cryptbot | 287dca86de5fc3ef241d711c396edca616e6a003c3f1110e0e4052898adad763

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbb85cfba575534b96dcaf51cc1e0a19.exe
Size 1.5MB
Sample240308-tx1kjace2w
SHA256 287dca86de5fc3ef241d711c396edca616e6a003c3f1110e0e4052898adad763
MD5 bbb85cfba575534b96dcaf51cc1e0a19
SHA1 711e6538654e8f0dbadd3e81d837999e32031482
SHA512 480ea5ce971a36f5bcb7f48d66b5a61a6c078055f9fc664a14ed148d99f9c107a737ca93e5b6bd5ab5ebf7a37aa9bd2d362d81240fdfe04b12ae5ac3e21820f5
SSDEEP 24576:g9j+dJLoiZIBsiGhvkBL4Z56WvNan/2KNOlweBDgsH7T4AAGM+eCGikb//Sic:YYZdiAvDZYWvN2KlweBbT4AAhJCGl/ai
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

haizul15.top
morhas01.top

Attributes

payload_url
http://zelcax01.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral2/memory/3628-25-0x0000000000740000-0x00000000007E3000-memory.dmp	family_cryptbot
behavioral2/memory/3628-26-0x0000000000740000-0x00000000007E3000-memory.dmp	family_cryptbot
behavioral2/memory/3628-27-0x0000000000740000-0x00000000007E3000-memory.dmp	family_cryptbot
behavioral2/memory/3628-29-0x0000000000740000-0x00000000007E3000-memory.dmp	family_cryptbot
behavioral2/memory/3628-236-0x0000000000740000-0x00000000007E3000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
3580	Imperiosa.exe.com
3628	Imperiosa.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bbb85cfba575534b96dcaf51cc1e0a19.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Imperiosa.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Imperiosa.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4744	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3628	Imperiosa.exe.com
3628	Imperiosa.exe.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 4576	1244	bbb85cfba575534b96dcaf51cc1e0a19.exe	90
PID 1244 wrote to memory of 4576	1244	bbb85cfba575534b96dcaf51cc1e0a19.exe	90
PID 1244 wrote to memory of 4576	1244	bbb85cfba575534b96dcaf51cc1e0a19.exe	90
PID 1244 wrote to memory of 1864	1244	bbb85cfba575534b96dcaf51cc1e0a19.exe	91
PID 1244 wrote to memory of 1864	1244	bbb85cfba575534b96dcaf51cc1e0a19.exe	91
PID 1244 wrote to memory of 1864	1244	bbb85cfba575534b96dcaf51cc1e0a19.exe	91
PID 1864 wrote to memory of 3992	1864	cmd.exe	93
PID 1864 wrote to memory of 3992	1864	cmd.exe	93
PID 1864 wrote to memory of 3992	1864	cmd.exe	93
PID 3992 wrote to memory of 4928	3992	cmd.exe	94
PID 3992 wrote to memory of 4928	3992	cmd.exe	94
PID 3992 wrote to memory of 4928	3992	cmd.exe	94
PID 3992 wrote to memory of 3580	3992	cmd.exe	95
PID 3992 wrote to memory of 3580	3992	cmd.exe	95
PID 3992 wrote to memory of 3580	3992	cmd.exe	95
PID 3992 wrote to memory of 4744	3992	cmd.exe	96
PID 3992 wrote to memory of 4744	3992	cmd.exe	96
PID 3992 wrote to memory of 4744	3992	cmd.exe	96
PID 3580 wrote to memory of 3628	3580	Imperiosa.exe.com	97
PID 3580 wrote to memory of 3628	3580	Imperiosa.exe.com	97
PID 3580 wrote to memory of 3628	3580	Imperiosa.exe.com	97

C:\Users\Admin\AppData\Local\Temp\bbb85cfba575534b96dcaf51cc1e0a19.exe
"C:\Users\Admin\AppData\Local\Temp\bbb85cfba575534b96dcaf51cc1e0a19.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\dllhost.exe
  dllhost.exe
  2⤵
  PID:4576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Mondo.docx
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^lxsGyfkBadbQrrnDCbufmfsJXySbtcWmXmiVshcRIcbMNvepAAmgsSjUeHJZbNvXxYSDVCjfefGtREWArIXDVHoyjjTJDczVYAsPDnhXgljekoebLoVOQSwNPNsIJCLGVLy$" Stanchezza.docx
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Imperiosa.exe.com
      Imperiosa.exe.com K
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Imperiosa.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Imperiosa.exe.com K
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:3628
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 30
      4⤵
      Runs ping.exe
      PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dal.docx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dal.docx
Size 736KB
SHA256 e7d7ff90b6344606f8c7ee166f0feab2a2162fe3d2b9e05f9cf25dd3ed594452
MD5 d8d37390455b186686dff3912d83a1e5
SHA1 8ac6d64bda573227beb5c6bbd0725b4fd5a5c51e
SHA512 afbbf85aa42f09d3fd58662ad7695e7e84ea9af109c95eff0ec5fff868b0a2439bd005821d2821f2b0c80a428eb7cf09616062e00201774cd447db9dc7ecb8bd
SSDEEP 12288:eU4FrfVLv6NTcZDGwJXHGc1uDBfTyUvq6OLk+X66Zn/zrfZf4v/rJ:e1HGaulnvVs/Xu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emergevano.docx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Emergevano.docx
Size 634KB
SHA256 964e7eb2a2d2e0f45eb722c7c859ab72d5dc6f60b14a636d27423e2dca141907
MD5 a05f1f3c4f9998a082a2924781ae8332
SHA1 5b08189c21b95f7aed6fbd5c356e96632cbb7284
SHA512 9748d93a9c15cc036d9e1446bdb70f645c337029c01af6a38d03cfcec2e9aa3a4111a74a6fcf1fb8d7a4e229d69e9ae2696fd8060fb3ec23b8e1172a06f14176
SSDEEP 12288:3clwZ3VTLnWvsCa7TeHISgVwAG2yavvgiHGyf57M2BPM/S4RJN6j:Mlw5BD6s37TriAG2yezGWM2W/S4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Imperiosa.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Imperiosa.exe.com
Size 657KB
SHA256 aa29eab5930418d47a3a65c536188bdf97a5ee16032acbf57401c41beec66c20
MD5 dfcac1a225ad8b3b803ae4a6a6734765
SHA1 ec08970ca0bcbef72c30d2889f3acab6eb6e3de1
SHA512 601eca1f0233e8f79d791b5702ce8ed916e6a7beb8d65a2019de10085f7fb18987122e2baa3e4ef3b533e1889b61a3ac72e3ade58c0fa89cd0833a822ac98af1
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdx:6T3E53Myyzl0hMf1trf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Imperiosa.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Imperiosa.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mondo.docx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mondo.docx
Size 490B
SHA256 d53d6108160978eb854cdc592a6741e6643f7b579790f32fbe5c902724ef020b
MD5 21f09b047007ce6d6f89d704b8f130b6
SHA1 c8ecbf36bf84b922462d6656c13ddbb55ed63a6b
SHA512 0809f5582bf7dce23f336bd30747ce27ba11ec03528699fd4ee0a9402b49b9869784a5a85e4540e80f8fccc0475a8a700d8f2f079a565b6b1d95c2a51fb2dee5
MD5 SHA1 SHA512

Submit Download

Stanchezza.docx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Stanchezza.docx
Size 872KB
SHA256 c623bfb9792ee366c8e8ac271d10530abf6420fb38da1dd2716c061d6f211d48
MD5 cec53a71fae2267af5e90d6cc6b6b16d
SHA1 ed34554b1840730da511ecf447b3c648af6176d8
SHA512 9c88a2aa9ca15f80d2c17800dd1ae500cde996eaca1af9f839dccb34f35971b673027d5d9e51d2e8eadb6dfa7342206b60639e28fb65d912cb8073719498962d
SSDEEP 12288:BpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:BT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

2qhKZaiQdXHNXr.zip

Path C:\Users\Admin\AppData\Local\Temp\uJr45BrxMo76\2qhKZaiQdXHNXr.zip
Size 40KB
SHA256 cb63386559af439f619e76a51aa1da4597616201f22fd16629e18f52de5a67ed
MD5 c13eaf3ab1f7db9ea19290d1d1091210
SHA1 17cad3b681e7500433d1581d38b4c75c1d3c4879
SHA512 fbabb71c25227c4ead38aa38c0eb38f773b3717df98ad4a8fdb2278a21e66ce8c3ce9bc43e2b26e4bedeb5e70c2dfbe4346fb19d8b7470d1a9efd0e69b9b86b7
SSDEEP 768:L+IjR6FfLl+swxbMWCl1m1ABCb7aV0p8Js+W2sr4a65Fd:5+iJCWMCXapJI5Uh57
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\uJr45BrxMo76\_Files\_Information.txt
Size 2KB
SHA256 9ed6173d3087d32090efc5beec7efe504f4ac5fbd4dcf67715e8a07595452a9a
MD5 c1fdf6747f14115b407f6334477d2d7e
SHA1 8e9d95eca3766020eb5421d8a1ddf339190986d8
SHA512 b5219ae25d336f37a1122ccd11b564e15d4a5e0cbe60c7b835e64a3b48c01f03096897e4bbf27daad8f976832bceaabb5526e79cffacb91fe6916b41e37ca6e6
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\uJr45BrxMo76\_Files\_Information.txt
Size 2KB
SHA256 06af2f175f0ee589599df525eda9a92e329ca61ef814e34a6640dc1fee13191f
MD5 7fcc7545810b31fc853f71164c70408c
SHA1 3fc555baebe91fc5520c2ea454879869e8a0bc6a
SHA512 042f46396f45e8c9a9eed10720989cdcebb20ebe4f9d12bada1f5fe054f58a71ddd6eb6cd23d4a63a8c26b3c26390d6bb7500841d6aef92249f9461170ecd09b
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\uJr45BrxMo76\_Files\_Information.txt
Size 4KB
SHA256 2fd3975215a237762ef75fa5c52fdbb796317c3ed75a1c29b2754bf00dee185a
MD5 323398b76324c7554b1122d9985b56b8
SHA1 915ae5e9b8c05903ac6bacc5d9fcf1c4fe19aae0
SHA512 f255ff669158ffab46ee018d2cfd7c6dec4202d5f91f7abb98faab177a494615d1c5d0ff3f8d7d6983cbdbaca26da450ba2b71e0eaa1fac75bf77c893ba99a26
SSDEEP 48:sxguUteXxvQlpaMDehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAa3:svUteB4PndqDlQHchmcnmB4McIHOUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\uJr45BrxMo76\_Files\_Screen_Desktop.jpeg
Size 47KB
SHA256 2c5363c9e06b988212777ac27c679db84d68b70eb8a61c2b7e8912bce3b0e6ac
MD5 74e44494a3fad13a514e2d52d28b7b75
SHA1 ba756fa17b5766eae55de6bb1e3ed1266cfc4075
SHA512 b27cbe2400b8c604589ba3f1e81c5b6b43357b5b3b52adca98ee3aa87fbd156006b4bcbc33c00580454c4905d5ba295129efc9a2fdb690ffe79ae8bdbf3b5507
SSDEEP 768:lvypY2cvanVmsP36BiwTxag40JX7j7hkJ7Ckv35dZtGA0C3Vpz0NoEBz:lCivRkqBjog40d37oukvTZOIVpz0N/Bz
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\uJr45BrxMo76\files_\system_info.txt
Size 7KB
SHA256 625a3530230baf1008be854acde2a848653cd7ba0f786e2e2f6231052d0c6b07
MD5 71591c6b4f122b1e886b82cfd6f1fcae
SHA1 80acacf7982cb1ceef4331882ea0a7bc97639c57
SHA512 d840a957426cc55c5d34305ebabf5c204b8550ffd77163f13f33cf90b22834ea76bbdee6975325c9ab06309c7356d1a2c3cbe3af4bb292ec207c98ef97ef7fdb
SSDEEP 96:RYtewouhSDlQHchmcnmB4McIHOUY46HzB+6cnhrcn1wcfzSByYO:NPuhhR5bQUb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3628-24-0x0000000000740000-0x00000000007E3000-memory.dmp

Download

memory/3628-25-0x0000000000740000-0x00000000007E3000-memory.dmp

Download

memory/3628-26-0x0000000000740000-0x00000000007E3000-memory.dmp

Download

memory/3628-27-0x0000000000740000-0x00000000007E3000-memory.dmp

Download

memory/3628-29-0x0000000000740000-0x00000000007E3000-memory.dmp

Download

memory/3628-23-0x0000000000740000-0x00000000007E3000-memory.dmp

Download

memory/3628-22-0x0000000000740000-0x00000000007E3000-memory.dmp

Download

memory/3628-21-0x0000000001690000-0x0000000001691000-memory.dmp

Download

memory/3628-236-0x0000000000740000-0x00000000007E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads