cryptbot | 8c576d63eb9a7078f1a1eed320fa0ec6c660ca48002ae28c8699551428c12d50

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7e83a966721691aee8f57fd5cce3c90.exe
Size 1.4MB
Sample240227-b8d7kaea21
SHA256 8c576d63eb9a7078f1a1eed320fa0ec6c660ca48002ae28c8699551428c12d50
MD5 a7e83a966721691aee8f57fd5cce3c90
SHA1 ba51e0eef832b6d98a9fe25f99616e6b976c2a0c
SHA512 0b5c27940eceb06650d54ea0dbdbc363418fb0bc6d41ee638384362174ea27d5b9895dabe9ce2f2b19e678037d50009f46ee2ffaa10e29a398590e927612022b
SSDEEP 24576:OQB0+SyBqCEOmqdyv0oYY6IyS5qbLkq3TtdFF0NKiY10sQCl2tL:vB0zyBrEzqboYY6veqbLz3nIynQCli
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

ewazda75.top
moraiw07.top

Attributes

payload_url
http://winfyn10.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral1/memory/2620-28-0x0000000003B70000-0x0000000003C13000-memory.dmp	family_cryptbot
behavioral1/memory/2620-29-0x0000000003B70000-0x0000000003C13000-memory.dmp	family_cryptbot
behavioral1/memory/2620-30-0x0000000003B70000-0x0000000003C13000-memory.dmp	family_cryptbot
behavioral1/memory/2620-31-0x0000000003B70000-0x0000000003C13000-memory.dmp	family_cryptbot
behavioral1/memory/2620-251-0x0000000003B70000-0x0000000003C13000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
2576	Petali.exe.com
2620	Petali.exe.com

Loads dropped DLL 2 IoCs

pid	Process
2492	cmd.exe
2576	Petali.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a7e83a966721691aee8f57fd5cce3c90.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Petali.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Petali.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2760	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2620	Petali.exe.com
2620	Petali.exe.com

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2692	2184	a7e83a966721691aee8f57fd5cce3c90.exe	28
PID 2184 wrote to memory of 2692	2184	a7e83a966721691aee8f57fd5cce3c90.exe	28
PID 2184 wrote to memory of 2692	2184	a7e83a966721691aee8f57fd5cce3c90.exe	28
PID 2184 wrote to memory of 2692	2184	a7e83a966721691aee8f57fd5cce3c90.exe	28
PID 2184 wrote to memory of 1940	2184	a7e83a966721691aee8f57fd5cce3c90.exe	29
PID 2184 wrote to memory of 1940	2184	a7e83a966721691aee8f57fd5cce3c90.exe	29
PID 2184 wrote to memory of 1940	2184	a7e83a966721691aee8f57fd5cce3c90.exe	29
PID 2184 wrote to memory of 1940	2184	a7e83a966721691aee8f57fd5cce3c90.exe	29
PID 1940 wrote to memory of 2492	1940	cmd.exe	31
PID 1940 wrote to memory of 2492	1940	cmd.exe	31
PID 1940 wrote to memory of 2492	1940	cmd.exe	31
PID 1940 wrote to memory of 2492	1940	cmd.exe	31
PID 2492 wrote to memory of 2524	2492	cmd.exe	32
PID 2492 wrote to memory of 2524	2492	cmd.exe	32
PID 2492 wrote to memory of 2524	2492	cmd.exe	32
PID 2492 wrote to memory of 2524	2492	cmd.exe	32
PID 2492 wrote to memory of 2576	2492	cmd.exe	33
PID 2492 wrote to memory of 2576	2492	cmd.exe	33
PID 2492 wrote to memory of 2576	2492	cmd.exe	33
PID 2492 wrote to memory of 2576	2492	cmd.exe	33
PID 2492 wrote to memory of 2760	2492	cmd.exe	34
PID 2492 wrote to memory of 2760	2492	cmd.exe	34
PID 2492 wrote to memory of 2760	2492	cmd.exe	34
PID 2492 wrote to memory of 2760	2492	cmd.exe	34
PID 2576 wrote to memory of 2620	2576	Petali.exe.com	35
PID 2576 wrote to memory of 2620	2576	Petali.exe.com	35
PID 2576 wrote to memory of 2620	2576	Petali.exe.com	35
PID 2576 wrote to memory of 2620	2576	Petali.exe.com	35

C:\Users\Admin\AppData\Local\Temp\a7e83a966721691aee8f57fd5cce3c90.exe
"C:\Users\Admin\AppData\Local\Temp\a7e83a966721691aee8f57fd5cce3c90.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\dllhost.exe
  dllhost.exe
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Tutti.accdb
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^fzEVfEZxZyWaHJahPhkKxbITVjLVhHUeuxXIUhljYhhMpNoRgBVcfFHSLKZrTtuakUkhMJaCrYLupVJir$" Gambe.accdb
      4⤵
      PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Petali.exe.com
      Petali.exe.com i
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Petali.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Petali.exe.com i
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:2620
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 30
      4⤵
      Runs ping.exe
      PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\71pmaGrDB\_Files\_Information.txt
Size 6KB
SHA256 108d5782cda2d0d875a3aad4fd599ec9a7a58607fd840781961d4cefd9e6bf86
MD5 2e5f58507fd96fb5b56c02a83225735e
SHA1 4782d0312dcf6149abe1bc545c4582f4084bb5ff
SHA512 135b98bd064cdfa767ec285b1dbec2b949e8b2198371d306c8201bccc1da68a35db9f68984d4cf979ef7715ea2527a3a15b3aa3c4cdf60ca2ec9a5852b981dda
SSDEEP 192:dPw93BUGdGGh8GBG1GoGHGwGrGFjG9GXGaGb:dPY3BUGdG+8GBG1GoGHGwGrGFjG9GXGf
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\71pmaGrDB\_Files\_Screen_Desktop.jpeg
Size 46KB
SHA256 e31b9fea313439a873c87cba3c8cc46e7ef39c9991719e81056639d15d944e70
MD5 9fda2d433ab9736ea94bf408bc642251
SHA1 05daf67f611d757cec616c6e4ea300f570341c21
SHA512 fe6df8c778cb4e92cec580f7802409f4c2b06cc8b8fb6d248bf80a2b1a92ebf27b2f0e548a10c96b63a3231633a11459a151c101abb5d12ee805af3295bc5a56
SSDEEP 768:lXKdnRCTcweFDFqfVqmWhJScVVMf2N+TB7hHmjy7ty:la+A3F8rkocVVM71bA
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\71pmaGrDB\files_\system_info.txt
Size 2KB
SHA256 e9704d08a66ef9ee553d989420dc5e213b9f3b6f306b5090e3712b7c36a98d79
MD5 d23f6f6d039d0bb6ed0f81e3fe383bef
SHA1 f6c71020d0003e44cba1b4eaf052c8181bfd9d0f
SHA512 e99c8be8bf8ea74e6d70db7ec6adb3f7ddb38dd239adefbb2c6cdf78711da34bcfb97db3706c683756763af39f5bb0d0fd633178d094e7190b0e39afdf133d83
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\71pmaGrDB\files_\system_info.txt
Size 8KB
SHA256 951368638e463e7cd775f24e02786576b87238c3672463a09f7359534dfde21c
MD5 04a64fa6fb2a34edc4a38584ba9a37e6
SHA1 e06860eb4188382e50868f0793d760948a18d7a9
SHA512 7cf2c253646d5ee8b3f09154fc6534d401c106c5a39d13c77399163bee30b75353a70b6d7a2598f496f303f3cdfd623175ff44e4e0253d58fb33bdba69df19b4
SSDEEP 192:2zs93BUGdGGh8GBG1GoGHGwGrGFjG9GXGaGQGtGYGKbe:2zM3BUGdG+8GBG1GoGHGwGrGFjG9GXGc
MD5 SHA1 SHA512 SSDEEP

Submit Download

xD0hKfS0jJ.zip

Path C:\Users\Admin\AppData\Local\Temp\71pmaGrDB\xD0hKfS0jJ.zip
Size 39KB
SHA256 08b89196ae36a7b39fcd8cc92e978a4f4b3d76f3de7de8d0d1f13bf9bfd44f44
MD5 3a348d9d77beaa4e2e97002687978603
SHA1 79f72e4bc48e2cabc89d51de357efb7b1b8d5fd9
SHA512 2a155c627b3a082c5ca518fa225bdb72aebec5467fad3eea8c260d4d80dc044625ccfe79a858754c43ac847c8737d98541c56a37df760c4b438180b1cd9058ae
SSDEEP 768:U5q7/75qyoGFbkO7Htj7BjZr0gpwqAlqhaALg6H+l3BJX8A948:HkyoGF9t/HrBWqQa/H83rsAB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chi.accdb

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Chi.accdb
Size 685KB
SHA256 bb1f6e48c7090593ccefae715a3f1954f3b5e508658d610a1bc4419b67f3ec31
MD5 b08ad3bfee5c224fa1fb989b1e35a9c5
SHA1 6fa4c83df6456cdfbba9da1eb9fd86b69a80c1ac
SHA512 82ac31ba234315b3df953256ec50d234263b9d245965b8d392c4402a74e0f45fa0165a503aa9d39726d7475a3f8425c7344782782e841a18b32937772250245d
SSDEEP 6144:skp/7U7ncsS1eclO7NekG863qQyRRSBmiyr1cZdTnjqrZoS/zXfok4Oe/eEjGaD:sJjS1eMOBwvWuwzXfpM/VSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ero.accdb

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ero.accdb
Size 634KB
SHA256 445336938500a4dc12e495c3e349e707da957933d6a099fa65554e6ee7df255e
MD5 12f8c5b1225509a339dee58a9e98f243
SHA1 85b5b6db7c805ad8b8495ca2aa357a18e8a5464c
SHA512 2394e6fb04d25a72be0fb82b42dc68e47b2d5d1ed119bdd66a6ea10f47e215dcd2db33b645d584e7528a8837dbcd6391a36e8cce2d5ea939556e8653c6c46411
SSDEEP 12288:eiTGummu0vVUFXu7CcC6uOKVwFQYf5CeZ6C6WcknJFXNUbhwpvo:edlmFv2FWCiKVwT5C/Cddfo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gambe.accdb

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gambe.accdb
Size 872KB
SHA256 4120219c48a4c4c57dd0890c54af8364d11701d6fae3b0e3e9a0ea62b3ea2c99
MD5 8892bbb1bb5c6bbccba8809e67544dba
SHA1 4c6df9417a5508e462f3b53e3fb6b4c7c903a173
SHA512 ddf54419eeb39f3f7b0f517965c4dbf48bdcc174f407a619efa25352d59cf4e00d5db17dbdd2b56c1d4d9a8ff6d6c27ac307a57998694510b4723a38d03cfeba
SSDEEP 12288:IpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:IT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Petali.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Petali.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tutti.accdb

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tutti.accdb
Size 468B
SHA256 c76b983f3a62efbe884f2ed86c9acb88936c9c85cf3842ee1c7ee991a49164bd
MD5 ce2662e17b3b46e81f7d4b3da660a562
SHA1 879f2e989d9cf8c35712995ed7c4a943291f43e4
SHA512 27344517321dfa571899055498ec276384880a3a929b20346b9ddfe98182ef83a4766bc33fd186ff533df15b122c93e314fb8e35abee87b38152e1c681876795
MD5 SHA1 SHA512

Submit Download

memory/2620-24-0x0000000000150000-0x0000000000151000-memory.dmp

Download

memory/2620-30-0x0000000003B70000-0x0000000003C13000-memory.dmp

Download

memory/2620-31-0x0000000003B70000-0x0000000003C13000-memory.dmp

Download

memory/2620-32-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/2620-29-0x0000000003B70000-0x0000000003C13000-memory.dmp

Download

memory/2620-28-0x0000000003B70000-0x0000000003C13000-memory.dmp

Download

memory/2620-27-0x0000000003B70000-0x0000000003C13000-memory.dmp

Download

memory/2620-25-0x0000000003B70000-0x0000000003C13000-memory.dmp

Download

memory/2620-251-0x0000000003B70000-0x0000000003C13000-memory.dmp

Download

memory/2620-252-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/2620-26-0x0000000003B70000-0x0000000003C13000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads