cryptbot | a5e39d2fc07dc83a51beb1478edddc392f813885e09a2d056410acd5c2f57ad9

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a5a45774ffd56a01361a539f706fb6c.exe
Size 557KB
Sample240214-a52b9ach9v
SHA256 a5e39d2fc07dc83a51beb1478edddc392f813885e09a2d056410acd5c2f57ad9
MD5 9a5a45774ffd56a01361a539f706fb6c
SHA1 764a46929d79bdc063db03ef212132a96e861804
SHA512 9f284a07ac9a0158b9c294590f19125dfc9ebb6906d8fcdc64609ae4b14cad8e26fb94cb785307b5c1b635ff5703bcdd579c8d4abf12204b51472f33933841d7
SSDEEP 12288:I+Vq6nTMaY/3Wvi9Obkhup7ESwPhq3OEi:IJNB3WyOk0pgSMqxi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

lysano52.top
morecj05.top

Attributes

payload_url
http://damyeb07.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 4 IoCs

resource	yara_rule
behavioral2/memory/5048-2-0x0000000004A60000-0x0000000004B00000-memory.dmp	family_cryptbot
behavioral2/memory/5048-3-0x0000000000400000-0x0000000002CC1000-memory.dmp	family_cryptbot
behavioral2/memory/5048-207-0x0000000000400000-0x0000000002CC1000-memory.dmp	family_cryptbot
behavioral2/memory/5048-212-0x0000000004A60000-0x0000000004B00000-memory.dmp	family_cryptbot

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 22 IoCs

pid	pid_target	Process	procid_target
3572	5048	WerFault.exe	86
2116	5048	WerFault.exe	86
1896	5048	WerFault.exe	86
2196	5048	WerFault.exe	86
1848	5048	WerFault.exe	86
3828	5048	WerFault.exe	86
1004	5048	WerFault.exe	86
1680	5048	WerFault.exe	86
5024	5048	WerFault.exe	86
3848	5048	WerFault.exe	86
4044	5048	WerFault.exe	86
3444	5048	WerFault.exe	86
860	5048	WerFault.exe	86
1664	5048	WerFault.exe	86
992	5048	WerFault.exe	86
1612	5048	WerFault.exe	86
2064	5048	WerFault.exe	86
4612	5048	WerFault.exe	86
4144	5048	WerFault.exe	86
3484	5048	WerFault.exe	86
3496	5048	WerFault.exe	86
4808	5048	WerFault.exe	86

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9a5a45774ffd56a01361a539f706fb6c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9a5a45774ffd56a01361a539f706fb6c.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5048	9a5a45774ffd56a01361a539f706fb6c.exe
5048	9a5a45774ffd56a01361a539f706fb6c.exe

C:\Users\Admin\AppData\Local\Temp\9a5a45774ffd56a01361a539f706fb6c.exe
"C:\Users\Admin\AppData\Local\Temp\9a5a45774ffd56a01361a539f706fb6c.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:5048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 604
  2⤵
  - Program crash
  PID:3572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 688
  2⤵
  - Program crash
  PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 756
  2⤵
  - Program crash
  PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 868
  2⤵
  - Program crash
  PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 840
  2⤵
  - Program crash
  PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 908
  2⤵
  - Program crash
  PID:3828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1148
  2⤵
  - Program crash
  PID:1004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1152
  2⤵
  - Program crash
  PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 772
  2⤵
  - Program crash
  PID:5024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 692
  2⤵
  - Program crash
  PID:3848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 796
  2⤵
  - Program crash
  PID:4044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1512
  2⤵
  - Program crash
  PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1548
  2⤵
  - Program crash
  PID:860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1500
  2⤵
  - Program crash
  PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1508
  2⤵
  - Program crash
  PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1580
  2⤵
  - Program crash
  PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1460
  2⤵
  - Program crash
  PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1492
  2⤵
  - Program crash
  PID:4612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1476
  2⤵
  - Program crash
  PID:4144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1580
  2⤵
  - Program crash
  PID:3484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1228
  2⤵
  - Program crash
  PID:3496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 856
  2⤵
  - Program crash
  PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5048 -ip 5048
1⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5048 -ip 5048
1⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5048 -ip 5048
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5048 -ip 5048
1⤵
PID:988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5048 -ip 5048
1⤵
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5048 -ip 5048
1⤵
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5048 -ip 5048
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5048 -ip 5048
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5048 -ip 5048
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5048 -ip 5048
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5048 -ip 5048
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5048 -ip 5048
1⤵
PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5048 -ip 5048
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5048 -ip 5048
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5048 -ip 5048
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5048 -ip 5048
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5048 -ip 5048
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5048 -ip 5048
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5048 -ip 5048
1⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5048 -ip 5048
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5048 -ip 5048
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JbK0lvVvX.zip

Path C:\Users\Admin\AppData\Local\Temp\cjCahYnvtv6g\JbK0lvVvX.zip
Size 41KB
SHA256 baaa722926cc09300cdb40d78fddc5f43475219fb43bf76e5dbaf5d420acf25b
MD5 2f4b20993b279e6c2eed4e2c263341fc
SHA1 43d72f27631c0aac1caf9ed4db4490b77a2ed9c5
SHA512 d6989c606b842b4b7a59555181813210a709b5ec70369d853c29057618078272d262f469a30ae702da27c6e2a4b4d3e16a9433e13fb1aa5f87c3a6a2892a4f08
SSDEEP 768:NZaRFrmyvjgNf29TBdzRrcb0L2Eqk2Sq17Ecd9MQpUxIFmVAWPp/8+m:LaRZmujv9TBd9GY2EtnQ3UxI8VZp/vm
MD5 SHA1 SHA512 SSDEEP

Submit Download

LvZVmNVhjEQHj.zip

Path C:\Users\Admin\AppData\Local\Temp\cjCahYnvtv6g\LvZVmNVhjEQHj.zip
Size 41KB
SHA256 d585b64059311adde5c2501c58db81fe0f18c0eceb666198f134e4875a70f472
MD5 6d8c82364b853e11fb7208360cc5de2d
SHA1 034cf3c7328383091ff6045fe22deac603cb13cc
SHA512 249a580c10e8bc28bfbcb62e8fb928cfcc078c8fda19b52471db457ae4587bdbcc2503e3518f43671d36e65f62fa73994f2e1839ae544edb67c3ef64846f8999
SSDEEP 768:B6CZqZaRFrmyvjgNf29TBdzRrcb0L2Eqk2Sq17Ecd9MQpUxIFmVAWPp/8v:VZmaRZmujv9TBd9GY2EtnQ3UxI8VZp/w
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\cjCahYnvtv6g\_Files\_Information.txt
Size 7KB
SHA256 eb930ca3bdf212a0ecc98c620cd8fce56906f66c55eb6f1fa64c633a63b43505
MD5 3c15a8ee872ccab3a0600accb29330f5
SHA1 3712ccd37b43ca9b2485e535efd07506c5fa37ca
SHA512 97855763e585897bd367079bca3aaae38e6d3aa882bba729d789a85675f2a711bd37611b4faa5a3c6c395b094c72e998facc6ed9f5ed8eda17a1332342708e85
SSDEEP 96:s8kUteBindqDlQHchmcnmB4McIHOU846HzB+6cnhrcn1wcfzSByYO:10EdJR5b8Ub8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\cjCahYnvtv6g\_Files\_Screen_Desktop.jpeg
Size 46KB
SHA256 aecc7602e701b3c9e768f9ce74b762b6bfb63991bb3f564eefe517f7dd1be0b0
MD5 3b2d3ebe416d970e33db33c64d8fb4e6
SHA1 99edd6ff8384649f115f9338034ab5016a08b1ea
SHA512 44471234717b768309b7634ee541e109978d6e3d298502833453fb7fe8a7992ab94a044bd4159d40a1a077156a94de29c11575c338a64dcb11fe5edc25b8c648
SSDEEP 768:lc/mvzrQzCAmyOKx/FW7DyB/Iijz/kuaivMmxsD6cS6xNeeTVk:lL7rQzNmyTDeyY9i0mx9AxNVTC
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\cjCahYnvtv6g\files_\system_info.txt
Size 718B
SHA256 3710edde994177dc18e1de87a07406380d49f9451b49dbadee49e91b062e440d
MD5 ca28a1bd1e99d56060ae48a3ac38ddc7
SHA1 d90748ccd17db8742ab484d00237a7e930d910b4
SHA512 7991c7b191709cf46454bf8bc861fb05556b3517a10fcfc9fce5210830f779f199a99a167948b5557d992d85ed0643db90e3a930a9b6daa96ccb9c751e8f66c7
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\cjCahYnvtv6g\files_\system_info.txt
Size 4KB
SHA256 d472490a285913912e9bbacdc423fdcfec9dcd1caa90b24af234248de34d6d6c
MD5 35bcdc0dfa40eb9f9d763c58d948c5f8
SHA1 7f988d9dc177060d56a6febdc0df6b3d6cc221ab
SHA512 27109e120016105b8dbe5a8929756677bfe7f8e3f4603173fb38b64ae5611af98fb9dc8e4bbfa0a42285fda749875fdc72ca016a1ec8aa3c2c6910992c100625
SSDEEP 48:cKjjYte8xFLkVOhGYTQ5zeDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+A3t:x/YtewAhSDlQHchmcnmB4McIHOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\cjCahYnvtv6g\files_\system_info.txt
Size 7KB
SHA256 587fb53df3c3818df6a1085cdcf178d175b39ed4f23cd1cce62bd508e8e107da
MD5 48a2ffa272521bf50795d22d20b6cf37
SHA1 4285c5fbc2f7f9992b3f9c68a225b46d4999e082
SHA512 3a164f39263662d31304b76a069a5350bf4f8dc19956a210f29f0951928e5ae03c6dadb5f494989f361c4626c6fde75b98bb5424631c27bfd7b22aa44fee5b69
SSDEEP 96:x/YtewAhSDlQHchmcnmB4McIHOU846HzB+6cnhrcn1wcfzSByYO:xTthhR5b8Ub8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5048-1-0x0000000002EC0000-0x0000000002FC0000-memory.dmp

Download

memory/5048-207-0x0000000000400000-0x0000000002CC1000-memory.dmp

Download

memory/5048-209-0x0000000002EC0000-0x0000000002FC0000-memory.dmp

Download

memory/5048-212-0x0000000004A60000-0x0000000004B00000-memory.dmp

Download

memory/5048-3-0x0000000000400000-0x0000000002CC1000-memory.dmp

Download

memory/5048-2-0x0000000004A60000-0x0000000004B00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads