cryptbot | 48dcbd723235d40fc1e4162e8808b4ca5eaa2b3fcd1d8daf8fc9b5bce31cf0ca

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
849ff89531036596a39c31e5b023ac52.exe
Size 619KB
Sample240131-rh4mjafgap
SHA256 48dcbd723235d40fc1e4162e8808b4ca5eaa2b3fcd1d8daf8fc9b5bce31cf0ca
MD5 849ff89531036596a39c31e5b023ac52
SHA1 e408e841600dc4d2d925cbca6c022a5babe46211
SHA512 f1c852c85f1e001d1aa2d4fabbd8891c4d886c2242bfc0f6d16cbaafbcb2a06fac90b0b86b31068f3b7c1ea2870b46343ba8be1e2f4d04a65f3c8e22088c8b57
SSDEEP 12288:6k/hUzVnAebJfZIrcPFql59iqp+6TH46YV+CNgiRB5XpiEkPr62I:WzWeQqiiqpdTYnA2xjkPr62I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

knuplj61.top
morwye06.top

Attributes

payload_url
http://sarjeb09.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 4 IoCs

resource	yara_rule
behavioral2/memory/3048-2-0x0000000004150000-0x00000000041F0000-memory.dmp	family_cryptbot
behavioral2/memory/3048-3-0x0000000000400000-0x0000000002405000-memory.dmp	family_cryptbot
behavioral2/memory/3048-207-0x0000000000400000-0x0000000002405000-memory.dmp	family_cryptbot
behavioral2/memory/3048-212-0x0000000004150000-0x00000000041F0000-memory.dmp	family_cryptbot

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	849ff89531036596a39c31e5b023ac52.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	849ff89531036596a39c31e5b023ac52.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3048	849ff89531036596a39c31e5b023ac52.exe
3048	849ff89531036596a39c31e5b023ac52.exe

C:\Users\Admin\AppData\Local\Temp\849ff89531036596a39c31e5b023ac52.exe
"C:\Users\Admin\AppData\Local\Temp\849ff89531036596a39c31e5b023ac52.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\_Files\_Information.txt
Size 1KB
SHA256 319c76fb63b84514781086eba8d4bd5dae7040c4aded89f8bcd7242831af4c21
MD5 8931686ef32e284c997e79a2998a8304
SHA1 238e9f8ff19f7e105f4bd744a86717797831bd5e
SHA512 a80bc187dedb133bb99a580edeff68142ccd87950f5e5d2528f940f4ba1baa62d9bcdd7a015172ff49c061ccf9c11d7d0336c52f20e1b10fbf0e13292a329b4c
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\_Files\_Information.txt
Size 2KB
SHA256 7a085e52ad12bcdf63a42eaee1f0dff311de83f776549b225b2554dc7fdd676c
MD5 399049f1937cbe7e128dfb505c8f78ad
SHA1 18771fa28cbae6ad815ec6f78f64eb11de6c1b09
SHA512 8b4faffc166ad5e9a5ce4c7bea261b4e75c2a71e9d1ed71c0e45079e37cb4816ed533b54fc0b0ce6812a73c456c70d90f93b5468c6a2338db01232398b4479fd
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\_Files\_Information.txt
Size 2KB
SHA256 77ab15b90a0c41287a79bc8b81671a0f1ba2d9023c844a9dfc0883e310b3cf20
MD5 10fc84e13f204939e363bc6945ef9113
SHA1 fc530717cf097c8cf4febf5861ebdaa2aeea6f70
SHA512 60cb8898537e65faefb0cbcb305b96b22b332a3e1b2f6d6130f495794f552e3dacfda8233882b935e732c60796c6b6d13ce9929d093c1d706f81529173199c08
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\_Files\_Information.txt
Size 2KB
SHA256 56f87a1e13bf6babe08f12d11c2e38d622b5343ece13a7523fcfd019db1fb826
MD5 4d482857b54ee81ec71bc342ac814d10
SHA1 d21a851fc92af36b9c557ff191a74325c981bc81
SHA512 f1c7390823689b4234cbddeb7e1771794a25ecc90d1e82d5af4426574c464cad6b32d30dcd17cd82d2b8baf88d99109f41195ef7aa9576b660c84d3a56317cb2
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\_Files\_Information.txt
Size 4KB
SHA256 4bb169503188360ac7343a2167e702373761f90a1dc435cee4833dfa68fadb1b
MD5 93c303fc3c385bfc13042a04e43d0fbf
SHA1 e53bfe4078958c63d59c977352da9061daaf7702
SHA512 7597c7ca571a1d1e98e53f18ab9bc57ab74151ee4601c2722c650ff8f9f26b9d5253af774518b08912b0d443950909aa5111afdeca3d0b141e4edde2cc5f5fc7
SSDEEP 48:sxmJiUteXxiaMEehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+6:s+iUteB7ndqDlQHchmcnmB4McIHOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\_Files\_Screen_Desktop.jpeg
Size 48KB
SHA256 effebb589ee7edc866eec9b030db7515e97e125b2e543da880f04ac7961c57c5
MD5 f91114b277dd972a9d6a9acb4bf130d7
SHA1 633030dff40637b27ea6dc8503eaf6b8394193ba
SHA512 a9ebbd6778d71bfd0f38060c099cb6a5b878583c37c059912d3d454485ab1debfeb8300d44820af16f9bede019503d0c498f450289fdbb0af20c0531973b7424
SSDEEP 768:l6rvh61i50FQa3fcQuofuP3Tc+IpnLibNL56nqwTYdBiItXp7nYqilYYbvKnES0i:lzVxCusY+MLsrAkdB3tpzYveYbvKEHE
MD5 SHA1 SHA512 SSDEEP

Submit Download

feSEQkDfUigr.zip

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\feSEQkDfUigr.zip
Size 42KB
SHA256 1fef49c8de73d081186b6a0e22f45e08446352d309013153b8e9a3655196a9fe
MD5 8419b6b867f2b1e77063e856ed9aeb2b
SHA1 070352b5cef67d2dd242e3c4397442a008a84579
SHA512 5583554aaeee2fce33e53ab4889e3afd5bbea995778ad61ec86f07af164d6808ce321c171d30cf2416e9c54775c6bfd8e72e13518dad19b0103e963845337000
SSDEEP 768:JKmGqqLGz/WLOvv4sMBwnMCVDNH7rvqo5SG+7QG87zUsHBnJuSLQCW4KMnRK:4d9L7Ovrc1mNHCrt7cz7HmSkCugw
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\files_\system_info.txt
Size 718B
SHA256 96e13479cb821b749df54f42013608f7adbabce082e508805cc6c0f1ee2e6ee2
MD5 9108e61c3cd44755a57f7c6b2048c675
SHA1 e81518cea4cdbfc27702a69838cb5048b0bf8fa9
SHA512 bf8739c345a5fff3ebc97b52cb97ccaa95038c1682824565c44b962b569c6c1ee16c8f6baf513b19a3e2189ff9a966573998a1e1b00413475dfd3c5485d3a4aa
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\files_\system_info.txt
Size 6KB
SHA256 f5cafa3e217291e6bd3f2f56ec42073e3900c1d63435920cee3d7d0bc37d974f
MD5 d8b6d3fa278f1804d7d69d3ae84d6122
SHA1 52b63fd5b6d13322396f61730c5f7f26a7b30a0e
SHA512 5274b44d84e63ec352c0d2b0be2dd103d11d5e12d2d81e816e24ab608b927299a99510102bcd29ed71eb3513efdd403be37963c09c91cb6901bac68fdb42e9ba
SSDEEP 96:9pYtewJhSDlQHchmcnmB4McIHOUE646HzB+6cnhrcn9:nUhhR5bnUS
MD5 SHA1 SHA512 SSDEEP

Submit Download

pSGMTccV.zip

Path C:\Users\Admin\AppData\Local\Temp\7K304hx24f\pSGMTccV.zip
Size 42KB
SHA256 e001ad56f0f3b197c121bc0326b70da99674e28301bf74b538ae116bac86973b
MD5 3bd87c1f2788e70f44c6d0edfdda1b53
SHA1 751d86ebea5525f19f57a7a22c06afd4b90fb7d9
SHA512 c398099853c23b4923baacebbbf686a388bfc42811874b3e5165df229256b64992016dbc0b3beef371ae7abe335bf6b4cb5c59e1e7303937f24f21a6c4a9cf93
SSDEEP 768:FLGz/WLOvv4sMBwnMCVDNH7rvqo5SG+7QG87zUsHBnJuSLQCW4KMnRbO:FL7Ovrc1mNHCrt7cz7HmSkCugA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3048-3-0x0000000000400000-0x0000000002405000-memory.dmp

Download

memory/3048-2-0x0000000004150000-0x00000000041F0000-memory.dmp

Download

memory/3048-1-0x0000000002420000-0x0000000002520000-memory.dmp

Download

memory/3048-207-0x0000000000400000-0x0000000002405000-memory.dmp

Download

memory/3048-210-0x0000000002420000-0x0000000002520000-memory.dmp

Download

memory/3048-212-0x0000000004150000-0x00000000041F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads