cryptbot | a9cbd47334607d4a1bb993b438c17072d0dc264aa620220556ea1818016b44e9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a94685b81ec768c7f935a04a3c91dee4.exe
Size 1.4MB
Sample240227-qrlmmshh89
SHA256 a9cbd47334607d4a1bb993b438c17072d0dc264aa620220556ea1818016b44e9
MD5 a94685b81ec768c7f935a04a3c91dee4
SHA1 f8226d782f14bf696368e52c5e24284662f4627f
SHA512 2f7908572983314d145c456d282f8a22f724d8f22993052cc147ba287551d12f5b9ff3feba65ded9fccc74f33136840d23fedd218eb1661e6b5ba20829084d05
SSDEEP 24576:auQEJzOJGGdJPa03vzMtUxNKbEVvfYaq16K2HLv6a4OegO6RabbMWr55N2n:akGXP3gt4bHFnbqmaHn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

knugzo71.top
moreag07.top

Attributes

payload_url
http://sarafc10.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral2/memory/1580-25-0x00000000042A0000-0x0000000004343000-memory.dmp	family_cryptbot
behavioral2/memory/1580-26-0x00000000042A0000-0x0000000004343000-memory.dmp	family_cryptbot
behavioral2/memory/1580-27-0x00000000042A0000-0x0000000004343000-memory.dmp	family_cryptbot
behavioral2/memory/1580-28-0x00000000042A0000-0x0000000004343000-memory.dmp	family_cryptbot
behavioral2/memory/1580-237-0x00000000042A0000-0x0000000004343000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
4416	Senza.exe.com
1580	Senza.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a94685b81ec768c7f935a04a3c91dee4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Senza.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Senza.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3692	PING.EXE

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4416	Senza.exe.com
4416	Senza.exe.com
4416	Senza.exe.com
1580	Senza.exe.com
1580	Senza.exe.com
1580	Senza.exe.com
1580	Senza.exe.com
1580	Senza.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4416	Senza.exe.com
4416	Senza.exe.com
4416	Senza.exe.com
1580	Senza.exe.com
1580	Senza.exe.com
1580	Senza.exe.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4856	4728	a94685b81ec768c7f935a04a3c91dee4.exe	89
PID 4728 wrote to memory of 4856	4728	a94685b81ec768c7f935a04a3c91dee4.exe	89
PID 4728 wrote to memory of 4856	4728	a94685b81ec768c7f935a04a3c91dee4.exe	89
PID 4728 wrote to memory of 2376	4728	a94685b81ec768c7f935a04a3c91dee4.exe	90
PID 4728 wrote to memory of 2376	4728	a94685b81ec768c7f935a04a3c91dee4.exe	90
PID 4728 wrote to memory of 2376	4728	a94685b81ec768c7f935a04a3c91dee4.exe	90
PID 2376 wrote to memory of 2968	2376	cmd.exe	92
PID 2376 wrote to memory of 2968	2376	cmd.exe	92
PID 2376 wrote to memory of 2968	2376	cmd.exe	92
PID 2968 wrote to memory of 1764	2968	cmd.exe	93
PID 2968 wrote to memory of 1764	2968	cmd.exe	93
PID 2968 wrote to memory of 1764	2968	cmd.exe	93
PID 2968 wrote to memory of 4416	2968	cmd.exe	95
PID 2968 wrote to memory of 4416	2968	cmd.exe	95
PID 2968 wrote to memory of 4416	2968	cmd.exe	95
PID 2968 wrote to memory of 3692	2968	cmd.exe	96
PID 2968 wrote to memory of 3692	2968	cmd.exe	96
PID 2968 wrote to memory of 3692	2968	cmd.exe	96
PID 4416 wrote to memory of 1580	4416	Senza.exe.com	97
PID 4416 wrote to memory of 1580	4416	Senza.exe.com	97
PID 4416 wrote to memory of 1580	4416	Senza.exe.com	97

C:\Users\Admin\AppData\Local\Temp\a94685b81ec768c7f935a04a3c91dee4.exe
"C:\Users\Admin\AppData\Local\Temp\a94685b81ec768c7f935a04a3c91dee4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\dllhost.exe
  dllhost.exe
  2⤵
  PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Attimi.aifc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^yDqUyhxxzNWwKdwAbDIfPkzxgDwEtBaAGnSfEDAWRaxEKOZtbqEBylNTlFFCjPfRcvckbLWUrLnbQOKmEXitXRxcKYyYXYKwrCphzNGLrJbzMdrvVuXgIlU$" Dovresti.aifc
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Senza.exe.com
      Senza.exe.com b
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Senza.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Senza.exe.com b
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1580
  - - C:\Windows\SysWOW64\PING.EXE
      ping QMWIRSIY -n 30
      4⤵
      Runs ping.exe
      PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Attimi.aifc

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Attimi.aifc
Size 523B
SHA256 b295f119653a8914793c54fbeeaa9ea4b5f1873207fb10d527be375e747d61ea
MD5 5e826a865041158ace16dd3466f3472c
SHA1 4ac19f076d3bb7b56909a0d47cebdb25deb1c75d
SHA512 70244de9752db2eeefe1704843edc514c0458872d3891aea68d3a9ab9be6a70e28eae47b476125f62ebcafa6b1d3d34b9874c7d103184073fbdf45d577cd6d76
MD5 SHA1 SHA512

Submit Download

Dovresti.aifc

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dovresti.aifc
Size 872KB
SHA256 f486c565c408fc9966ae86e4725b6eb77784436258d9b32895b292c4eee2dbd1
MD5 16adb1ec69cbbf7f8dafdb45eb5064b5
SHA1 5efc32643294b6934ea1d7fe679a6539c3f110d8
SHA512 6a9442e22f3b8f0db57f855f9dab9a34196e3636831aafcb510c7e1f058e737025111784aed8a051e97142c690adf8163672c135163ed80c69627271d883543a
SSDEEP 12288:vpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:vT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Luce.aifc

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Luce.aifc
Size 713KB
SHA256 a5a2a8e595add1a83e5831285751cbb7d58a88f601ce15b5244b3a7945063eef
MD5 39fa57122dc1b855ee7319fce010a948
SHA1 2fb0e3963df561781fc9161f22794f944e04a479
SHA512 bbde96b1aa8113c4effda8ba2d03efcb67fcab9ce977ed080534ef532fcb76e7f766a87a796960f8d1466f5e70e9db9eea35b8a8b0e16f3f281be9408c84be62
SSDEEP 6144:NBj5qGcY+Fu5onoMMONhcCma5JFnEfKiBoFvCL6WMmAnT6zmlyi/MJBE/L3bYTVN:b4hvFVZNIOnEi+oY4ezm4JI0yMV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rosa.aifc

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rosa.aifc
Size 634KB
SHA256 3c5a71e62db7bc35a2cb723ef9e53c60fafcf529694660478dff6a96b521f4eb
MD5 52e0aee784146494ed16807c5e70bca2
SHA1 0c3fdddf56cd1eac635fbf695c11d8f3138ee94e
SHA512 fb41438700491a2d760fdd111575fc221311513925d71248ee124fabd006f1b9dcab9bf1d457c87288cf5bfc9f9b7c830505b241e7e85cda3b08deaf081b2b0f
SSDEEP 12288:7emNB4m4n1phIbNxO7g9/yLwN8ORZw3gjTxrM+bd8rRg6kP:7vrV4ONKU6cJvwQRrbYaXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Senza.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Senza.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

VL3gDn7Ecb.zip

Path C:\Users\Admin\AppData\Local\Temp\cX0Ghvje1gP\VL3gDn7Ecb.zip
Size 42KB
SHA256 1528a2ef84c15abaf70d30ec2848c84c6113bc6e1ac67da1a338792f387bb571
MD5 35e0e8508981fc0317752d1c8bfd2997
SHA1 fd2f3443d6263424def10d566a7ce02d0bf28132
SHA512 2e722cdf3414255b22eaf1494fc6bfe264398adfa4ac58222fbee2217ec35c0f9aedd760dc7fc9875b764abbae074b3d8d92eb56507463792d13437fcce66ce8
SSDEEP 768:ziG2G+dQflUSf/phBZC+YBJkZNFOXr6Nfpa+cvUHWEeZJw:z12jQKSfj5YTkZeT3UHWEeZJw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZvVMJ8PWP.zip

Path C:\Users\Admin\AppData\Local\Temp\cX0Ghvje1gP\ZvVMJ8PWP.zip
Size 42KB
SHA256 872a429ed053f4eac6933608be2c8508ee41d7c8f82345b2f1cdcf13d8f65f17
MD5 7f0178a40809025963074d328ba5948e
SHA1 499711c37d81c6e02f2047b2f20ac04634981135
SHA512 47617b932048dc33700b1594abe7de8280e6ea8377d8d4f0f97c263e3f7c41d2479945994f9c2a63a171fce285ff4d0e7fc40596487f61a60c33777b91a03ff4
SSDEEP 768:mG2G+dQflUSf/phBZC+YBJkZNFOXr6Nfpa+cvUHWEeZJi:x2jQKSfj5YTkZeT3UHWEeZJi
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\cX0Ghvje1gP\_Files\_Information.txt
Size 1KB
SHA256 2cd670bae54b9a53f0b8a5be90f5ad5d5b84e266eb995a65dac3eb9536cd1c82
MD5 04e1fe9d5dc1c867adffff46b0e2d099
SHA1 9ec24e0874e86f951cea207a41e5d85b2c3dd0d4
SHA512 92a1ea7f3e00eb4025ca66cdcf7d3d202c73b9a23f54a59cebabf20093a112ba5c1c74cfd83e9a07d759477d0ca872d346aa6f1bf81ac972b43f686177d85d54
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\cX0Ghvje1gP\_Files\_Information.txt
Size 1KB
SHA256 c67c2689e1ebc7fd169ac1750ac84aa736556a5b26caaf441a6b49404bbbcd28
MD5 47b580afd77aef156bdfd705559ab05a
SHA1 b06b9ac0446c33ab0050536d97ce668af2559bfa
SHA512 80bc2972d55469fdcd9c5c3273f7a4ab13b981c00c8c7fd5ad881d0766ce5d82a3b6f63cb0a0ac5d63c1a62cea449554c2ebddb057cb8f40ddd38463bc1aeef4
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\cX0Ghvje1gP\_Files\_Information.txt
Size 4KB
SHA256 d084abbd2c2ab88bfe52ab5123f62c26a2639b980a5c627deec6d34fc70633ef
MD5 b69f052029ae287bc12e272a776ff157
SHA1 af23efd19e940915974158f232330c2de0b4bc23
SHA512 7b80ec9e7b4c08727ff737102e0602750a5e40d3a65d75acafbbdcdc6a96db0d40fd0e13dfda28ad5f7254f79ec0a3232a48364053e595a546c4823a6636adde
SSDEEP 48:sx1UteXxEaMevehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+AR:szUteBTPndqDlQHchmcnmB4McIHOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\cX0Ghvje1gP\_Files\_Screen_Desktop.jpeg
Size 48KB
SHA256 cb3c85a2017350a959fb32bb44aab5ba7fcb671fe5cdfde6ba9957bf42e28a97
MD5 d1813bff6dc7c7acddcd19380acab0a5
SHA1 03d231fecfb6df7ca4cfd2ebf46f845b41bbd4d8
SHA512 153fffb4ddc1f8c2f14d41adf49f835f902c2312dd7914d0123a5574f3d9176629b5604b17010c440ed280eb63411a013aa2904a0f655e0a7facc6bc3055ff44
SSDEEP 1536:lfbOMf9n1Rz+Olbd1J0E7S0pDWKG5qEtjeFBq:FbZf9n1Rz+cd1pNpiCQAw
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\cX0Ghvje1gP\files_\system_info.txt
Size 694B
SHA256 cb22a921058853953a3a1acfe6fc26e1b558b92cd24324c06d1910443d037597
MD5 76e998ca7b4ec65f347e22e81f98da19
SHA1 d2434609b37120663c5224c5dcb4bf3d477443d5
SHA512 c6dd58ec1846a3e7d309abfff75d9fcea2c3425c17fb6a4429a27a999d22576fb0efb8ce7b1d59ca58647fac37a0dec13e40433d80f2fbf9bab1a69fbd213c4b
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\cX0Ghvje1gP\files_\system_info.txt
Size 4KB
SHA256 2d01a84c973b84e0ea9a2198ab3479934dbd0579714a35b8c884916980323ccd
MD5 6c06ad35e3854eb21ce5e3e32b723501
SHA1 d2631db05cb8e85d8f10a3f7f0543d86a7ab9614
SHA512 c31ddf9baf6e0ea9cf5c0e875e369a508aa3f15138f00f27f80eaa19bcf5011a13f14d0c52896f4782508e343cdbe7b51c709c63197bbd5a08e1f11105b486f6
SSDEEP 48:cWYte8xq7vOhGYTQ5zeDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+A3ZN+m:tYtewufhSDlQHchmcnmB4McIHOUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1580-21-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/1580-28-0x00000000042A0000-0x0000000004343000-memory.dmp

Download

memory/1580-27-0x00000000042A0000-0x0000000004343000-memory.dmp

Download

memory/1580-26-0x00000000042A0000-0x0000000004343000-memory.dmp

Download

memory/1580-25-0x00000000042A0000-0x0000000004343000-memory.dmp

Download

memory/1580-24-0x00000000042A0000-0x0000000004343000-memory.dmp

Download

memory/1580-23-0x00000000042A0000-0x0000000004343000-memory.dmp

Download

memory/1580-237-0x00000000042A0000-0x0000000004343000-memory.dmp

Download

memory/1580-22-0x00000000042A0000-0x0000000004343000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads