFjG9GXGc
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\krG47nhLb4\_Files\_Screen_Desktop.jpeg
Size 46KB
SHA256 f4ec34bc64dec66910527ecd086703f7e958a26340691f22984b3b9b72d2261e
MD5 7c3e3128b4258db60108c9517fa46b31
SHA1 90f429ffa5f8ee527f438c8f47426d03bc803954
SHA512 017aadb2bdab0d8b85d00fb532a5f4de7aaa1910c3f628328b8ecddc2b16cbea63701eeb85c7ca43fccc2ec513ea1c8310bf6e4ed4709477a4fafb1eecc8f739
SSDEEP 768:lPIA8wSCA/rtfwjOBRlFeLmZ4zfVS35RJUpCzq5YTyFEIO5zIW/czoUxGoCN91/1:lPuxh/0OBRuLm+zfU35PUpCzqqTyFEIY
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\krG47nhLb4\files_\system_info.txt
Size 3KB
SHA256 4d2c77f2ada72993b2251eafda422c28e80c283d4881d7e8f6816af8791452f4
MD5 ae1b2cda20a9fdad8416daef9fd7442f
SHA1 e5e0b398e2235485b4d9a2787d04d485cd720621
SHA512 a1f9b180bae6e5865dfd2d53ea671515b461e6a12008aa88084dab1f2845189ccee958dce65c2987d3b34411f61d2873987f115d3da81aaba9d7b14dda634b22
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\krG47nhLb4\files_\system_info.txt
Size 4KB
SHA256 3025f114e09dae431204b08efcbaa528542bf2a0fb535fa262ed78e5db808d37
MD5 03b32c11aea08d45c49006e5d10c303b
SHA1 b92e0147b2613d1b7f33029e8411772d2b65ccdf
SHA512 646d07a112eaa57509990b5824663b4b913b4b8e428443b1522d2e9800bd065c1d46754649bd5a0964e7fc285a8627d52bd3f95d02e6347bcac4d28297c43b9e
SSDEEP 96:NbtewBPsh/LHcnmcnmJ4McTW2GcfMGGhO1D83HzBO:iEs93BUGdGGC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vigilanza.exe.com

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2696-24-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/2696-30-0x0000000003990000-0x0000000003A33000-memory.dmp

Download

memory/2696-31-0x0000000003990000-0x0000000003A33000-memory.dmp

Download

memory/2696-32-0x0000000000200000-0x0000000000201000-memory.dmp

Download

memory/2696-29-0x0000000003990000-0x0000000003A33000-memory.dmp

Download

memory/2696-28-0x0000000003990000-0x0000000003A33000-memory.dmp

Download

memory/2696-27-0x0000000003990000-0x0000000003A33000-memory.dmp

Download

memory/2696-26-0x0000000003990000-0x0000000003A33000-memory.dmp

Download

memory/2696-25-0x0000000003990000-0x0000000003A33000-memory.dmp

Download

memory/2696-252-0x0000000003990000-0x0000000003A33000-memory.dmp

Download

memory/2696-253-0x0000000000200000-0x0000000000201000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads