cryptbot | ce7d94e2c15962b64b2ba26e656e8c11fee4b042c11021dc242ae1cf0b537b2d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0f26518a6a528d697ee4a335bdc73b5.exe
Size 711KB
Sample240304-cglb8seh9w
SHA256 ce7d94e2c15962b64b2ba26e656e8c11fee4b042c11021dc242ae1cf0b537b2d
MD5 b0f26518a6a528d697ee4a335bdc73b5
SHA1 c30b0acf4aec48e55f7bdc7e671b35792b91dece
SHA512 0e760dfcece5084a37901bd223ab192e34ea8e40e588d6b4658bc2ceaf3f50bfca85bd9ffd07b27ac49a3f05aa2402b21a8f83c15f71ae0820bf11e64edc5b0e
SSDEEP 12288:LVte9iz4NoV304o1tLt48ixrbm/2hR3PMYG1uf3+2:fKm4NzWx2uh9kZ1+39
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

lyspsc22.top
morepq02.top

Attributes

payload_url
http://damsez02.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 4 IoCs

resource	yara_rule
behavioral2/memory/3340-2-0x0000000003350000-0x00000000033F0000-memory.dmp	family_cryptbot
behavioral2/memory/3340-3-0x0000000000400000-0x000000000334F000-memory.dmp	family_cryptbot
behavioral2/memory/3340-212-0x0000000000400000-0x000000000334F000-memory.dmp	family_cryptbot
behavioral2/memory/3340-218-0x0000000003350000-0x00000000033F0000-memory.dmp	family_cryptbot

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	b0f26518a6a528d697ee4a335bdc73b5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b0f26518a6a528d697ee4a335bdc73b5.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3340	b0f26518a6a528d697ee4a335bdc73b5.exe
3340	b0f26518a6a528d697ee4a335bdc73b5.exe

C:\Users\Admin\AppData\Local\Temp\b0f26518a6a528d697ee4a335bdc73b5.exe
"C:\Users\Admin\AppData\Local\Temp\b0f26518a6a528d697ee4a335bdc73b5.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7scAa2CKir.zip

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\7scAa2CKir.zip
Size 550KB
SHA256 a4dceab0a1e57431b9c5ee560ae5cffb4c013406f77f735f2b1ac37e71f340de
MD5 496638a8ec7e0eae9509242a1f746e69
SHA1 2d287731f1ebd26fcc9c3219810db27379da2998
SHA512 afeb9a5b2e818edcdf3cf204d7f90069047366acb7eb208132293d27784963f78eb58eda3b681c82ab8e5c22000c3a3c399cabbf561d95451bf0a234f7a49097
SSDEEP 12288:NtDhwaAdyiNJfJ1VpqDQrtU6plMiK264IWrxsu/G0X:NtfEy+1Za0U6/aurX
MD5 SHA1 SHA512 SSDEEP

Submit Download

B8ea3AOW3mcdN.zip

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\B8ea3AOW3mcdN.zip
Size 550KB
SHA256 d55cb390891292a96b0a628f521785e712660ef795c7bbcd1deef8989c79d169
MD5 f5d90bc92cc395a3d1d56291093d9d12
SHA1 a863a14a0c7454986480f91d761605ec64b8f0d2
SHA512 61d4ed777ec365f3bd77a6995c795e22325f6fffea62b4439002706765b0348a245482202d41dd1fcda55c568ccfc6978ff3ba28abcd2e3012a7d6d8480b3b81
SSDEEP 12288:ptDhwaAdyiNJfJ1VpqDQrtU6plMiK264IWrxzu/G0H:ptfEy+1Za0U6/VurH
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupLimit.txt

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\_Files\_Files\BackupLimit.txt
Size 510KB
SHA256 6905d821b6f08877e38e31f8bfeb6115eebf22405dd44ab6b74e840341add683
MD5 a6139878ddea8a9924a82510cf0de4cc
SHA1 9275a508c09acf269a517af3918ff3a255f703e9
SHA512 f84b2e08c38b7ab25bc2d4e9c7d5057c959406a58273cd3d2e15b9111935fcd9870a431380fab40261837b9c97f47dc07c4c186a26e2e4197fb464be794485c6
SSDEEP 12288:GtXhwwkd+iNJfJFVpqDQxt46plUoK26CgWrGo:Gt3o++1Vaa46fp
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\_Files\_Information.txt
Size 1KB
SHA256 d01c0c455613b8298895eef8ac537c7c68fa82c0d304e6dced81996a1d458d0f
MD5 53fd25d0b54144105c5670623ba5fb5e
SHA1 21425a81757306a4e5faf69183fbaea8402e577a
SHA512 d79e005c4ac8be0018fd458258104a890b9c2d3b6433cdbce0905bf93acb456d555b2794f101f87d6130b5c06c18b9a05abe97a4204fec5cae0d3f622d710dc1
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\_Files\_Information.txt
Size 2KB
SHA256 1f8d5d7e76c10eae6bc9290297f7a408d41d5eddae59fd44920a2cd5c0f7d6e1
MD5 a1a9d1559c04625818a56b3068bc37d3
SHA1 f050727d6a50868ad2ffa622027c0def5afb5f3d
SHA512 0b57fb6a0da5827bf0c72ccf42ea63f8ae9a034319696ffb06cfd5f7953f10380924fbdbee01d991d95981ba5b100bf501f3f97d05928d1bced9f378ac473b03
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\_Files\_Information.txt
Size 4KB
SHA256 e624a947c80945162366407d63851f91e79c8fa5402f6a1e754d5c332460fa7a
MD5 e2ccc232939e029f6d8cdd873f3ae31f
SHA1 b95acc9f0d4395e58b68fcc33ed2702dd84a8f45
SHA512 a00adc82475e6132304525f52cd605c9434fd1d54a19522276486f921820da35a82c6963dcecae7488c9fa0328ce9f4ae388b6eec833085dcee70bd66655f076
SSDEEP 48:sxpiUteXxYpaM1ehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+G:sqUteBWndqDlQHchmcnmB4McIHOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\_Files\_Screen_Desktop.jpeg
Size 46KB
SHA256 39da11ef0e3081dddf4e319473f75086834ae4751d9e2e10095d245896aef71f
MD5 548ff5b16d5b37775f4dccf70db6330b
SHA1 af22ea5ad78c37df2fb18fdf41a34a6d932f36e6
SHA512 17f3f2d3dcb44be56a9719dc8bbbf616be95a4c62ea3d70516bc0ec18ecb1a0d8ed7e7e504bcf67d5ee158e655e64a0068da83b15f33de79619e4199624eb4b2
SSDEEP 768:lqTVZnsyTp97g1IkC9eALhTo7pYIpnxMb7BsbUNY8Hw56v7eOwgrX:lqTVZnBTptkqeAFkCIpebtsbZSw56v7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\files_\system_info.txt
Size 1KB
SHA256 fe2191c9252e84ff915155abbfbc62101b115e0e1883737cdb5d8883d5191462
MD5 5767bc13c49aa7488cda53369d5e26b0
SHA1 0c93308b882e68b84096257c68dd4cb58fd8d195
SHA512 1e32ee1ec3642485f2697c27ffaf2caef10d6915cb41556f5a62978c6df9b353e579fbdc0074fb848983feebcc51e366aca5a769fc22a3b8a8eb77ffbd930d20
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\files_\system_info.txt
Size 1KB
SHA256 c840c11583dfdf7ff0757d38ffe02bd1d210c9ef825bf83db09bdf9834a9d80e
MD5 206414f881154a10b91c9edc8353a69b
SHA1 fa0e8505c076faa13884ca03c5661ea9d4f971d5
SHA512 7b2880e64dcf0c265d95679986f41c0651edbb561d48c739debb0766967e3301eca00915ec1339a77b5259128ec4b666beb06000a6d797d73f34900df3328df7
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\files_\system_info.txt
Size 3KB
SHA256 652425eb357f72b11f3bb7c8940dac1741b02906555116eac83e1c2fdbed03a5
MD5 634427993d5bc3fa91bd12566a7840ba
SHA1 40c529280cf9de48427ac835355bee1f2fcacdd1
SHA512 2977b5c4a08e2370ac027a7727870d134b711678deafa41b72d4d2ba3c1a53de252f53e6998e5062585279c47e58091063d22d2e8dbd84b71b6fcbdcf72e8122
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\dYbMsrMNku\files_\system_info.txt
Size 4KB
SHA256 09f9d4c4d40511543c261004ceacd856d986766a8451563890743dfc02372ed5
MD5 c39073692f715ce48815be75158314f5
SHA1 01c667052b4d602c094e65a7714b46fe6e6ec33d
SHA512 39bac3467f8e30520e18561823f508950f5ad893fc65dfd51d5756128d6414f9418c33fb7f8b44af9d1c89c09bfa5215d29ea5e5ebbfce4a35fd1feee89c66bb
SSDEEP 48:cppYte8x23MOhGYTQ5zeDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+A3ZNd:8YtewnhSDlQHchmcnmB4McIHOUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3340-1-0x0000000003410000-0x0000000003510000-memory.dmp

Download

memory/3340-212-0x0000000000400000-0x000000000334F000-memory.dmp

Download

memory/3340-214-0x0000000003410000-0x0000000003510000-memory.dmp

Download

memory/3340-3-0x0000000000400000-0x000000000334F000-memory.dmp

Download

memory/3340-218-0x0000000003350000-0x00000000033F0000-memory.dmp

Download

memory/3340-2-0x0000000003350000-0x00000000033F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads