cryptbot | b82f56d700f46d03d91ab996e3affd374c44312213dfa4440e0a8926f5433b0e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8472ae9fabd1a6ed08801c724d1f7370.exe
Size 603KB
Sample240131-py3n3aecel
SHA256 b82f56d700f46d03d91ab996e3affd374c44312213dfa4440e0a8926f5433b0e
MD5 8472ae9fabd1a6ed08801c724d1f7370
SHA1 d78d252b68721ab80c5ef7871de0d313c7d38c11
SHA512 d331a685a05be0bd811e295bfd6ab783c477bad7afc452139473f9a2ad55442bdaa4b8bef4d1a7d00abbefedabbf124bc26010f080557a76022ac9e4e9b71d8a
SSDEEP 12288:Yue8smsP0aIyb0SrfHZvTStzmMbP+jzh9C5:U8stMbyb0SrfZrStnmjl9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

haibam72.top
morelm07.top

Attributes

payload_url
http://zelyoc10.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 4 IoCs

resource	yara_rule
behavioral2/memory/1740-2-0x0000000004A90000-0x0000000004B30000-memory.dmp	family_cryptbot
behavioral2/memory/1740-3-0x0000000000400000-0x0000000002CCC000-memory.dmp	family_cryptbot
behavioral2/memory/1740-208-0x0000000000400000-0x0000000002CCC000-memory.dmp	family_cryptbot
behavioral2/memory/1740-213-0x0000000004A90000-0x0000000004B30000-memory.dmp	family_cryptbot

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8472ae9fabd1a6ed08801c724d1f7370.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8472ae9fabd1a6ed08801c724d1f7370.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1740	8472ae9fabd1a6ed08801c724d1f7370.exe
1740	8472ae9fabd1a6ed08801c724d1f7370.exe

C:\Users\Admin\AppData\Local\Temp\8472ae9fabd1a6ed08801c724d1f7370.exe
"C:\Users\Admin\AppData\Local\Temp\8472ae9fabd1a6ed08801c724d1f7370.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\qo11svyl\_Files\_Information.txt
Size 1KB
SHA256 a53e2f3cf69b065c95dffdafd8c41380df3ef49d69d776270e0b1ab18b909844
MD5 28f783a91c73faeadbface6d268348fd
SHA1 08a0fa9ef7faf637c3d049a0d55a01e0896b6d03
SHA512 8481708587cbad79445819ec088062a7a6a07b0aa96da3f6aba4ecd7029e4c8d854af185e0030909e2234c45542bc98cf635a485400db691c7047446d581abb2
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\qo11svyl\_Files\_Information.txt
Size 1KB
SHA256 d635c861765bd4e1dc5c3ade198c49a686292536071729e519393a933cfdc86d
MD5 7a39b742a1336ead0c9fde2a9f1c4ea3
SHA1 30871eaa1bd5ecba225b15d82e7cee6d419761f3
SHA512 cb186b72459df98ad48fd0be455d326b384b6519851a28285b819cb17d5fc7c0d3f7ad2af8aa1984d1ee326521086665c34be94b4664d6de7c3b465051d1b91c
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\qo11svyl\_Files\_Information.txt
Size 4KB
SHA256 539dd4e2c720123202c4f6ccfb60f1220068a595481a23bb95c0b518ed5c28e5
MD5 dc8b5117ad6cf30edbcdbc82482cd04f
SHA1 46843c1bff73fe454208449a29e71451d7c7d20a
SHA512 f82f0ee0b1b76515eb9c1b440da0c8cc84c2c8b5d10ccf6c24fb0a8d150c66589b2cfc429417b2a24c4e9ab412041cf5942b24a85101132a37ea248b4a2f3d0b
SSDEEP 48:sxKUteXxcaMBNehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+A9:ssUteBq1ndqDlQHchmcnmB4McIHOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\qo11svyl\_Files\_Screen_Desktop.jpeg
Size 45KB
SHA256 f1199fb82e9f250734760b2013a2a4232b648d07f4c46ab9fe6fe8827c918c74
MD5 8d8117f9da6b17fe80e77a6547360bd3
SHA1 d3923b07e736affb4312b30d54de1038a25bd99f
SHA512 a85320105d69e910c5edd0d0ad64aad6b4e7f0b13b8f5ce4d4334577cf21057b2c664a735f84162900fa85cbdadb97ac673c05417edb773a93bb6448ee65b1da
SSDEEP 768:lSoC1IQYVbtoPzWDcJhhMk+ZC0YYjJyVB8WOLLn7FcktPaGWxkuWTFo68:lFC1IQYbKP6Q6ty4DLLn7mktZWxkuWTy
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\qo11svyl\files_\system_info.txt
Size 1KB
SHA256 8a7eb7b61773a149eb0adbfa15ac25e508e256769e6971d445f22487bde6c940
MD5 7098b15b7d7e44c72496ec47209cc618
SHA1 0825752d69815c2c8fa8c94c804d80130a4a774d
SHA512 e4a5a9031e16ad55467f13640a55b037033dd951311985be2b60809f620fa3c2755ef51b01e65bd6cb369072aa9518198f364676c31e298ea997d3ebe77be900
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\qo11svyl\files_\system_info.txt
Size 4KB
SHA256 2c9041f76ee9078f7c21ca68202424d687c64dbdc1c95451e364648e421c8081
MD5 9cf00968b52cbc5c5f1e4c655e669a5a
SHA1 131cd3d11455d3c9dd667ced3be215582813f948
SHA512 75cc712f9cc044f4dcaa9d0f0c398a4e95ce171ec5700e4b624ded057b7be71fadf2539f6cd3db2797d5a89a607799e198afd06ff5ee58fad4604d860410ba7d
SSDEEP 48:chYte8x8qNOhGYTQ5zeDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+A3ZN+W:aYtew7lhSDlQHchmcnmB4McIHOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

lAfiEz8jLg.zip

Path C:\Users\Admin\AppData\Local\Temp\qo11svyl\lAfiEz8jLg.zip
Size 39KB
SHA256 36db86e1cb6eddc2f912e741c099800542847422f464dbf298900d8748f416bf
MD5 24428a0304e03d1b6cc2ef49ecd6f385
SHA1 977bfbbe836d50ff578b36d2d11d767f7045b9db
SHA512 48fc0aa83bb40e64490c9b6fa26693cff480e8066c4f6354ec978327185b4c5b5788cf91bff5951a3c5b50bdc7f17c5ad7b763d834f4c46996968e9dfab05cd0
SSDEEP 768:mBp9W5TNgaI+OsWEvaLaytN+Yjj60tRna4/eJKy2CK40yeq0O0wkCMxeQr:WclNHI+OxzL3tNi0na2eEy2S01O0w6xF
MD5 SHA1 SHA512 SSDEEP

Submit Download

uj8u1R2AlkPCwh.zip

Path C:\Users\Admin\AppData\Local\Temp\qo11svyl\uj8u1R2AlkPCwh.zip
Size 39KB
SHA256 22ae21514f5f8d8777a0b88e27d8184fe6ff31cc45979f7c7a80ceefd1111986
MD5 e8cf1d26b29a2eb98957f9e87f5b3eba
SHA1 5d7c5d6481347fc4dd125b16b3597d0c61047d6d
SHA512 886a5dd561b69828ee45c17321eee2b64355e09e0e518d5440cfc94a74a12c349192db8bdde058161ef05128c9dda713bc38d0669d10ab13fe2a0753aafd93c1
SSDEEP 768:NQuBp9W5TNgaI+OsWEvaLaytN+Yjj60tRna4/eJKy2CK40yeq0O0wkCN:NQ+clNHI+OxzL3tNi0na2eEy2S01O0w/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1740-3-0x0000000000400000-0x0000000002CCC000-memory.dmp

Download

memory/1740-2-0x0000000004A90000-0x0000000004B30000-memory.dmp

Download

memory/1740-1-0x0000000002D10000-0x0000000002E10000-memory.dmp

Download

memory/1740-208-0x0000000000400000-0x0000000002CCC000-memory.dmp

Download

memory/1740-212-0x0000000002D10000-0x0000000002E10000-memory.dmp

Download

memory/1740-213-0x0000000004A90000-0x0000000004B30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads