cryptbot | b3c673f83a5acafdea6d995ee24e6a180f5123cccf8d4d30f6e3b51cadbabd95

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8434835aa84653edea3d33e1b5b31b98.exe
Size 1.5MB
Sample240131-mtbcxaadd5
SHA256 b3c673f83a5acafdea6d995ee24e6a180f5123cccf8d4d30f6e3b51cadbabd95
MD5 8434835aa84653edea3d33e1b5b31b98
SHA1 4b172c6d0e1de7723c3f1f0657a485e0e498f289
SHA512 a10a54ef6d95a89cbc6008216f7f80da554b90ac8de839f19ac367b293a0fca0c0aa10b4fe8851387f34a4cc605f4039e82dc0676ab33f44bf4567e863a7b5d8
SSDEEP 24576:VEHC0rfWIHRL9KPqs4+2Bjo6Ln30ovGO4P5rIxtiwF+cVrO8CDXlQi:L0jJHqPqsnUU6L30qGOgrIiwFq1Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

ewaqfe45.top
morjau04.top

Attributes

payload_url
http://winhaf05.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral2/memory/5108-25-0x0000000000220000-0x00000000002C3000-memory.dmp	family_cryptbot
behavioral2/memory/5108-26-0x0000000000220000-0x00000000002C3000-memory.dmp	family_cryptbot
behavioral2/memory/5108-27-0x0000000000220000-0x00000000002C3000-memory.dmp	family_cryptbot
behavioral2/memory/5108-28-0x0000000000220000-0x00000000002C3000-memory.dmp	family_cryptbot
behavioral2/memory/5108-243-0x0000000000220000-0x00000000002C3000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
4680	Vigilanza.exe.com
5108	Vigilanza.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8434835aa84653edea3d33e1b5b31b98.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Vigilanza.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Vigilanza.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4052	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5108	Vigilanza.exe.com
5108	Vigilanza.exe.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 3864	2320	8434835aa84653edea3d33e1b5b31b98.exe	85
PID 2320 wrote to memory of 3864	2320	8434835aa84653edea3d33e1b5b31b98.exe	85
PID 2320 wrote to memory of 3864	2320	8434835aa84653edea3d33e1b5b31b98.exe	85
PID 2320 wrote to memory of 5048	2320	8434835aa84653edea3d33e1b5b31b98.exe	87
PID 2320 wrote to memory of 5048	2320	8434835aa84653edea3d33e1b5b31b98.exe	87
PID 2320 wrote to memory of 5048	2320	8434835aa84653edea3d33e1b5b31b98.exe	87
PID 5048 wrote to memory of 1716	5048	cmd.exe	89
PID 5048 wrote to memory of 1716	5048	cmd.exe	89
PID 5048 wrote to memory of 1716	5048	cmd.exe	89
PID 1716 wrote to memory of 1532	1716	cmd.exe	90
PID 1716 wrote to memory of 1532	1716	cmd.exe	90
PID 1716 wrote to memory of 1532	1716	cmd.exe	90
PID 1716 wrote to memory of 4680	1716	cmd.exe	91
PID 1716 wrote to memory of 4680	1716	cmd.exe	91
PID 1716 wrote to memory of 4680	1716	cmd.exe	91
PID 1716 wrote to memory of 4052	1716	cmd.exe	92
PID 1716 wrote to memory of 4052	1716	cmd.exe	92
PID 1716 wrote to memory of 4052	1716	cmd.exe	92
PID 4680 wrote to memory of 5108	4680	Vigilanza.exe.com	93
PID 4680 wrote to memory of 5108	4680	Vigilanza.exe.com	93
PID 4680 wrote to memory of 5108	4680	Vigilanza.exe.com	93

C:\Users\Admin\AppData\Local\Temp\8434835aa84653edea3d33e1b5b31b98.exe
"C:\Users\Admin\AppData\Local\Temp\8434835aa84653edea3d33e1b5b31b98.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Gtzfc
  2⤵
  PID:3864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Pei.ppt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^DidKbftvVuhjtIjhvGxQLRsfIoTuzxuQWgyrEowyLLOhkyfZbLwLRoSMQqwgvYrBZvfQCpIgFfyZerrCTTJIacZOvzjEuMJNIhhPPmbheNyBrSJMWmcCgcoE$" Ora.ppt
      4⤵
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com
      Vigilanza.exe.com s
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com s
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:5108
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 30
      4⤵
      Runs ping.exe
      PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Avidamente.ppt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Avidamente.ppt
Size 348KB
SHA256 55e8e0ce2aabf5f083f637eb44abc05353b4d109187628a2f05a706538ae1caa
MD5 cee28d577406cef902aaafe624ef3ea5
SHA1 cfa16de3d5f1a80611888b0d3a97172bb4b945a8
SHA512 2f8d2faf4cb1469af73b7933ac57dc01626445812cfe8af0c9812fd5a02b2cf5fb913818b2842d4accb3b694bc43cab2a471edc3b8e72519ba4af8d392ee8ea8
SSDEEP 6144:romnEbXohkJgfwT4QVULGHrTrfw+mrHMtPKTamLR7r5uqqAfwQ9g/3iYSUhbR7D:romeoyJJT4ZqTrfw+gsclHJqSw5JSUdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lui.ppt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Lui.ppt
Size 460KB
SHA256 31f306aaf0c4b815b4ab8c13b767ff3049c5391e8ab27167e6dae571545a6231
MD5 6a4ee7dae921a6c840f3d15637c63972
SHA1 018669c95fa5cb417fd207d70509ccec61ae6cd6
SHA512 7473d91d796fbde978f74fe241bd6b493b3d62fc7f26c5d794ebe196b354d0b3af1bb436c29eea1c25016ee689fe60057466138e72ac86c098683a979b63d5fd
SSDEEP 6144:7YMl+t32WOh1tQTE4Fqt4/OVISmTomeJNLZlirEZ8K+zSKQW77Oi:7YA+tUh1tQIfmejLZ0AZ8KESU77D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ora.ppt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ora.ppt
Size 645KB
SHA256 dda881148603bab4026e7ea54edfa0370b1ae27e92df8476d43d1989d245b87f
MD5 3393103fec75699a3f0b5e34823e64e8
SHA1 85ab03b412b791d2bda78d66cef021a136ad477e
SHA512 9b1029e1cf620d2586aecb310c34315a9f1b13b2e061c28c9aac5971bfe0e4e4c2147649adb8399de8ddd5368febff4adcb0c544acff171f9fe76c4675575d50
SSDEEP 12288:zpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoM:zT3E53Myyzl0hMf1t4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pei.ppt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pei.ppt
Size 425B
SHA256 fae8f12d0ae7dd390313c53cb2832dad08ba04e95a95f176926fd74c4fa087e7
MD5 785225bc18fe9f16d8a675ab73e5e5a9
SHA1 fdb2a2c005d479941069946e3227778fb310de99
SHA512 40d8f0897d2473a4ab3ba3de4d0025525f0d00ab7af94698816bf47b3cf5a7ed5656f9106f209805bc65f6e4f9cc4a85bf72cd244b059b79818d36961064e493
MD5 SHA1 SHA512

Submit Download

Vigilanza.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com
Size 383KB
SHA256 89c2a770c6d16056d52d8b69e9fa8c0337bc746e407ee2de2ced0fa82fa6d0ff
MD5 7cbd48ccf270765de8d55ec25669a605
SHA1 2f12159142a2aea7a0496e12050e3ede91e1ed1c
SHA512 eaf54991da75588abf74ce685321acd7bea2f2558d994466715b31f2a308c001c7fc8e861faf0d2efbd8937dcf83c7af3b2184815a944372c9a12e6869ac6963
SSDEEP 6144:6i2VWTyFsJ8gNJBnGtINsegA/12vk6AQzyMfA+eyVPln:6pVWeOV7GtINsegA/hMyyzln
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vigilanza.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com
Size 267KB
SHA256 0ba4ec14b4e9a94db5250c236d95b349f5e4518b724f38063783657869e3d300
MD5 2945e397f11b770094d3ab6df81e64d2
SHA1 25fcad1bc85b088299a05da22590c067f047ff24
SHA512 f57d42b828478183a435acbc8ce350c033cdbf919d1925a6694645919e7e1570b80eafabed18c98d8c2fd9756d021e9a5b90dece994fe86f15504ebcf58a4940
SSDEEP 3072:6CV26MqgQTc5F446iYNpK5SB7BJBzLZDKJtIs8di/37EM/j2xQeixApVIa0/viz:6i2VWTyFsJ8gNJBnGtINsegA/12v4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vigilanza.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vigilanza.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s
Size 363KB
SHA256 01cea8ea203102825aec3ccf16d72e75ce2cffcdbd725ac6e75bb9ce9eaccbe9
MD5 9d5b4dca2d2e90c9bd165a63edfd0cb6
SHA1 ee0d16478909767666760abfbf907b8ee1fe5e0a
SHA512 4a821d262eda30feedc797d2300d4c51c397592bc2691fe4db0240c2261bd9251596778d97cad24ddcab9833219fab3b22e625ac7d823deefa0fc97b65b806f8
SSDEEP 6144:7YMl+t32WOh1tQTE4Fqt4/OVISmTomeJNLZlirEZ83:7YA+tUh1tQIfmejLZ0AZ83
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReadUpdate.txt

Path C:\Users\Admin\AppData\Local\Temp\QB5TK5tiiRF0\_Files\_Files\ReadUpdate.txt
Size 461KB
SHA256 3a80d38ab737aaa88ca0d549f367dac96b8a3d5045e251a70f1586dfebfc9989
MD5 fa656aecdb2dec22a2cdd2b5b4cc725d
SHA1 dd181a9d056a864859f222d5238efde6b879523e
SHA512 e376f25e400ced6c9296a4b662197347ace47ecfa2a3eaad219d15378c32ff5c895ec74993d9b375b1bba337ebe37d57db60e5f08041f7ec121848a0da44ef9e
SSDEEP 12288:cgewhvKOZSgg3hc2HViyAU8zF7skZ97BHvRPIUk5vWH0:cgeuvZSgg3hX1JAzzF7pZ99pBH0
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\QB5TK5tiiRF0\_Files\_Information.txt
Size 1KB
SHA256 ab7f102063f9f1cfdb22e0f06b93e171b5d9ba50552cd30ce12fc1700545ad13
MD5 c83190bdd93dec3044a050e56dea5be2
SHA1 7c31a381b344a3f00a1442d756a9aab4e166a067
SHA512 a9e47d565fe15d4c01f6638b914827d2f164136c348a89d7b7f381c8bb66d13d8cde48b9025003e2e0a06c5a3301095d392e5c5cd592a7bc580f8c21eedc6311
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\QB5TK5tiiRF0\_Files\_Information.txt
Size 1KB
SHA256 c88be340a9a24e47caac0529f4ff03d91640930e3241a9f40b0cb5133ade6c2f
MD5 dc16dad5d7b6e3e81b3359706a0f527a
SHA1 80a138edbe0afdff5051eb7add3b7ce17bdf80ff
SHA512 b09a2982587f12d2ac1a426bba4414b97f9045b78e9bbc4fc539a46a2c8961e04f687b6796d5b73d5056d149255ff6abd4d116403f5579c159b963cedf234a0f
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\QB5TK5tiiRF0\_Files\_Information.txt
Size 4KB
SHA256 b559a17c0a4a9a2ed6320e83c37e36f22716fc10958c79ff04feb5f61f39bb40
MD5 dfedd7cbbc49441c2d6b87882f9d3cd0
SHA1 4a74eea8639f1b8b771e442ea6e1fb7aee067dd4
SHA512 e06c3b16e971d12c91ac5a445fe85d080126db7c06e52b04d68a0e4ea98be6c9f2d87d32dbab1eb6262f05061c994a71ba4ced7312a8a8cf607a24d9278f3701
SSDEEP 48:sxvUteXxIaMJ7ehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+AR:spUteB2DndqDlQHchmcnmB4McIHOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\QB5TK5tiiRF0\_Files\_Screen_Desktop.jpeg
Size 47KB
SHA256 d0329053f34581d3e19d9e681e4af2903f7708db31043308399ec0bcc9fffc35
MD5 693c9639deba0935ff614a9ab2ab8671
SHA1 4ce26294d71a194b49564e6e055cbc99be359b90
SHA512 a9e5a45340301019bd2cfa4611e4f262dfc4f8d0b3ec42be835e8b042c608afb6443fcfaecf285f2548218559aa029057a557a7a05e1aeeb6582db570154dc10
SSDEEP 768:lIiQ6XRWrySmfZb5obWHQG5yulywkmMI8ee/C2nrnzl6KSnE0mZekkkkkkkkkjRl:lIizXcx4bKbW1gaD78f/C4hYELIkkkka
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\QB5TK5tiiRF0\files_\system_info.txt
Size 1KB
SHA256 7b3b4a1566ec4732a9cdc16eb4b2c5c24addf9cc5e49be8faf3953f7f909b8d8
MD5 76c7cdafc172f91bec4bf9811eb6572d
SHA1 8c6f5d5438b07296a159ac2e59756518a24f87a7
SHA512 32225ee75aaca73490b3c3d56509910343ead437f8de0d13a165dd86d9a71c49fd4bd6f05e5762b155901e3d2981c1b51a2cc85c270e59b12fcd41415484b74a
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\QB5TK5tiiRF0\files_\system_info.txt
Size 7KB
SHA256 4336c37ba2b638a27a6435bca26b2980e92c8051936581f3adf73ade896c620d
MD5 edfb562065d89a6c7d55d2635030af40
SHA1 fe58d0c5eaec338215398cb1d82859fc790f4119
SHA512 0d6d0d4e0578ccd383bc6c9d772b516a733029ea87d8bee40abd3b9d05e652fecbfe6bfe9689f40e66d8fa342a2ec432a07488b95afb41132f9696c425e5dabd
SSDEEP 96:nYtew3ThSDlQHchmcnmB4McIHOUE646HzB+6cnhrcn1wcfzSByYO:baThhR5bnUb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

niMamurKhRWNZo.zip

Path C:\Users\Admin\AppData\Local\Temp\QB5TK5tiiRF0\niMamurKhRWNZo.zip
Size 503KB
SHA256 da4e41fe248f3dc956ae9e4e4f818c552e38e56b71cd06fb054081eedc6824ca
MD5 a9ba9c10b7bb78295fee82a5f2fbf421
SHA1 af380fefea9404a069314f6a839b80fe32b5076c
SHA512 0c2d30d75ae176358373da6edfc9ac1ee125cfb4a33f4ba266b14c9be49d5681d08edebfbeb100baddca829d290cf7b5f2a01820e2a0218a836a18d276ec516e
SSDEEP 12288:V+ewhvcOZSgO33c2HtiyAUwzt7s+Zz7r5vRPkUa5vWHYFuWc:V+euBZSgO33XNJAJzt7ZZXVpvHYFi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5108-28-0x0000000000220000-0x00000000002C3000-memory.dmp

Download

memory/5108-27-0x0000000000220000-0x00000000002C3000-memory.dmp

Download

memory/5108-26-0x0000000000220000-0x00000000002C3000-memory.dmp

Download

memory/5108-25-0x0000000000220000-0x00000000002C3000-memory.dmp

Download

memory/5108-24-0x0000000000220000-0x00000000002C3000-memory.dmp

Download

memory/5108-23-0x0000000000220000-0x00000000002C3000-memory.dmp

Download

memory/5108-22-0x0000000000220000-0x00000000002C3000-memory.dmp

Download

memory/5108-243-0x0000000000220000-0x00000000002C3000-memory.dmp

Download

memory/5108-21-0x00000000038E0000-0x00000000038E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads