cryptbot | e7c90c063390ac4ea029710361c1f701a7e0ce3c7ac48c0200b2c0a40d556844

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c246376b276edf4bd3800999bcdbd8b.exe
Size 1.4MB
Sample240214-t174safe6w
SHA256 e7c90c063390ac4ea029710361c1f701a7e0ce3c7ac48c0200b2c0a40d556844
MD5 9c246376b276edf4bd3800999bcdbd8b
SHA1 baaa4ee8d86277ce9b4c2e8545f26b8ec4214ff5
SHA512 61deb8ba8ede3250605bdb6a893cdfe16aae7a93c2da05fb74976a79c443b4b3c39255e8c0fbdc04e9bd69b67516efa5973efc04283e7118eefa4552fbb48734
SSDEEP 24576:/0bsPpigjXnPv9IhXZ4h8yEHgFctZgBMOp9TIkgkjUicrFXlo/cwVI9Vt:sbsPZXPlaOyyCqctZgx9WrIcV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

ewaisb31.top
morxeg03.top

Attributes

payload_url
http://winxob04.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral1/memory/3100-26-0x0000000004F30000-0x0000000004FD3000-memory.dmp	family_cryptbot
behavioral1/memory/3100-27-0x0000000004F30000-0x0000000004FD3000-memory.dmp	family_cryptbot
behavioral1/memory/3100-28-0x0000000004F30000-0x0000000004FD3000-memory.dmp	family_cryptbot
behavioral1/memory/3100-29-0x0000000004F30000-0x0000000004FD3000-memory.dmp	family_cryptbot
behavioral1/memory/3100-236-0x0000000004F30000-0x0000000004FD3000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
4072	Avevano.exe.com
3100	Avevano.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9c246376b276edf4bd3800999bcdbd8b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Avevano.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Avevano.exe.com

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3100	Avevano.exe.com
3100	Avevano.exe.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1748	1844	9c246376b276edf4bd3800999bcdbd8b.exe	84
PID 1844 wrote to memory of 1748	1844	9c246376b276edf4bd3800999bcdbd8b.exe	84
PID 1844 wrote to memory of 1748	1844	9c246376b276edf4bd3800999bcdbd8b.exe	84
PID 1844 wrote to memory of 2896	1844	9c246376b276edf4bd3800999bcdbd8b.exe	86
PID 1844 wrote to memory of 2896	1844	9c246376b276edf4bd3800999bcdbd8b.exe	86
PID 1844 wrote to memory of 2896	1844	9c246376b276edf4bd3800999bcdbd8b.exe	86
PID 2896 wrote to memory of 2140	2896	cmd.exe	88
PID 2896 wrote to memory of 2140	2896	cmd.exe	88
PID 2896 wrote to memory of 2140	2896	cmd.exe	88
PID 2140 wrote to memory of 2072	2140	cmd.exe	89
PID 2140 wrote to memory of 2072	2140	cmd.exe	89
PID 2140 wrote to memory of 2072	2140	cmd.exe	89
PID 2140 wrote to memory of 4072	2140	cmd.exe	90
PID 2140 wrote to memory of 4072	2140	cmd.exe	90
PID 2140 wrote to memory of 4072	2140	cmd.exe	90
PID 2140 wrote to memory of 2076	2140	cmd.exe	91
PID 2140 wrote to memory of 2076	2140	cmd.exe	91
PID 2140 wrote to memory of 2076	2140	cmd.exe	91
PID 4072 wrote to memory of 3100	4072	Avevano.exe.com	92
PID 4072 wrote to memory of 3100	4072	Avevano.exe.com	92
PID 4072 wrote to memory of 3100	4072	Avevano.exe.com	92

C:\Users\Admin\AppData\Local\Temp\9c246376b276edf4bd3800999bcdbd8b.exe
"C:\Users\Admin\AppData\Local\Temp\9c246376b276edf4bd3800999bcdbd8b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c twctb
  2⤵
  PID:1748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Ero.xlsx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^WrvhTZxwllMbJlwpSgYvrvWTdYqHcYFYZnbsprCkvPiYzcdNDSpAGRpAuCXVZNGkENblNJqOLNqhgXAUHjrCOysifWkGuHkJ$" Mossa.xlsx
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Avevano.exe.com
      Avevano.exe.com S
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Avevano.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Avevano.exe.com S
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:3100
  - - C:\Windows\SysWOW64\choice.exe
      choice /C YN /D Y /t 30
      4⤵
      PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Afa.xlsx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Afa.xlsx
Size 759KB
SHA256 9a67ec53e2cf2856c0f768ec8d841b9ce525d637c6280c24bbd3dd02caaf55a6
MD5 336d83f68ac29b0d8c9ed1114687c974
SHA1 6f2f555b2c36c25e1374dcaf948d75a2ff715e19
SHA512 ca4713b47f4dcf5f226e3355663407107096e0e26c186bf64c42e81dcbd582ab8491e2e64cf1ba6fa17f0bbfdd0204269f6bf4523642e6560bed5e6b3c7076c4
SSDEEP 12288:L78Tr0Vicsd//ss35qEzNz7V8X2Z/7sb6jvIP+oW0Wpji1u3wV9+mm:fw0A//rx8X3j1YF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Animazione.xlsx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Animazione.xlsx
Size 634KB
SHA256 8480e8b274304c1bebe3032462cb88be0cf344bb674b2941ec1f759f4363500e
MD5 e76cefed6bf0853d0bd3ebd47c6c0b54
SHA1 9efee9e1530f088dff1cab38d2d858c3caf66689
SHA512 795b902c0aecef5e54dcaa4f8f78c970f8c2482e5712f1961d5e8b6b3c131d2e8fb1a64b8d0bfc6a791cfccc884242d07517a7bc9597c8588f7088519d09508a
SSDEEP 12288:p1QdMKMOo36T9rYfspTkRUlZYDtVrFk2ouk4/Ynn3IzJIV7/X2:3eNMOM6TB9FkRUW3rFxC4/cY9IFv2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Avevano.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Avevano.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ero.xlsx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ero.xlsx
Size 412B
SHA256 4c409b1fb0512232196d4736419684137aaf0381db2a374ed0bb8f7f8845cc95
MD5 be0eecba29d212cb8fa794f6cdc410a9
SHA1 fd80987ca6bbb3c2979672ec50c027387f92f13c
SHA512 8482d89e41743a4104f65324659203b8fed6831b94df148e8e15f73d9b4b3de57c08b6ea40e924f41eca8d42d4d559e0470763872ea6a023884a7cb720c35597
MD5 SHA1 SHA512

Submit Download

Mossa.xlsx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mossa.xlsx
Size 872KB
SHA256 cec4425082b020a617714221ab542c8585dc481195242d681a9436fe8e1a388a
MD5 b3818489c206e21ff4b697f419754a56
SHA1 f8e4ff07615ce4ba12755a0fad4c5a462e2316bc
SHA512 5139b0d80c10610082845448ce5cf3a18d78d6e326bb11295d7fb295ea94d1c1ea7b946650287cd3f1cef85400a6fc84be75b48f551bbddc1c529fe3815b261a
SSDEEP 12288:kpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:kT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

SO5Uo8YJ5ixjZ.zip

Path C:\Users\Admin\AppData\Local\Temp\b4HsT85NPMWO\SO5Uo8YJ5ixjZ.zip
Size 43KB
SHA256 1bed6bc799e7735eb173afb642ed669e8cae2a5e97af30b80bf54fffa479513a
MD5 ba6808e644fb4aa1edc8269b0333877b
SHA1 09f88565df46d5abf1c3a516f1dcea1f095c3950
SHA512 13aafba44adfc18f76904e631f9261462a9ab3c7e5d2ade7dd4d240c68dcd0618a2827dc056f90c997d786b3b674ffdf01bccb5be540914f22d570dd3882cf92
SSDEEP 768:imao1L+XDOdM255ut2uynHppdwXa9Q2s4LL8fkS5GNJG8iLe:ikE6b5uMFHnUWBLA8/Jl2e
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\b4HsT85NPMWO\_Files\_Information.txt
Size 1KB
SHA256 a3e0effbb32112dfa2b612d06f091071ff4ed6b2498b38122a2ae3707284ad5e
MD5 d2c1acfe45a426dfc0c8a2c4863098df
SHA1 8e3374b2f817169f84fc467cdebd320d2e12e35f
SHA512 9b945d9e89bcf65725e38ea349f16fc092a4e4258585c184e8892f10309353eec3a6ab2f2b4127beb121a955082e9f98410d340dcfbff4792e44e625dbbbe3ab
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\b4HsT85NPMWO\_Files\_Information.txt
Size 1KB
SHA256 20aa2b7c3b98f3afc816694eb91301340fce98e03ce633cd50bc6567634438a3
MD5 f81397821a8868dd7c725c53c4ad7827
SHA1 7f2e377bcf87f8b843ac68bc904e1260f94ec1b3
SHA512 9456984451240aae9a8d0eed54cef142777f24bd7f164a171e88d7a9e88faa0dcd1eabf2f4b63ed74d451b92789b866c4dfc04c3dd2ef27962fe3797f3ae5b3f
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\b4HsT85NPMWO\_Files\_Information.txt
Size 4KB
SHA256 f9d242a05227404695d1068e91f17d12064c1453ef0cbdf0e28e173758b015aa
MD5 c0bb5cd7cca2f4e9c55ca41fe5d4d60b
SHA1 beec0da654a1e73815489a0d0ae9d0f527931397
SHA512 c4154b22638803ce47544557851e531a09830a9b6f77113013512c89ad300f9f1b218737cb0c0a9add8a958a330ad5373f758cd3d1b83eb7ef5de284dbc8ce03
SSDEEP 48:sxaUteXx7waMVehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+AR:scUteB+ndqDlQHchmcnmB4McIHOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

screenshot.jpg

Path C:\Users\Admin\AppData\Local\Temp\b4HsT85NPMWO\files_\screenshot.jpg
Size 49KB
SHA256 bfb6b366497e543838b9f232095ceeef50e7a0b1a121079da131ce545a2e6ec2
MD5 124e2c65b6029b7d83bd959f85a28ccf
SHA1 e191e4edb554c5d5b909e07c4bc7c443c687c72d
SHA512 aa7d0f82306dd5feb7aae641ae449e301d812aa87b745e670c1ef9430457dd6a16e110e3f98bc19195bf9420385f0e407cfd3ed411549212a8c660b130ad9102
SSDEEP 1536:lDu+xN6p6z4He1mfw2aMNkcnkIliiO+kkkkkkkkkju:dTxN6p6zLAwDM1kIzOPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\b4HsT85NPMWO\files_\system_info.txt
Size 5KB
SHA256 1d8191f6e2f1368497a84ae3f41c7e47c13382653335b7e3ccee765317b7ca80
MD5 bebf7f6b3b165569ded23e5c23646ee1
SHA1 b03a1eca019aa40e298a07e58a29196cb630cc30
SHA512 6bb760b462fa1d121da4e2246cc6bf045316f35387c0196313fbbb7f957f630853bc9c4df5da1a32e333755236995aa761b334d1af64d14d3054fae0873d9d1c
SSDEEP 96:aYteworhSDlQHchmcnmB4McIHOUE646HzB+6cnb:G9rhhR5bng
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3100-22-0x00000000013D0000-0x00000000013D1000-memory.dmp

Download

memory/3100-29-0x0000000004F30000-0x0000000004FD3000-memory.dmp

Download

memory/3100-28-0x0000000004F30000-0x0000000004FD3000-memory.dmp

Download

memory/3100-27-0x0000000004F30000-0x0000000004FD3000-memory.dmp

Download

memory/3100-26-0x0000000004F30000-0x0000000004FD3000-memory.dmp

Download

memory/3100-25-0x0000000004F30000-0x0000000004FD3000-memory.dmp

Download

memory/3100-24-0x0000000004F30000-0x0000000004FD3000-memory.dmp

Download

memory/3100-23-0x0000000004F30000-0x0000000004FD3000-memory.dmp

Download

memory/3100-236-0x0000000004F30000-0x0000000004FD3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads