cryptbot | 8c576d63eb9a7078f1a1eed320fa0ec6c660ca48002ae28c8699551428c12d50

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7e83a966721691aee8f57fd5cce3c90.exe
Size 1.4MB
Sample240227-b8d7kaea21
SHA256 8c576d63eb9a7078f1a1eed320fa0ec6c660ca48002ae28c8699551428c12d50
MD5 a7e83a966721691aee8f57fd5cce3c90
SHA1 ba51e0eef832b6d98a9fe25f99616e6b976c2a0c
SHA512 0b5c27940eceb06650d54ea0dbdbc363418fb0bc6d41ee638384362174ea27d5b9895dabe9ce2f2b19e678037d50009f46ee2ffaa10e29a398590e927612022b
SSDEEP 24576:OQB0+SyBqCEOmqdyv0oYY6IyS5qbLkq3TtdFF0NKiY10sQCl2tL:vB0zyBrEzqboYY6veqbLz3nIynQCli
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

ewazda75.top
moraiw07.top

Attributes

payload_url
http://winfyn10.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral2/memory/5052-25-0x0000000004040000-0x00000000040E3000-memory.dmp	family_cryptbot
behavioral2/memory/5052-26-0x0000000004040000-0x00000000040E3000-memory.dmp	family_cryptbot
behavioral2/memory/5052-27-0x0000000004040000-0x00000000040E3000-memory.dmp	family_cryptbot
behavioral2/memory/5052-28-0x0000000004040000-0x00000000040E3000-memory.dmp	family_cryptbot
behavioral2/memory/5052-237-0x0000000004040000-0x00000000040E3000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
4324	Petali.exe.com
5052	Petali.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a7e83a966721691aee8f57fd5cce3c90.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Petali.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Petali.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4004	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5052	Petali.exe.com
5052	Petali.exe.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3844	3200	a7e83a966721691aee8f57fd5cce3c90.exe	86
PID 3200 wrote to memory of 3844	3200	a7e83a966721691aee8f57fd5cce3c90.exe	86
PID 3200 wrote to memory of 3844	3200	a7e83a966721691aee8f57fd5cce3c90.exe	86
PID 3200 wrote to memory of 4584	3200	a7e83a966721691aee8f57fd5cce3c90.exe	87
PID 3200 wrote to memory of 4584	3200	a7e83a966721691aee8f57fd5cce3c90.exe	87
PID 3200 wrote to memory of 4584	3200	a7e83a966721691aee8f57fd5cce3c90.exe	87
PID 4584 wrote to memory of 4172	4584	cmd.exe	89
PID 4584 wrote to memory of 4172	4584	cmd.exe	89
PID 4584 wrote to memory of 4172	4584	cmd.exe	89
PID 4172 wrote to memory of 1620	4172	cmd.exe	91
PID 4172 wrote to memory of 1620	4172	cmd.exe	91
PID 4172 wrote to memory of 1620	4172	cmd.exe	91
PID 4172 wrote to memory of 4324	4172	cmd.exe	92
PID 4172 wrote to memory of 4324	4172	cmd.exe	92
PID 4172 wrote to memory of 4324	4172	cmd.exe	92
PID 4172 wrote to memory of 4004	4172	cmd.exe	93
PID 4172 wrote to memory of 4004	4172	cmd.exe	93
PID 4172 wrote to memory of 4004	4172	cmd.exe	93
PID 4324 wrote to memory of 5052	4324	Petali.exe.com	95
PID 4324 wrote to memory of 5052	4324	Petali.exe.com	95
PID 4324 wrote to memory of 5052	4324	Petali.exe.com	95

C:\Users\Admin\AppData\Local\Temp\a7e83a966721691aee8f57fd5cce3c90.exe
"C:\Users\Admin\AppData\Local\Temp\a7e83a966721691aee8f57fd5cce3c90.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\dllhost.exe
  dllhost.exe
  2⤵
  PID:3844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Tutti.accdb
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^fzEVfEZxZyWaHJahPhkKxbITVjLVhHUeuxXIUhljYhhMpNoRgBVcfFHSLKZrTtuakUkhMJaCrYLupVJir$" Gambe.accdb
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Petali.exe.com
      Petali.exe.com i
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Petali.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Petali.exe.com i
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:5052
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 30
      4⤵
      Runs ping.exe
      PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chi.accdb

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Chi.accdb
Size 685KB
SHA256 bb1f6e48c7090593ccefae715a3f1954f3b5e508658d610a1bc4419b67f3ec31
MD5 b08ad3bfee5c224fa1fb989b1e35a9c5
SHA1 6fa4c83df6456cdfbba9da1eb9fd86b69a80c1ac
SHA512 82ac31ba234315b3df953256ec50d234263b9d245965b8d392c4402a74e0f45fa0165a503aa9d39726d7475a3f8425c7344782782e841a18b32937772250245d
SSDEEP 6144:skp/7U7ncsS1eclO7NekG863qQyRRSBmiyr1cZdTnjqrZoS/zXfok4Oe/eEjGaD:sJjS1eMOBwvWuwzXfpM/VSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ero.accdb

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ero.accdb
Size 634KB
SHA256 445336938500a4dc12e495c3e349e707da957933d6a099fa65554e6ee7df255e
MD5 12f8c5b1225509a339dee58a9e98f243
SHA1 85b5b6db7c805ad8b8495ca2aa357a18e8a5464c
SHA512 2394e6fb04d25a72be0fb82b42dc68e47b2d5d1ed119bdd66a6ea10f47e215dcd2db33b645d584e7528a8837dbcd6391a36e8cce2d5ea939556e8653c6c46411
SSDEEP 12288:eiTGummu0vVUFXu7CcC6uOKVwFQYf5CeZ6C6WcknJFXNUbhwpvo:edlmFv2FWCiKVwT5C/Cddfo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gambe.accdb

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gambe.accdb
Size 872KB
SHA256 4120219c48a4c4c57dd0890c54af8364d11701d6fae3b0e3e9a0ea62b3ea2c99
MD5 8892bbb1bb5c6bbccba8809e67544dba
SHA1 4c6df9417a5508e462f3b53e3fb6b4c7c903a173
SHA512 ddf54419eeb39f3f7b0f517965c4dbf48bdcc174f407a619efa25352d59cf4e00d5db17dbdd2b56c1d4d9a8ff6d6c27ac307a57998694510b4723a38d03cfeba
SSDEEP 12288:IpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:IT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Petali.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Petali.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tutti.accdb

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tutti.accdb
Size 468B
SHA256 c76b983f3a62efbe884f2ed86c9acb88936c9c85cf3842ee1c7ee991a49164bd
MD5 ce2662e17b3b46e81f7d4b3da660a562
SHA1 879f2e989d9cf8c35712995ed7c4a943291f43e4
SHA512 27344517321dfa571899055498ec276384880a3a929b20346b9ddfe98182ef83a4766bc33fd186ff533df15b122c93e314fb8e35abee87b38152e1c681876795
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\vhBAh5FA\_Files\_Information.txt
Size 1KB
SHA256 539f747d613832e766106a6db8f5d494bd1a010a7f80e8fdaa93c2498ee5fc6c
MD5 1c8adf53ee4d79e9fb80895125ada22a
SHA1 da82302f84904c903d46ffbbcbbc282208bc8108
SHA512 c1674d03ba33c426a7aa825e3c674713c8403be19d1cc7b5844b1e888c15aac94d5620c3a75cb94239f3464625aa968e2662b3f2b535eed1fd4d2226f8d74878
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\vhBAh5FA\_Files\_Information.txt
Size 3KB
SHA256 a110a30e403b592dd824a567a21b43604a11b85a1274ca941dc9df2989122f35
MD5 3ccc36e288bc93778c2b740d9a84d605
SHA1 bea5a9acb508e59d64ddfd2f39e71a8348a6c735
SHA512 e3f938542ce6a1d894b47c2f302b03388e6dce42d3d708ad0e73ec4556116564bad75b6ce752e13318dee15f7048a51e6b9be2f84be846aaea7448bdad8c0c22
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\vhBAh5FA\_Files\_Information.txt
Size 4KB
SHA256 76717ff22115a177a974c6cb8bd374fad0052b919fa5fa6483a4b1ba91e4c785
MD5 761bacab9a22b37d5ce5cffbc1a9a257
SHA1 f0af65bec9e8100079ee03439db714b9b0fbd2aa
SHA512 849515539fbd396e2176fd4db169ee4b075016b8f9c2fca4c060c68f22b40d89d32d0ef01b436d772d080810712a11d579324e03b4fb19e62449dc07031c134e
SSDEEP 48:sxDUteXxOemaMAehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+6:sVUteBHzndqDlQHchmcnmB4McIHOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\vhBAh5FA\_Files\_Screen_Desktop.jpeg
Size 47KB
SHA256 d13fa9899108d1e58ab7292861602744564d2311c420e01a3859582c8798d233
MD5 7b48ec6ea626647118907fabd6189a46
SHA1 cedaf14a00607808681b150dd18fa5390c24d596
SHA512 81fa06b2c8db1523ba2fa594c953b24d7519d913ce085c45389882ea5f1619ee47c4b1366dd4cff1421ed97dbd78bc8b2360bc4b6dc07631d147d50c6b5710e2
SSDEEP 768:lux0GPzQs2PJTddam21RMEYQEIqHUHqgyjJD2Zoxey/brTr6/JkocZeRWjhq/S3W:lnGPV2PNddXZEPEn0K/2G0UH6RmZBtqB
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\vhBAh5FA\files_\system_info.txt
Size 1KB
SHA256 ab4fdd636fc6c3504e951b69b77d31f4503f1eca5de9ba47f5d7e5b28fa1f194
MD5 82183c3fd995ee0828a62c2a1ef5a5da
SHA1 44839a06ef1653af46a7a552f690909dcabc33b9
SHA512 59ced1e2c6c328f37457151c8a0b4458df5627b277961af7698e5ffb2a57ff27d62fc0557879590d0f5cb947c24eb8d568382b54b9ab2c00bbb984780e2bb955
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\vhBAh5FA\files_\system_info.txt
Size 7KB
SHA256 b08772a1c1b4251a294506287cb445cc95c349872261e36e63a25a4e7beb73e1
MD5 ac39a24d835d7befa183485af7aa25e6
SHA1 a05ed6539486a4fbaf5186622117d97747ad6e38
SHA512 8bc292df99b296d98e7a4ec1b2edc120b72b03e2163d2df6ee3bcf4793dbd523ce53b6f8712cdf60c4b9e73e35e9bb62928951c0c2eb8869073800b960b410f5
SSDEEP 96:TYtew8hSDlQHchmcnmB4McIHOUY46HzB+6cnhrcn1wcfzSByYO:vxhhR5bQUb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

gkCJmhMTerH.zip

Path C:\Users\Admin\AppData\Local\Temp\vhBAh5FA\gkCJmhMTerH.zip
Size 40KB
SHA256 dd393c02dfb661248dc8bb2a261a988a8dcc7d2d45ba4284e355638f6a58226e
MD5 3b6836c8407b03f6b245902012351849
SHA1 a1a1961e112f762ca882304db0281e7d9542bdc0
SHA512 5bc9ab07fd20e66e1cda8ab583efcbea969cafcc74a2633c04f9509aee4d8e3ee36cf1fc60f17fc3947df226e05daa5783904643a0e33e5e1087984b97f79ab7
SSDEEP 768:7AkuTDBLvJuduh+k9UD/262HClF5QA4+h/5rM+j57ZrWeS4oxTuhf83XA0:HUFNVU5+9A4+hhX1Wt4Ay63XA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

pXnsSUh86ZjH.zip

Path C:\Users\Admin\AppData\Local\Temp\vhBAh5FA\pXnsSUh86ZjH.zip
Size 40KB
SHA256 6326de20b135f51af2c92d8e5fd7d591887b0754a2ae1aa41467127db354b5f8
MD5 a795d4956ed1df6df5eefd30ff6a9fb7
SHA1 1da1eaefcf387627e825248cf9800bed5df6d533
SHA512 015b41c8b9d704d25da4d16d332b198d2f059d5b51653e05cec761f5684a9690ffe7af6234f6f1ff2ef6bce628f5bd8a76b8584e3df6a52672b9c20c1c008466
SSDEEP 768:bkuTDBLvJuduh+k9UD/262HClF5QA4+h/5rM+j57ZrWeS4oxTuhf83XAls9:IUFNVU5+9A4+hhX1Wt4Ay63XAls
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5052-21-0x0000000001230000-0x0000000001231000-memory.dmp

Download

memory/5052-28-0x0000000004040000-0x00000000040E3000-memory.dmp

Download

memory/5052-27-0x0000000004040000-0x00000000040E3000-memory.dmp

Download

memory/5052-26-0x0000000004040000-0x00000000040E3000-memory.dmp

Download

memory/5052-25-0x0000000004040000-0x00000000040E3000-memory.dmp

Download

memory/5052-24-0x0000000004040000-0x00000000040E3000-memory.dmp

Download

memory/5052-23-0x0000000004040000-0x00000000040E3000-memory.dmp

Download

memory/5052-237-0x0000000004040000-0x00000000040E3000-memory.dmp

Download

memory/5052-22-0x0000000004040000-0x00000000040E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads