cryptbot | 5261e9df15262227ac4ebc91643d13d5a9a56de89ab8916e7a3ae736cfa3cd3f

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91b8b5d888f9cb4655ac03d4553f690e.exe
Size 1.7MB
Sample240205-l952safeel
SHA256 5261e9df15262227ac4ebc91643d13d5a9a56de89ab8916e7a3ae736cfa3cd3f
MD5 91b8b5d888f9cb4655ac03d4553f690e
SHA1 aaeb196542db17b8f2526d0355a8b2b0649a0186
SHA512 c72e33044ee35f996f7c7150b695be57021dba9031562a4650e2a9e56fc118a2bc899fd61aad0ab3797adadb6723d7a0fcb5285319c3868075dde892b18e178e
SSDEEP 49152:YTT9nwPw0pSj2I70pqzrK90i/rci3lRT6z:Yv9wIMSPHK90i/rx1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

ewadgz11.top
morvay01.top

Attributes

payload_url
http://winezo01.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral1/memory/2692-28-0x0000000003BA0000-0x0000000003C85000-memory.dmp	family_cryptbot
behavioral1/memory/2692-29-0x0000000003BA0000-0x0000000003C85000-memory.dmp	family_cryptbot
behavioral1/memory/2692-30-0x0000000003BA0000-0x0000000003C85000-memory.dmp	family_cryptbot
behavioral1/memory/2692-31-0x0000000003BA0000-0x0000000003C85000-memory.dmp	family_cryptbot
behavioral1/memory/2692-34-0x0000000003BA0000-0x0000000003C85000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
2160	Specie.exe.com
2692	Specie.exe.com

Loads dropped DLL 2 IoCs

pid	Process
1644	cmd.exe
2160	Specie.exe.com

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	91b8b5d888f9cb4655ac03d4553f690e.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Specie.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Specie.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2644	PING.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2372	2216	91b8b5d888f9cb4655ac03d4553f690e.exe	28
PID 2216 wrote to memory of 2372	2216	91b8b5d888f9cb4655ac03d4553f690e.exe	28
PID 2216 wrote to memory of 2372	2216	91b8b5d888f9cb4655ac03d4553f690e.exe	28
PID 2216 wrote to memory of 2372	2216	91b8b5d888f9cb4655ac03d4553f690e.exe	28
PID 2216 wrote to memory of 3032	2216	91b8b5d888f9cb4655ac03d4553f690e.exe	30
PID 2216 wrote to memory of 3032	2216	91b8b5d888f9cb4655ac03d4553f690e.exe	30
PID 2216 wrote to memory of 3032	2216	91b8b5d888f9cb4655ac03d4553f690e.exe	30
PID 2216 wrote to memory of 3032	2216	91b8b5d888f9cb4655ac03d4553f690e.exe	30
PID 3032 wrote to memory of 1644	3032	cmd.exe	32
PID 3032 wrote to memory of 1644	3032	cmd.exe	32
PID 3032 wrote to memory of 1644	3032	cmd.exe	32
PID 3032 wrote to memory of 1644	3032	cmd.exe	32
PID 1644 wrote to memory of 2912	1644	cmd.exe	33
PID 1644 wrote to memory of 2912	1644	cmd.exe	33
PID 1644 wrote to memory of 2912	1644	cmd.exe	33
PID 1644 wrote to memory of 2912	1644	cmd.exe	33
PID 1644 wrote to memory of 2160	1644	cmd.exe	35
PID 1644 wrote to memory of 2160	1644	cmd.exe	35
PID 1644 wrote to memory of 2160	1644	cmd.exe	35
PID 1644 wrote to memory of 2160	1644	cmd.exe	35
PID 1644 wrote to memory of 2644	1644	cmd.exe	34
PID 1644 wrote to memory of 2644	1644	cmd.exe	34
PID 1644 wrote to memory of 2644	1644	cmd.exe	34
PID 1644 wrote to memory of 2644	1644	cmd.exe	34
PID 2160 wrote to memory of 2692	2160	Specie.exe.com	36
PID 2160 wrote to memory of 2692	2160	Specie.exe.com	36
PID 2160 wrote to memory of 2692	2160	Specie.exe.com	36
PID 2160 wrote to memory of 2692	2160	Specie.exe.com	36

C:\Users\Admin\AppData\Local\Temp\91b8b5d888f9cb4655ac03d4553f690e.exe
"C:\Users\Admin\AppData\Local\Temp\91b8b5d888f9cb4655ac03d4553f690e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c illZWL
  2⤵
  PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Frecce.wms
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^WIfltySvgfOTLJAGwehqWMAXJhuFwFmOnPtUuexdmQnljMUZuwoVglApiaAQZhcJPqxVFFAZHXBygdKWzunZvDmggUNOBEdkcPxjsYxBBphsIx$" Verita.wms
      4⤵
      PID:2912
  - - C:\Windows\SysWOW64\PING.EXE
      ping GLTGRJAG -n 30
      4⤵
      Runs ping.exe
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Specie.exe.com
      Specie.exe.com G
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Specie.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Specie.exe.com G
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Frecce.wms

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Frecce.wms
Size 398B
SHA256 db4deec86222e56d8e6a20174a6d32d98f6d573c6c62341e881b7e1b2bbd36a4
MD5 bcd372ec88a6dc3b8c2a9f5c37a279a3
SHA1 9cf618b5a3490ac7bd43290a5f87ef5b83758ef3
SHA512 2501268d1b26535ea85dcc3843ee560086dd2046dbdc643701fa98b3f7e0fd7a4a70f313e1a4117bc83e19dabf5f635598686e638ac92fab09733900fe44c681
MD5 SHA1 SHA512

Submit Download

Gambe.wms

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gambe.wms
Size 712KB
SHA256 d5a0e29b9ef2b0c932384cbbc848642e247e221014c7fe53558a39c81ababd2f
MD5 0966ae729e527707e30db85336fc6bb1
SHA1 50f5041be7405426838990377bf5ca554680a498
SHA512 de0b36bf4a022ac970376c3611e5e044f1a566bc463f2e441c326f457ff674208b48390e8e57fc8c39a38b34f7e28e1f084e272526cbc16ec6dfd2b71896cfbb
SSDEEP 12288:ap643BvWxmVcbe5iUS4cPJGMRy67R8hZgWiYUBzK9:apf76Vs5iYUBO9
MD5 SHA1 SHA512 SSDEEP

Submit Download

San.wms

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\San.wms
Size 894KB
SHA256 6291e5db2c3b21e95f808283efcdfaaacb04da19d58011252d4d058066918be6
MD5 49a5b12e0f0ac48f8404359ab387ef40
SHA1 05cfdce260363c73ef2ed4b2222086cc415d1978
SHA512 37bf21968295260cd4b2dcd478b15ae1058a4ad51f12d730a473a744ac7ea2dc2167bc2db5a1ff0a512b6df0c3fc22c86f981a3be865f4d3e3c64eb72375f953
SSDEEP 24576:YkIuPZeczoGnKfBlNRfkdIKh3lWbODA0Kzj:Yp03zrKJdMdIKh3lJdKzj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Specie.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Specie.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Verita.wms

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Verita.wms
Size 872KB
SHA256 76efe3589432097119afeba70cebb3fb14a96e07e7a6de45357e89b8ad359f55
MD5 13e8d6cde8345b00394f328462128c2b
SHA1 94e01a16fe521a6a2218d0fbe084dd0e9c78614e
SHA512 bf87d434c29cb9425115f3c0dbc2f1da3838e0a0a0172be1fd7f333932a873408f948a1cd1414cd8476ca228458b6b084952ce63277c62b9bd9b50d6f9c1a707
SSDEEP 12288:upVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:uT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2692-25-0x0000000003BA0000-0x0000000003C85000-memory.dmp

Download

memory/2692-24-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2692-26-0x0000000003BA0000-0x0000000003C85000-memory.dmp

Download

memory/2692-27-0x0000000003BA0000-0x0000000003C85000-memory.dmp

Download

memory/2692-28-0x0000000003BA0000-0x0000000003C85000-memory.dmp

Download

memory/2692-29-0x0000000003BA0000-0x0000000003C85000-memory.dmp

Download

memory/2692-30-0x0000000003BA0000-0x0000000003C85000-memory.dmp

Download

memory/2692-31-0x0000000003BA0000-0x0000000003C85000-memory.dmp

Download

memory/2692-34-0x0000000003BA0000-0x0000000003C85000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads