cryptbot | 1d07bf7984822e6421852a7ce61b765f344fd7cc7ac8597ef91a00bf4c55d8cb

Analysis

max time kernel
155s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b016187f2f4b23b676b6e7d21b2be6c1.exe
Size 1.3MB
Sample240301-ct5lmsae81
SHA256 1d07bf7984822e6421852a7ce61b765f344fd7cc7ac8597ef91a00bf4c55d8cb
MD5 b016187f2f4b23b676b6e7d21b2be6c1
SHA1 81afd90ef5279af3f92e9bdcbafdd35f7775e928
SHA512 b5fa40f388307eb48068eada8b8bce14ac6bae5868f21526052661ecf2ab5113d4ec69b22f1089cccdf9447fb405494806de21f0840800b53175519199cb7b1e
SSDEEP 24576:Ado2Ir16CtHXxaZ22QJtJ+xhxs1Vl5wqAuq7Cf/QX7dvE192/y:5FuPQJtgxs1VlAt7CfmZvE19u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

bunbeq17.top
morkix01.top

Attributes

payload_url
http://tobdol01.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral2/memory/4184-22-0x0000000000480000-0x0000000000523000-memory.dmp	family_cryptbot
behavioral2/memory/4184-23-0x0000000000480000-0x0000000000523000-memory.dmp	family_cryptbot
behavioral2/memory/4184-24-0x0000000000480000-0x0000000000523000-memory.dmp	family_cryptbot
behavioral2/memory/4184-25-0x0000000000480000-0x0000000000523000-memory.dmp	family_cryptbot
behavioral2/memory/4184-232-0x0000000000480000-0x0000000000523000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
2316	Sabbia.exe.com
4184	Sabbia.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b016187f2f4b23b676b6e7d21b2be6c1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sabbia.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Sabbia.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4600	PING.EXE

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2316	Sabbia.exe.com
2316	Sabbia.exe.com
2316	Sabbia.exe.com
4184	Sabbia.exe.com
4184	Sabbia.exe.com
4184	Sabbia.exe.com
4184	Sabbia.exe.com
4184	Sabbia.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2316	Sabbia.exe.com
2316	Sabbia.exe.com
2316	Sabbia.exe.com
4184	Sabbia.exe.com
4184	Sabbia.exe.com
4184	Sabbia.exe.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 384	1464	b016187f2f4b23b676b6e7d21b2be6c1.exe	97
PID 1464 wrote to memory of 384	1464	b016187f2f4b23b676b6e7d21b2be6c1.exe	97
PID 1464 wrote to memory of 384	1464	b016187f2f4b23b676b6e7d21b2be6c1.exe	97
PID 1464 wrote to memory of 4740	1464	b016187f2f4b23b676b6e7d21b2be6c1.exe	98
PID 1464 wrote to memory of 4740	1464	b016187f2f4b23b676b6e7d21b2be6c1.exe	98
PID 1464 wrote to memory of 4740	1464	b016187f2f4b23b676b6e7d21b2be6c1.exe	98
PID 4740 wrote to memory of 4308	4740	cmd.exe	100
PID 4740 wrote to memory of 4308	4740	cmd.exe	100
PID 4740 wrote to memory of 4308	4740	cmd.exe	100
PID 4308 wrote to memory of 1676	4308	cmd.exe	101
PID 4308 wrote to memory of 1676	4308	cmd.exe	101
PID 4308 wrote to memory of 1676	4308	cmd.exe	101
PID 4308 wrote to memory of 2316	4308	cmd.exe	102
PID 4308 wrote to memory of 2316	4308	cmd.exe	102
PID 4308 wrote to memory of 2316	4308	cmd.exe	102
PID 4308 wrote to memory of 4600	4308	cmd.exe	103
PID 4308 wrote to memory of 4600	4308	cmd.exe	103
PID 4308 wrote to memory of 4600	4308	cmd.exe	103
PID 2316 wrote to memory of 4184	2316	Sabbia.exe.com	104
PID 2316 wrote to memory of 4184	2316	Sabbia.exe.com	104
PID 2316 wrote to memory of 4184	2316	Sabbia.exe.com	104

C:\Users\Admin\AppData\Local\Temp\b016187f2f4b23b676b6e7d21b2be6c1.exe
"C:\Users\Admin\AppData\Local\Temp\b016187f2f4b23b676b6e7d21b2be6c1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\dllhost.exe
  dllhost.exe
  2⤵
  PID:384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Bordatino.psd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^LpicWyJDzDQufOqIaiJTJAZAXZcMhhYfBXZPdGltsOzNzaOiuSfRGDxllHnXKXdyFBEsPksLXECVikuEkhFxX$" Tua.psd
      4⤵
      PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sabbia.exe.com
      Sabbia.exe.com o
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sabbia.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sabbia.exe.com o
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4184
  - - C:\Windows\SysWOW64\PING.EXE
      ping OAILVCNY -n 30
      4⤵
      Runs ping.exe
      PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bordatino.psd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bordatino.psd
Size 485B
SHA256 34b41b4116053699aa36e4829705b325e123d195a6530d40b2bce642e079b760
MD5 f3e609e243582b41ee439ae7096382f3
SHA1 dc71a09d16356706440aafd00777caecc27e7272
SHA512 d06403aa37d9f4cb8be368ba3218e0ae28ae6162b63cf45f48c7fd0522cb149af8cfa2354e35801c0d4ffa6a651aed9c2df9392b9b2a1543f20e40831dd2649a
MD5 SHA1 SHA512

Submit Download

Immemore.psd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Immemore.psd
Size 4.3MB
SHA256 90a8cf38ce78dd830a490894ce2aaed931299d4bbeb41cd23fd6a922ba34d9eb
MD5 b356cfc7ff3df6fe3893f655c004ffd7
SHA1 609d4754131bb489cf695c64171fae3622b94c1f
SHA512 66c0bfc563c9cf9d17e2af996e35fa7a32a5d5136e34cc80d756fcdecea23633467d13f9d435a5f219f7a573f654fc4ecc20340f53585e565a89cfab3f019bd4
SSDEEP 6144:SRMGtNuXSHDFKMPDiNb63G5OSyTRdp60V4F0VfzL/:QjktNb6WpyTRdp60VNdn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sabbia.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sabbia.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tua.psd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tua.psd
Size 872KB
SHA256 d425b44a402fcec3f436a92b3618b58491052b70bd2f8f1e93b35ed27bd2715d
MD5 5a45f312674c1178697a5b498c1e3707
SHA1 58410c67f5e22f3b525dd8bc0ccc040d37859c0d
SHA512 b1ec9c31d3367e1d9121375ceb4e152d813eb91518d9da82772f4ef53db145a3396cf1af1c7a1df89112859f082c5a60ddbff57810545f8095513bec60350e0d
SSDEEP 12288:GpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:GT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\QNK061znYM\_Files\_Information.txt
Size 1KB
SHA256 53264dc34495456638af4d6b89ed6a17c4fd286641ae007c394bb9fefd881912
MD5 ee1e81288ca0213fa8c0b304b2cc2a8e
SHA1 f1f3c91c32f91ea694dead6b658320820da13a12
SHA512 c9c6996336bbf426d9cec87b1f2893a7db9b2b8af377ff1acfefad221223eb76c1f80ed1e3333ece48521e7ca3ac607d313ec31902eb507ad807ea897788dced
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\QNK061znYM\_Files\_Information.txt
Size 3KB
SHA256 6c3413e5714b956a637c23125deb710867cf13ab0eb319280ff940d790c5891b
MD5 8c85b4def6c07360e62674991ee65e44
SHA1 2eb481ae2fa45e47ecb0d8cc3ff3b30122812878
SHA512 7549df68ae82224aeca5b1746d0aa2777eac76483dcf07fde5c53fd9df6215abf627448e3f55149caa3758c55a199e611c1e8818ba57b46c03310c103eeefb33
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\QNK061znYM\_Files\_Information.txt
Size 3KB
SHA256 420376997e70a20e95b4a803c0c104df676dba546e4f7dced1fddd0e0dc6d7ea
MD5 7c66e050b1056923c320690eb797a1d0
SHA1 d9a52a05ca8359ae2aa4f892e7394eaab9df9448
SHA512 bef3ca9b038910835b8cc878d175c3c04365d7991f18390f6a30b29c55c1a75dc586ecd3cff8790398c879286e4f808b637ff2e47dc29b4844fd3b93aeabd732
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\QNK061znYM\_Files\_Information.txt
Size 4KB
SHA256 7e9010943b1c4d77d13a091d4f098ea2d2ce624429b9a75aea585e7a2de22d06
MD5 58d985b89bbee03d85e1bb8a1806b49b
SHA1 7b34bd6717ca152eb004af4f61776d147e953742
SHA512 e5ff3756ba1d137ae698d0b58342f9f74e566fa1a2624afc950a91909a0f8fd7c1186db33927b3abacc13f3ffa94164ba23d0d7e07030b3c7f4bdb5013135f2b
SSDEEP 48:sxsUteXxMuaMQehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+A3:s6UteBMbndqDlQHchmcnmB4McIHOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\QNK061znYM\_Files\_Screen_Desktop.jpeg
Size 43KB
SHA256 8edd2db4550a9be4fedf2af94c0f0b85d71e8924d6c4617326926072267cc47f
MD5 076ddd05685e8491822595527eb12e00
SHA1 1531bad329839c31a22da0890a4d12cd3b2c694f
SHA512 b2c5137500b0d83d78adc8846bf2d0f9edd9e25a746279bb41df0539b4fc10d5129a2756cb69477c41fdc36770d2ab81213739bda3a1d5edaf193dca152d33d8
SSDEEP 768:l4g16JxE36Pz4uylKb2dC80rviXcY+k1N04l+J8EyOexQnn:l4g1ELPRKXav0cY+wNfLO7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\QNK061znYM\files_\system_info.txt
Size 1KB
SHA256 48cc788a5940429b427940fb549549aaa19374dd5b7852ead5f1d808790f12ed
MD5 5474db4d76d8dfd0b18ff617d9cf6b46
SHA1 4752a55675fa8b9803f534fb6c2ed640173038b2
SHA512 588321b2f3661d6d6f3edc5e0f1897e72e46ea1780fabc8b02b570744beb184568bdccef254929f8d3e6025bfa5074a65196e4f5d1218764674d74406da95952
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\QNK061znYM\files_\system_info.txt
Size 3KB
SHA256 59ad30f9de0a727922eecd98acd085203d3ebd20550ee888506a56382ea8f971
MD5 84678daa51e516ab0079c34ab5442c71
SHA1 339972f43704847aeb1afe186520dd7e96bb58cc
SHA512 488020dc7808e311f2e40007e1f5ab4e83e9bfffb19a4d9ee92f56b1c89a37af1e1802df860e2ca84bb7b47e9380194929c1cbe6e7ad8fd02684eafd324156c2
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\QNK061znYM\files_\system_info.txt
Size 4KB
SHA256 7c34308c78e4d116455461712d291521276930c5047392cfbeebfc9b5d781877
MD5 bf173e41fabc9adf222c51e2ce822fe1
SHA1 4b1dac5bdcf1687191ed4424af1e90aeb0bfc1ad
SHA512 038ff871f312f469c1a09a7a839b38395198ba7deb3a0550e6ed4553c84bbb778f74734ebe87e4105167e1e9bac38945c2c5e16a579348a889844d68712b5662
SSDEEP 48:cXYte8xcy5OhGYTQ5zeDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+A3ZN+K:UYtewcKhSDlQHchmcnmB4McIHOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

mhU34ALdP1Xtb.zip

Path C:\Users\Admin\AppData\Local\Temp\QNK061znYM\mhU34ALdP1Xtb.zip
Size 37KB
SHA256 30e8cf37d558111b350bb5b7e6c39922bbf9c4a016122c8b5eef77baeeb8825c
MD5 4773a8513d6ddaf2edc2e5a005c817c4
SHA1 6724701b6dd9ab15f6aba1ae9850c9ec301ad90f
SHA512 cf4dada6354cb836b5ba26f63e51844fe0122c4eff73b17657d9b6498efd2e2e550e89b00c87a8bbb8e0de89ea1b55ef4f86a979510870645d3c4e1f6ade0ab1
SSDEEP 768:SgRgbEoFXACDEMUPhuOLQbq758eNLfhNmu8LTQRnTPuGuTMs:Te53E5JuSQbq758S7hYuwTQZuxl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4184-20-0x0000000000480000-0x0000000000523000-memory.dmp

Download

memory/4184-25-0x0000000000480000-0x0000000000523000-memory.dmp

Download

memory/4184-24-0x0000000000480000-0x0000000000523000-memory.dmp

Download

memory/4184-23-0x0000000000480000-0x0000000000523000-memory.dmp

Download

memory/4184-22-0x0000000000480000-0x0000000000523000-memory.dmp

Download

memory/4184-21-0x0000000000480000-0x0000000000523000-memory.dmp

Download

memory/4184-232-0x0000000000480000-0x0000000000523000-memory.dmp

Download

memory/4184-19-0x0000000000480000-0x0000000000523000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads