cryptbot | 838edfe6cbf7b8fb1f0d3d99535f15ef22b651fa82a9f31a50c3cae435a0af0c

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3c559e832052bbf33f52f6f8b0ff086.exe
Size 701KB
Sample240312-tgrmpafb85
SHA256 838edfe6cbf7b8fb1f0d3d99535f15ef22b651fa82a9f31a50c3cae435a0af0c
MD5 c3c559e832052bbf33f52f6f8b0ff086
SHA1 23477b75572d17b1d47b9670862aa174fb55d166
SHA512 2a1e3e9676b103d23947b2271059f59f0bd71559071805f8650c6a27168016cff791ec3c7f2102740b1e1b9a6c5f34775a9a58d2ae3215f9bf386827d9da4583
SSDEEP 12288:2mSxZQAOMrb0dAmfaRyCeBroJrL4ydQGgjSRClCgABPAi:2mPAOMcd2y5Z6rL4v59QBPA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

smauvo62.top
mortuh06.top

Attributes

payload_url
http://gurswi09.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral2/memory/400-2-0x0000000002760000-0x0000000002841000-memory.dmp	family_cryptbot
behavioral2/memory/400-3-0x0000000000400000-0x0000000000919000-memory.dmp	family_cryptbot
behavioral2/memory/400-213-0x0000000000400000-0x0000000000919000-memory.dmp	family_cryptbot
behavioral2/memory/400-220-0x0000000000400000-0x0000000000919000-memory.dmp	family_cryptbot
behavioral2/memory/400-221-0x0000000002760000-0x0000000002841000-memory.dmp	family_cryptbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	c3c559e832052bbf33f52f6f8b0ff086.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	400	WerFault.exe	85

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c3c559e832052bbf33f52f6f8b0ff086.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c3c559e832052bbf33f52f6f8b0ff086.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3680	timeout.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
400	c3c559e832052bbf33f52f6f8b0ff086.exe
400	c3c559e832052bbf33f52f6f8b0ff086.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4524	400	c3c559e832052bbf33f52f6f8b0ff086.exe	101
PID 400 wrote to memory of 4524	400	c3c559e832052bbf33f52f6f8b0ff086.exe	101
PID 400 wrote to memory of 4524	400	c3c559e832052bbf33f52f6f8b0ff086.exe	101
PID 4524 wrote to memory of 3680	4524	cmd.exe	105
PID 4524 wrote to memory of 3680	4524	cmd.exe	105
PID 4524 wrote to memory of 3680	4524	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\c3c559e832052bbf33f52f6f8b0ff086.exe
"C:\Users\Admin\AppData\Local\Temp\c3c559e832052bbf33f52f6f8b0ff086.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\lmjqAZRZ & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\c3c559e832052bbf33f52f6f8b0ff086.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1056
  2⤵
  - Program crash
  PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 400 -ip 400
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BGRRYY~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\lmjqAZRZ\BGRRYY~1.ZIP
Size 38KB
SHA256 fe414d4519c9055da4ff9d5a104a389ec7f23c9ed7c494b29f76cd37e94f2348
MD5 638c07f5552a72562d18083519ca3ea5
SHA1 a9e831c0a69feadbf183a2a83ac06656a2c02bbf
SHA512 32f8911a105110965d79071d06893edb57285fd1e6b88ce02d18c4f2e57599112b73710e8a0ec565614ce5f44b2c7d52e202d6645d322e98eb5c0f34485023ff
SSDEEP 768:J4qxD4usUo5P/P9PF/2/uS0tYLHrtZhnrNcY71p6kKzp:Hfodnp0mjertZhnpHI9V
MD5 SHA1 SHA512 SSDEEP

Submit Download

YVVGVS~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\lmjqAZRZ\YVVGVS~1.ZIP
Size 38KB
SHA256 e0c70b898b0710eac64a8ea0086f6115877e2f28a910f6f14870ea2ded66bb8c
MD5 847913bd7b9e90b865ca5bd6e68c7d89
SHA1 2f824858fbfd921fdf8a1984a09b487332e05b1f
SHA512 bdc1bdf56296b1d4960352417e4688deb121f2bedcb71d6edec511a0395604d516e5042f04a4e4103950eb1bb211cb2110e6859c982915f58c334cdfa6a9a52f
SSDEEP 768:H4usUo5P/P9PF/2/uS0tYLHrtZhnrNcY71p6kKzb41d:Bodnp0mjertZhnpHI9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

_INFOR~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\lmjqAZRZ\_Files\_INFOR~1.TXT
Size 7KB
SHA256 652c72213c0994f0f87bdba16c61a53a7dfa650b4c676e872be1be32ea648b5b
MD5 6aa7b89e17e8c3c44c68abb4ae8d0734
SHA1 5bf382f09f6ba8d4aaa73a54f1486af999fc8a34
SHA512 07a445a2dfb702f76ca189d2aa0b3fb198d478f13dfe37783049c3256e03e8dd1eaa9f04e3b80b7ea11431ea79d5404e83a0f00cd49f61857ed13c917e615815
SSDEEP 96:sxUteBWndqDlQHchmcnmB4McIHOUY46HzB+6cnhrcn1wcfzSByYO:gQdJR5bQUb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\lmjqAZRZ\_Files\_Information.txt
Size 4KB
SHA256 1f0791a9f6b375d1f188f3a458e1e5f2ea9a3a13a7e9194b11e69cef41077ba6
MD5 49037ea6590a5a36f7a87b22ed646581
SHA1 db104f89880d6930e09f4aaa61de64e071acaa27
SHA512 edd21b8157423b23c0ef6e28f919c11f84784e08af51143fafb8ffa46abeeb7b6d4381248e5d472136b96db33009d8d7a783d06be17729cb58b9c1e8ecc0671f
SSDEEP 48:sx3UteXxKiqaMDehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+K:sxUteBWndqDlQHchmcnmB4McIHOp
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\lmjqAZRZ\_Files\_Information.txt
Size 4KB
SHA256 de90fd80294128280b3eccb8cac1382f3ceef45b8da317a16e4bbcb713a7d936
MD5 b1f1621e4875d13b3f24538895fadf76
SHA1 867351a405ca1a0f3755177f43b38c0f3292e373
SHA512 b01ad2d0b5f1cc4525df830490b50518b66cf17b5051c6755d77236ef760000e56bc9ce9abcb084dced4604f2bb64b3f40bc959e0b2cda04143d2abf6f6aa3db
SSDEEP 48:sx3UteXxKiqaMDehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+G:sxUteBWndqDlQHchmcnmB4McIHOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\lmjqAZRZ\_Files\_Screen_Desktop.jpeg
Size 44KB
SHA256 850bf71bd3036571dee365078062cce565ddc2923c50eada7fa3f891fbf17186
MD5 f782b1bcffb4418a6e7356d22157df38
SHA1 7d5e16f86177c7364eaac8c8020defde8f856431
SHA512 bc0b0bb53f6ad62931daa64dbe1b1f822c5bd45abe8596790fa4b8d916ce5d7bff57cf0e319d47ca991c4aeb02647d5a87a38cba794de459a5d9c1760b1a67db
SSDEEP 768:l48IqJkbjA2mdPJAPnkUMm/6FTlICs33BMvRckOZa8G0lAPEEEEEEEEE3:l48fJ0MhdPWT6FTeCs3GiA8
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\lmjqAZRZ\files_\system_info.txt
Size 7KB
SHA256 d6be577e86548d1eeb7d1790f60693a87a26732f2fd264f6649f7adc94275a6d
MD5 4415712aea826da087180ca7080d1486
SHA1 2e7970626b277ba781ec87d2e296e8334902b74c
SHA512 fb82a4aa92d7ad7858ad2d98191bd415549a0697422d9ce05311c5c2c4925a610fc650ffa7da3a40873b11c74a465caa41f01dbabec93c1ef9269e4fc2bc9f59
SSDEEP 96:PYtew2hSDlQHchmcnmB4McIHOUY46HzB+6cnhrcn1wcfzSByYO:DrhhR5bQUb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-213-0x0000000000400000-0x0000000000919000-memory.dmp

Download

memory/400-1-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

Download

memory/400-3-0x0000000000400000-0x0000000000919000-memory.dmp

Download

memory/400-2-0x0000000002760000-0x0000000002841000-memory.dmp

Download

memory/400-220-0x0000000000400000-0x0000000000919000-memory.dmp

Download

memory/400-221-0x0000000002760000-0x0000000002841000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads