cryptbot | a228971bef4b94f2319bda9171a810d555238208893c3609d3291e24591922fb

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2024, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc7fa5e9590a5655e2599a34ebe7418f.exe
Size 527KB
Sample240321-ysjtfagh77
SHA256 a228971bef4b94f2319bda9171a810d555238208893c3609d3291e24591922fb
MD5 dc7fa5e9590a5655e2599a34ebe7418f
SHA1 5315cc45343f942cf8a7d9009eb9eed9a3cf25d9
SHA512 ec602628faaefe5d0387249ac2521415ee1eb070d84ebda8b93e5598725032e12847349333f16abdfd9a09c4760809e3c01877604a305c31c1054d7f488f6fdb
SSDEEP 12288:uz+ImOoPNL6oQCktuSglKcftk10P3st2YUf7hZL:uqDwzXglKCaA3uyf7n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

knuspj52.top
morjeo05.top

Attributes

payload_url
http://sarefy07.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral2/memory/1504-2-0x0000000004B20000-0x0000000004BC0000-memory.dmp	family_cryptbot
behavioral2/memory/1504-3-0x0000000000400000-0x0000000002D13000-memory.dmp	family_cryptbot
behavioral2/memory/1504-4-0x0000000000400000-0x0000000002D13000-memory.dmp	family_cryptbot
behavioral2/memory/1504-208-0x0000000000400000-0x0000000002D13000-memory.dmp	family_cryptbot
behavioral2/memory/1504-210-0x0000000004B20000-0x0000000004BC0000-memory.dmp	family_cryptbot

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 21 IoCs

pid	pid_target	Process	procid_target
976	1504	WerFault.exe	91
3292	1504	WerFault.exe	91
3952	1504	WerFault.exe	91
2264	1504	WerFault.exe	91
1928	1504	WerFault.exe	91
4844	1504	WerFault.exe	91
2148	1504	WerFault.exe	91
4736	1504	WerFault.exe	91
3100	1504	WerFault.exe	91
4792	1504	WerFault.exe	91
2596	1504	WerFault.exe	91
1692	1504	WerFault.exe	91
3984	1504	WerFault.exe	91
3912	1504	WerFault.exe	91
4832	1504	WerFault.exe	91
4608	1504	WerFault.exe	91
4568	1504	WerFault.exe	91
860	1504	WerFault.exe	91
948	1504	WerFault.exe	91
2264	1504	WerFault.exe	91
1084	1504	WerFault.exe	91

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dc7fa5e9590a5655e2599a34ebe7418f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dc7fa5e9590a5655e2599a34ebe7418f.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1504	dc7fa5e9590a5655e2599a34ebe7418f.exe
1504	dc7fa5e9590a5655e2599a34ebe7418f.exe

C:\Users\Admin\AppData\Local\Temp\dc7fa5e9590a5655e2599a34ebe7418f.exe
"C:\Users\Admin\AppData\Local\Temp\dc7fa5e9590a5655e2599a34ebe7418f.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 588
  2⤵
  - Program crash
  PID:976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 664
  2⤵
  - Program crash
  PID:3292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 756
  2⤵
  - Program crash
  PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 880
  2⤵
  - Program crash
  PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 868
  2⤵
  - Program crash
  PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 868
  2⤵
  - Program crash
  PID:4844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1152
  2⤵
  - Program crash
  PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1176
  2⤵
  - Program crash
  PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 880
  2⤵
  - Program crash
  PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 688
  2⤵
  - Program crash
  PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 796
  2⤵
  - Program crash
  PID:2596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1264
  2⤵
  - Program crash
  PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 724
  2⤵
  - Program crash
  PID:3984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1264
  2⤵
  - Program crash
  PID:3912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 972
  2⤵
  - Program crash
  PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1164
  2⤵
  - Program crash
  PID:4608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1032
  2⤵
  - Program crash
  PID:4568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 988
  2⤵
  - Program crash
  PID:860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1192
  2⤵
  - Program crash
  PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1036
  2⤵
  - Program crash
  PID:2264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 892
  2⤵
  - Program crash
  PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1504 -ip 1504
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1504 -ip 1504
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1504 -ip 1504
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1504 -ip 1504
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1504 -ip 1504
1⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1504 -ip 1504
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1504 -ip 1504
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1504 -ip 1504
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1504 -ip 1504
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1504 -ip 1504
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1504 -ip 1504
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1504 -ip 1504
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1504 -ip 1504
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1504 -ip 1504
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1504 -ip 1504
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1504 -ip 1504
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1504 -ip 1504
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1504 -ip 1504
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1504 -ip 1504
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1504 -ip 1504
1⤵
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:8
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1504 -ip 1504
1⤵
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KBKIkpFq.zip

Path C:\Users\Admin\AppData\Local\Temp\gRrEtYvTAUpp\KBKIkpFq.zip
Size 43KB
SHA256 8f03d9904883a5b3f22cd9ef10bbd10ad0380f78157eb076f22da45969536b3c
MD5 5f54a4db7ff7d0d5f151a7dee113b12b
SHA1 e57f5824dcd378f4848a79784a8f7dc3b8bf8494
SHA512 a4a3c8cb6e598574b69956a7f14dc56ca2e0e180b334a128c115bae1e9b3acf2fb71c54a82788d8de10165406a7df13f54d1e091a3b5c950d6bd66c217e6145c
SSDEEP 768:q10oqWNmYf5TczKQr3fysLkTI1efdAga8ILu9Jb1Pl9JWXkM5JT:3kNt0h3fVQTI1eO3lLutN9Jz4T
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\gRrEtYvTAUpp\_Files\_Information.txt
Size 1KB
SHA256 2e24cbd8dc9cdef964f4e57c3506fad1ac24b7232755564d729e136a93b6c972
MD5 bfee9f02aa700ac0bb317516b2082b1d
SHA1 5f6a00dedfe6fde36939ac4efd88dab5a1f2f0eb
SHA512 6353d0ff050902302965e0dc9fde6d7d12523aae846005e626cbcccf58d0a4b100c8ff95be9c3ba784dbeff7ae71fd91263393f2d031d1916fe727500e973d75
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\gRrEtYvTAUpp\_Files\_Information.txt
Size 4KB
SHA256 13ddafff469b1103258ad29357e62cd75d916b737ce1b493abb9d323228c5677
MD5 53d21436a196527ec606039a137a314b
SHA1 7633efe383b5881fb569ffefc3393bde81b815cc
SHA512 83206233a63677d3bcf836d52c874a4326f87bfcc9c86726c4102d6cb62f05e05355e4de95fc4f6b52c4d8e91567e7cd312c8af27a8555b66ec4868dbdf32bb0
SSDEEP 48:sxQ54UteXxBEaMBrehGYTwTZDWDe7iGqXpwbe7/UHcBOOmcn+jYyrJB4Mc7AaN+N:sQ4UteBBSTndqDqHHcZmcnmB4Mc6zOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\gRrEtYvTAUpp\_Files\_Screen_Desktop.jpeg
Size 49KB
SHA256 f20eec9ab06b6c89ce9c607b9b8c979751590f81abb0d4fd50eb17b263a58a4f
MD5 eb81d0862692e9a43f8f15f33a5c8abc
SHA1 754a83e8845adb9f638e72cdd204572cedb4fa36
SHA512 bdfca3d2b2741119755499172408da28c6151d7e852347538b8974ed9b4968770564080f68df990d61aa503b477122854471fbb3bd7c39c09f59e98243b2292b
SSDEEP 1536:lqWGd4DgBTpxuvPdzXW+i3+JKkADOYLJXVnXEqef76:4qgXwvlzDi3+JeNLJ9bB
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\gRrEtYvTAUpp\files_\system_info.txt
Size 718B
SHA256 b5019b1490903a0a9f953faa932700b135e71a78daa0f0841905178e1cd0ad5c
MD5 d889cd1d210178cb362bb6f2d38d98f5
SHA1 ce3e39c2416b91049917b91775aaf43f09397294
SHA512 a62eea162fb6a72262559c11568e35766047b3deb496f7803d403d7d0fd9260c3fe939944ba1992bbeceeac0044f6ce75254fdd6a6a4caf7f344c2d2f040499a
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\gRrEtYvTAUpp\files_\system_info.txt
Size 5KB
SHA256 6515c4d126d54886150f00c8fbf4dfe981b732a81fa0916fab9e6035cceeeda0
MD5 bea138dda7d09327bbef431cc154d1ed
SHA1 745c8a3562c480fdd21cb148dc1c2e3f89156962
SHA512 295e7378d7912542f15ade2d65bb359c4f40f467a5959b8d0296bca03f2ff08d86a477800eca31e6f8837e20944e10a26c3eca12bc1d9332b3c048a8e6d23a46
SSDEEP 96:VjYtewRHjhSDqHHcZmcnmB4Mc6zOgT46HzBs6cnp:dkHjh1R59f2
MD5 SHA1 SHA512 SSDEEP

Submit Download

uYkiXzUwyJh.zip

Path C:\Users\Admin\AppData\Local\Temp\gRrEtYvTAUpp\uYkiXzUwyJh.zip
Size 43KB
SHA256 020f722773cb723fe4f09d78b0564f1670ef9b2400d189e2715562d0119d4402
MD5 80eb2bf298040100a6c133fc6e1f0a57
SHA1 983b1282e25bc92db092fff4ef6f53634048306e
SHA512 059dc8171be6624c3778cbabd538011954d76e49f79e0b5195c3da10d343d1d1f95c4b720e70179caa06e774cd41b5891722be3d88aeb2ee51327ab7f58c831e
SSDEEP 768:2i10oqWNmYf5TczKQr3fysLkTI1efdAga8ILu9Jb1Pl9JWXkMT:2vkNt0h3fVQTI1eO3lLutN9Jz2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1504-4-0x0000000000400000-0x0000000002D13000-memory.dmp

Download

memory/1504-1-0x0000000002FE0000-0x00000000030E0000-memory.dmp

Download

memory/1504-208-0x0000000000400000-0x0000000002D13000-memory.dmp

Download

memory/1504-209-0x0000000002FE0000-0x00000000030E0000-memory.dmp

Download

memory/1504-210-0x0000000004B20000-0x0000000004BC0000-memory.dmp

Download

memory/1504-3-0x0000000000400000-0x0000000002D13000-memory.dmp

Download

memory/1504-2-0x0000000004B20000-0x0000000004BC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads