cryptbot | 5261e9df15262227ac4ebc91643d13d5a9a56de89ab8916e7a3ae736cfa3cd3f

Analysis

max time kernel
119s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91b8b5d888f9cb4655ac03d4553f690e.exe
Size 1.7MB
Sample240205-l952safeel
SHA256 5261e9df15262227ac4ebc91643d13d5a9a56de89ab8916e7a3ae736cfa3cd3f
MD5 91b8b5d888f9cb4655ac03d4553f690e
SHA1 aaeb196542db17b8f2526d0355a8b2b0649a0186
SHA512 c72e33044ee35f996f7c7150b695be57021dba9031562a4650e2a9e56fc118a2bc899fd61aad0ab3797adadb6723d7a0fcb5285319c3868075dde892b18e178e
SSDEEP 49152:YTT9nwPw0pSj2I70pqzrK90i/rci3lRT6z:Yv9wIMSPHK90i/rx1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

ewadgz11.top
morvay01.top

Attributes

payload_url
http://winezo01.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral2/memory/2472-25-0x0000000004450000-0x0000000004535000-memory.dmp	family_cryptbot
behavioral2/memory/2472-26-0x0000000004450000-0x0000000004535000-memory.dmp	family_cryptbot
behavioral2/memory/2472-27-0x0000000004450000-0x0000000004535000-memory.dmp	family_cryptbot
behavioral2/memory/2472-28-0x0000000004450000-0x0000000004535000-memory.dmp	family_cryptbot
behavioral2/memory/2472-239-0x0000000004450000-0x0000000004535000-memory.dmp	family_cryptbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	Specie.exe.com

Executes dropped EXE 2 IoCs

pid	Process
1960	Specie.exe.com
2472	Specie.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	91b8b5d888f9cb4655ac03d4553f690e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Specie.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Specie.exe.com

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3520	timeout.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4748	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2472	Specie.exe.com
2472	Specie.exe.com

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1868	1268	91b8b5d888f9cb4655ac03d4553f690e.exe	84
PID 1268 wrote to memory of 1868	1268	91b8b5d888f9cb4655ac03d4553f690e.exe	84
PID 1268 wrote to memory of 1868	1268	91b8b5d888f9cb4655ac03d4553f690e.exe	84
PID 1268 wrote to memory of 1756	1268	91b8b5d888f9cb4655ac03d4553f690e.exe	87
PID 1268 wrote to memory of 1756	1268	91b8b5d888f9cb4655ac03d4553f690e.exe	87
PID 1268 wrote to memory of 1756	1268	91b8b5d888f9cb4655ac03d4553f690e.exe	87
PID 1756 wrote to memory of 1956	1756	cmd.exe	89
PID 1756 wrote to memory of 1956	1756	cmd.exe	89
PID 1756 wrote to memory of 1956	1756	cmd.exe	89
PID 1956 wrote to memory of 4428	1956	cmd.exe	88
PID 1956 wrote to memory of 4428	1956	cmd.exe	88
PID 1956 wrote to memory of 4428	1956	cmd.exe	88
PID 1956 wrote to memory of 1960	1956	cmd.exe	90
PID 1956 wrote to memory of 1960	1956	cmd.exe	90
PID 1956 wrote to memory of 1960	1956	cmd.exe	90
PID 1956 wrote to memory of 4748	1956	cmd.exe	91
PID 1956 wrote to memory of 4748	1956	cmd.exe	91
PID 1956 wrote to memory of 4748	1956	cmd.exe	91
PID 1960 wrote to memory of 2472	1960	Specie.exe.com	92
PID 1960 wrote to memory of 2472	1960	Specie.exe.com	92
PID 1960 wrote to memory of 2472	1960	Specie.exe.com	92
PID 2472 wrote to memory of 3444	2472	Specie.exe.com	101
PID 2472 wrote to memory of 3444	2472	Specie.exe.com	101
PID 2472 wrote to memory of 3444	2472	Specie.exe.com	101
PID 3444 wrote to memory of 3520	3444	cmd.exe	103
PID 3444 wrote to memory of 3520	3444	cmd.exe	103
PID 3444 wrote to memory of 3520	3444	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\91b8b5d888f9cb4655ac03d4553f690e.exe
"C:\Users\Admin\AppData\Local\Temp\91b8b5d888f9cb4655ac03d4553f690e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c illZWL
  2⤵
  PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Frecce.wms
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Specie.exe.com
      Specie.exe.com G
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Specie.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Specie.exe.com G
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2472
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\qYVsKJDdkQyFY & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Specie.exe.com"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:3520
  - - C:\Windows\SysWOW64\PING.EXE
      ping TSBKFJQM -n 30
      4⤵
      Runs ping.exe
      PID:4748

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^WIfltySvgfOTLJAGwehqWMAXJhuFwFmOnPtUuexdmQnljMUZuwoVglApiaAQZhcJPqxVFFAZHXBygdKWzunZvDmggUNOBEdkcPxjsYxBBphsIx$" Verita.wms
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Frecce.wms

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Frecce.wms
Size 398B
SHA256 db4deec86222e56d8e6a20174a6d32d98f6d573c6c62341e881b7e1b2bbd36a4
MD5 bcd372ec88a6dc3b8c2a9f5c37a279a3
SHA1 9cf618b5a3490ac7bd43290a5f87ef5b83758ef3
SHA512 2501268d1b26535ea85dcc3843ee560086dd2046dbdc643701fa98b3f7e0fd7a4a70f313e1a4117bc83e19dabf5f635598686e638ac92fab09733900fe44c681
MD5 SHA1 SHA512

Submit Download

Gambe.wms

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gambe.wms
Size 712KB
SHA256 d5a0e29b9ef2b0c932384cbbc848642e247e221014c7fe53558a39c81ababd2f
MD5 0966ae729e527707e30db85336fc6bb1
SHA1 50f5041be7405426838990377bf5ca554680a498
SHA512 de0b36bf4a022ac970376c3611e5e044f1a566bc463f2e441c326f457ff674208b48390e8e57fc8c39a38b34f7e28e1f084e272526cbc16ec6dfd2b71896cfbb
SSDEEP 12288:ap643BvWxmVcbe5iUS4cPJGMRy67R8hZgWiYUBzK9:apf76Vs5iYUBO9
MD5 SHA1 SHA512 SSDEEP

Submit Download

San.wms

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\San.wms
Size 894KB
SHA256 6291e5db2c3b21e95f808283efcdfaaacb04da19d58011252d4d058066918be6
MD5 49a5b12e0f0ac48f8404359ab387ef40
SHA1 05cfdce260363c73ef2ed4b2222086cc415d1978
SHA512 37bf21968295260cd4b2dcd478b15ae1058a4ad51f12d730a473a744ac7ea2dc2167bc2db5a1ff0a512b6df0c3fc22c86f981a3be865f4d3e3c64eb72375f953
SSDEEP 24576:YkIuPZeczoGnKfBlNRfkdIKh3lWbODA0Kzj:Yp03zrKJdMdIKh3lJdKzj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Specie.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Specie.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Verita.wms

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Verita.wms
Size 872KB
SHA256 76efe3589432097119afeba70cebb3fb14a96e07e7a6de45357e89b8ad359f55
MD5 13e8d6cde8345b00394f328462128c2b
SHA1 94e01a16fe521a6a2218d0fbe084dd0e9c78614e
SHA512 bf87d434c29cb9425115f3c0dbc2f1da3838e0a0a0172be1fd7f333932a873408f948a1cd1414cd8476ca228458b6b084952ce63277c62b9bd9b50d6f9c1a707
SSDEEP 12288:upVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:uT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

FMIMDH~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\qYVsKJDdkQyFY\FMIMDH~1.ZIP
Size 41KB
SHA256 fb44591d999ff02aac1ed53cdcf8e13b93316e3d885daa508b9c7b7ed7d16ec3
MD5 f50ecd8a8b364cc28ac537ddfdeebb5b
SHA1 0efe117523adb22eab575ba7330924e2b09d7b4e
SHA512 41938a53a1c67d32b6dbb330ec25b48933616d8d48d1b4c3ead6e976867dda627255e06314fe495c599e9ec956beccfb46ef4bf09d62773c1abe7edfef8f20d3
SSDEEP 768:+bERc0VNhy7RO78xI74hHcd01c7p5DM5kWqRKRZ81uIo7cDjTM3:+bEi0o7tI76801cnDM+WQKRZ81uI7DPe
MD5 SHA1 SHA512 SSDEEP

Submit Download

PYUZFN~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\qYVsKJDdkQyFY\PYUZFN~1.ZIP
Size 41KB
SHA256 f43628d104c68e22e7c30a369401a7afb346df170137cd2e79f25c3c1d25ee19
MD5 13272b2063c6533faa4d84dc198d8aad
SHA1 d7bdbd73cacaf790ca6c1f97d551d4f8afdf97d9
SHA512 30877e0d643d2b44383cc94688d0cc40dd0ee9ea1aebc1293d01fa17348892fe1c12ae4d402b456ed39e1192034e639be0b83a32a1a06acd78b881813c2e1b8a
SSDEEP 768:e8bERc0VNhy7RO78xI74hHcd01c7p5DM5kWqRKRZ81uIo7cDjT5:dbEi0o7tI76801cnDM+WQKRZ81uI7DP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

_INFOR~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\qYVsKJDdkQyFY\_Files\_INFOR~1.TXT
Size 7KB
SHA256 341e928fa4459caa7c8a56218ce4ee6e8678fce4650141224fdfc7a745a228d8
MD5 b3e34ffab3b9950897a0700d13a83abe
SHA1 744c3976d27211b4b81c76d04dae57b6d16bc157
SHA512 7b51f685f90955645336ffe43564b6ff7f950d8a5a4a994b731bbfa568e1f5525f27d2214994e1490caadd616fced6fee654927a5205e6e5d5fb27ad74c53285
SSDEEP 96:sGgUteBSrndqDlQHchmcnmB4McIHOUE646HzB+6cnhrcn1wcfzSByYO:/wErdJR5bnUb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\qYVsKJDdkQyFY\_Files\_Information.txt
Size 5KB
SHA256 cc06c8b08d110b52414874c5558c71050e544a128e5e85ddebf208192e91c82d
MD5 74e56260696f8d1f16ff422bc7b688e5
SHA1 29d4102e6c23feb7b59010b5121f237fba1c3b3b
SHA512 a8c8ced35bf4f943e152b5a60ec167998477a3bfeedc0d7b02bc644ac92cf1896c82546011ea98d3156fc07176716b2afaaf9d5d6606a987d92ce87fbf42d03c
SSDEEP 96:sGgUteBSrndqDlQHchmcnmB4McIHOUE646HL:/wErdJR5bb
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\qYVsKJDdkQyFY\_Files\_Screen_Desktop.jpeg
Size 47KB
SHA256 76b1ce23dee973c0c693a243c39c9fd450df3ecb8f7a96490d73f9cb5bf56e40
MD5 b5f0ef42e618d772e2efc1f30408f123
SHA1 969da1503da3596aef74475affa35950e8b9531a
SHA512 a96f375d423d9cac049b7bb857030ecc55e9207ccff0e447680e107400f77bd6d6dec30d3001900cb6fa8561c00f8d27ccac5c32a822054c471bbdaf97eb11fa
SSDEEP 768:l5pS32gCzecQuoOVyC5BDIMIfoi7qKv/VfDJnzDEVtkIim5PE9c7hCh11ZCc0ftH:l5pzg+rUYKdwi71vRDZDqimlE9csCdfR
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\qYVsKJDdkQyFY\files_\system_info.txt
Size 1KB
SHA256 d8dbdde1e58261f33f6cba192ea808466d10f5b3c76c01360893acbff88911fe
MD5 bfec64447ecc9a043a62924fd7890c8b
SHA1 52cd3b6285ff8cc1ff332d4ac58c970b63d0fa56
SHA512 f7f768737c7047b0d5154a0071506fc7b2e907b6d1a655cc1eac72f7661ba164e5e95b07b5b8c705a9cb75c4845e0d06b7ebaf8d3f42ddb324013548cb37d98d
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\qYVsKJDdkQyFY\files_\system_info.txt
Size 7KB
SHA256 d203929f3d77fa8a437e223f9b3a5c38678a7af1bf0e0312823bf1639556067e
MD5 dbda3e9af887fb93e80c07f1198c0f57
SHA1 7094f3fb0d48cb7a2fbd10ac0ea60072eac5de2f
SHA512 7bf1d68b57c74ee66db8e6e2abdf59ce6201669c021c12a261569b116b2215b4bd65a82478cd0893684ebaa79cdb8f4b64e010db1b32317c764516cd70be9d30
SSDEEP 96:7bYtewirhSDlQHchmcnmB4McIHOUE646HzB+6cnhrcn1wcfzSByYO:73nrhhR5bnUb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2472-21-0x0000000000C60000-0x0000000000C61000-memory.dmp

Download

memory/2472-28-0x0000000004450000-0x0000000004535000-memory.dmp

Download

memory/2472-27-0x0000000004450000-0x0000000004535000-memory.dmp

Download

memory/2472-26-0x0000000004450000-0x0000000004535000-memory.dmp

Download

memory/2472-25-0x0000000004450000-0x0000000004535000-memory.dmp

Download

memory/2472-239-0x0000000004450000-0x0000000004535000-memory.dmp

Download

memory/2472-24-0x0000000004450000-0x0000000004535000-memory.dmp

Download

memory/2472-23-0x0000000004450000-0x0000000004535000-memory.dmp

Download

memory/2472-22-0x0000000004450000-0x0000000004535000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads