cryptbot | 2a322e9c3e95592135d3fb1985ff53c9b78d248ae425c4de91b7715e68cef42b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df499c779ba0a23633ffe355ae86018a.exe
Size 1.5MB
Sample240326-qsr6taec6s
SHA256 2a322e9c3e95592135d3fb1985ff53c9b78d248ae425c4de91b7715e68cef42b
MD5 df499c779ba0a23633ffe355ae86018a
SHA1 7e847abd9d72174d4fc4959848e0e56d5cddf06f
SHA512 e3a8b2a1741a7dd5d87ee7cbcd6ff12f548ec0e1b4507fb6c13329f2a801a8b0c1b2bab1a6e2b8071a1cd68f44f8a21b4d8e1d413bc0cbe9eb816290406d913b
SSDEEP 24576:+GR9qG5qez9Y7WINzgZIVVeZtHfuRHFNXkGM7pGJnzEhPijf9LOvOL1g2Vf:+q9qiK/NgZsVCH2RnK7Uzd9qi1/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Extracted

Family

cryptbot

ewabpl55.top
morexn05.top

Attributes

payload_url
http://winorm07.top/download.php?file=lv.exe

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 5 IoCs

resource	yara_rule
behavioral2/memory/3112-25-0x00000000043F0000-0x0000000004493000-memory.dmp	family_cryptbot
behavioral2/memory/3112-26-0x00000000043F0000-0x0000000004493000-memory.dmp	family_cryptbot
behavioral2/memory/3112-27-0x00000000043F0000-0x0000000004493000-memory.dmp	family_cryptbot
behavioral2/memory/3112-28-0x00000000043F0000-0x0000000004493000-memory.dmp	family_cryptbot
behavioral2/memory/3112-236-0x00000000043F0000-0x0000000004493000-memory.dmp	family_cryptbot

Executes dropped EXE 2 IoCs

pid	Process
3888	Giovine.exe.com
3112	Giovine.exe.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	df499c779ba0a23633ffe355ae86018a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Giovine.exe.com
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Giovine.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
492	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3112	Giovine.exe.com
3112	Giovine.exe.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3852	2520	df499c779ba0a23633ffe355ae86018a.exe	88
PID 2520 wrote to memory of 3852	2520	df499c779ba0a23633ffe355ae86018a.exe	88
PID 2520 wrote to memory of 3852	2520	df499c779ba0a23633ffe355ae86018a.exe	88
PID 2520 wrote to memory of 4152	2520	df499c779ba0a23633ffe355ae86018a.exe	90
PID 2520 wrote to memory of 4152	2520	df499c779ba0a23633ffe355ae86018a.exe	90
PID 2520 wrote to memory of 4152	2520	df499c779ba0a23633ffe355ae86018a.exe	90
PID 4152 wrote to memory of 872	4152	cmd.exe	92
PID 4152 wrote to memory of 872	4152	cmd.exe	92
PID 4152 wrote to memory of 872	4152	cmd.exe	92
PID 872 wrote to memory of 4748	872	cmd.exe	93
PID 872 wrote to memory of 4748	872	cmd.exe	93
PID 872 wrote to memory of 4748	872	cmd.exe	93
PID 872 wrote to memory of 3888	872	cmd.exe	94
PID 872 wrote to memory of 3888	872	cmd.exe	94
PID 872 wrote to memory of 3888	872	cmd.exe	94
PID 872 wrote to memory of 492	872	cmd.exe	95
PID 872 wrote to memory of 492	872	cmd.exe	95
PID 872 wrote to memory of 492	872	cmd.exe	95
PID 3888 wrote to memory of 3112	3888	Giovine.exe.com	97
PID 3888 wrote to memory of 3112	3888	Giovine.exe.com	97
PID 3888 wrote to memory of 3112	3888	Giovine.exe.com	97

C:\Users\Admin\AppData\Local\Temp\df499c779ba0a23633ffe355ae86018a.exe
"C:\Users\Admin\AppData\Local\Temp\df499c779ba0a23633ffe355ae86018a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c HrqzmfaF
  2⤵
  PID:3852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Peso.png
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^wxKhHHNxSLiwkTrWsbTamRtjJEGsCMBkhjCzFxGRMlEsiYJsbHRtlyNldnEewcSylWNYdJsXQeFfjMtKVgUUVvqomariQDQss$" Sconvolge.png
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Giovine.exe.com
      Giovine.exe.com g
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Giovine.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Giovine.exe.com g
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:3112
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 30
      4⤵
      Runs ping.exe
      PID:492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6ZboQLrlm3njpV.zip

Path C:\Users\Admin\AppData\Local\Temp\68X36nXKdf\6ZboQLrlm3njpV.zip
Size 38KB
SHA256 a0092f7c23e9a79f4fcf2a27b59114a967dcf2a268578f5faf373690fd7232f2
MD5 84663f66cfd92eb13699dd0d7c8b0ea9
SHA1 d8985a875dbf3a1a26be6f6eb3088d527a257b39
SHA512 9b0574a61395e6a2a9f012a5e36325e0844ffc3a5db7ae4d44cd57c5812b72be326b596545ca4dded8e81ef657a43b79ee48589088e017f0c83a6e4bbc6cb802
SSDEEP 768:trE43yIUQEB2U73h7gnIJAFhM2zE1xfMH9inwLpqqUe40SbnlnJT:B3yCoh7SIJahM2zE1UHBUe40Snt
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\68X36nXKdf\_Files\_Information.txt
Size 1KB
SHA256 e467e00ae5e10fc149ebae9be9ba47d486efe9c67afc6c60d23f35da260a9463
MD5 a153a0fc54b63c15b9a8187074a873db
SHA1 b7f4c04d0dbd08cffda771505d18f81c24d7fe8d
SHA512 9d2e8593c13193afa890c0ec25d1387830efedb57c92757df2c415f535b345cd742c703f5d8a6af1dd3b40e7fc7453d20444d530fe4614a7bb5ec302cd87b74f
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\68X36nXKdf\_Files\_Information.txt
Size 1KB
SHA256 734576fa399b422cf1dbfbcbfb8806f9ac62aba0a6d852ba0d4f89726cea895c
MD5 281f66e55c892f8eef133e9a5d774d42
SHA1 36d0eccf46dc9f6a712152c86669a6246bba33b5
SHA512 bc67f567f57cf99bffa513d3cf97d222b9080150de6943b93d67e550cf79ca7ebee6f008533fb317affb1463f8e3953c9767a9fd05877a9921ba4f4b45a75c8f
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\68X36nXKdf\_Files\_Information.txt
Size 4KB
SHA256 836442db66632cda5b7246abc58e3db5ba9c6d839b16b4b5cfeb8ced8f6dcd63
MD5 60ae786a4293b0e835a2c96bd85e1cf1
SHA1 8bf2cd00caad1add7cd33964e2b5cf7bb958af0a
SHA512 530e5ac5dfa3d8ee3f465210de05022a11034951280fa988b7800f0ece9448842611976b56a140f25d898f2a948211cea19345e6de44a6ee8cd233c556830863
SSDEEP 48:sxjUteXxsGpaMQehGYTwTZDWDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+W:slUteByndqDlQHchmcnmB4McIHOUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\68X36nXKdf\_Files\_Screen_Desktop.jpeg
Size 44KB
SHA256 b7f07e489ff9425456e8674867a510d4cf72062b4d499487f73dd278b461cb46
MD5 8623d1f6970e966e0fd4dca57521513b
SHA1 8bfb599be05daefb54bc6b60e1f3b3caa91b980f
SHA512 3f3c188391e61e44dac876db118d480387051e99e3591891c4c131381bd3d025004124d980414a4bb1a9cc9d13598c96024da4f60ddb0e6ca7e847909b4c8246
SSDEEP 768:l27tQ6Xan+7/PE/QfNXJiEE3gAP9QmKgcZrqYdVWq6Fc9YJdI49kXRcZfGAl:lau2J/POQfhJiEX+9QB9ZlaJS9ofQRJQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\68X36nXKdf\files_\system_info.txt
Size 4KB
SHA256 68a3df3c0fa934c0731e98823c16325b60b7da0997ad814f34e5cc3db4930ee0
MD5 53017dbce6b18e0e8004254f2a0a6d9d
SHA1 7f2fc330d2ad16487f55574faa6cea95b300bde0
SHA512 72f1b69aaadfc51e2eecb3db40d1feaf4390cd9c56fc285db0ad62ac0ab9cb13efa2ede30ecac8b7cde4b1f916be9da59114b155a4df4c61141f63f46450aee3
SSDEEP 48:cQYte8x8a5OhGYTQ5zeDe7iGqXpE4be7rHcBOkRmcn+jYyrJB4McbZAaN+A3ZN+Y:LYtewThSDlQHchmcnmB4McIHe
MD5 SHA1 SHA512 SSDEEP

Submit Download

inkt7mnX.zip

Path C:\Users\Admin\AppData\Local\Temp\68X36nXKdf\inkt7mnX.zip
Size 38KB
SHA256 bd9138dd4813c3f9f01674137367af4d855f9c34d6b7fbc963b2389f0ae3750f
MD5 1e4d48d4e82e5a1814d4b4b78c4b80ff
SHA1 2a95032efa959cb231906a1a1e72bfda30be924d
SHA512 4efbaf2b5dc562232f556489b1d06b388bad42cca0d67377e932866410172d970d4d0d2a64d0d92e9ab7993b8537291a6d31ca60d02f0ca319901eb781879a82
SSDEEP 768:irE43yIUQEB2U73h7gnIJAFhM2zE1xfMH9inwLpqqUe40SbnlnJcJl/:23yCoh7SIJahM2zE1UHBUe40Snq/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Giovine.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Giovine.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Par.png

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Par.png
Size 774KB
SHA256 125c176b43b52984ddccb81e906d8d7332dfa1399c9be6a64ff6d438a7ea4df8
MD5 a08c407f236a0e6a2a32c88fb95d82d3
SHA1 70c78af326e46bcd143321fb382f7036571a0126
SHA512 fdfa30f93f3b8e9ea449c9863b743f14f29827da911a7d225ea663af3326c2c7ea5f56c30fccbef9e83e8b24c710a807f4424a872fda2d1135689b812cd1498d
SSDEEP 6144:vJ9priDzBQ+5CsWIErekx0TsKVCDXeobVCrX8N6oqjaJIp8FtdsQYCCAXG:vJ9EBQ+OPr1x0T9gN6IipKtdgCRXG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Parlato.png

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Parlato.png
Size 634KB
SHA256 3a88f4c24d7a754ffb8d3f0081f8b4e446c1a192e1653ac42ef5209e32cdea1f
MD5 148a049bd682bfccfbc6d39a536389ec
SHA1 060448bb6cf27d1a9dad07f1afed9b20deeb4851
SHA512 4ca76acc89431422021b9599179b4194d85303a30a60076d0cc038df348eca2d90fed257d09a698583eaddb9e3eb00988a4d32967efa42155742587ed678ea5f
SSDEEP 12288:DRsK6/GFjTbGqx3vn7d7G9d4wnyuH0hri4sZYBvNMKz/YHi2O+kB+gYDH8kvr:DRsFIjHGInpGjnN0hGUNMKLODOLIgOFr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Peso.png

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Peso.png
Size 457B
SHA256 0bb716e563884454ce59c1e542f811e0217df3b6a4bf2fe73903ca811053f05b
MD5 5037c7050b11cdc0ed2086365973e26c
SHA1 86cea22e1db15c8fc46cd17955fde58c95d2f6ff
SHA512 e08cd5b36ce35a1009d3c24c1fb9728e469c2c7cddc4effc1d85a8e6cf769f3c9cf0946a48b607bd559fc77de6637830370e110f6f56fe8cd1953c8329bc8722
MD5 SHA1 SHA512

Submit Download

Sconvolge.png

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sconvolge.png
Size 872KB
SHA256 fd2154d917d47cf77002b8fdd66f5083e66665d90bee5dfa39f289d6a86c0a11
MD5 f8723d9cdd9daac10ff0785d75cbbda8
SHA1 501f9d9ecd670cc5ab563fe44a32921c6d2e404a
SHA512 a68cf17a9d9b19603999f8a046f3a454de4b72ce5ef38927159ab36d20d3adecd8ef08ed056286f923b658963b95ff2333eeb6bcf53a16d297778baa313a8296
SSDEEP 12288:WpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:WT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3112-21-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/3112-28-0x00000000043F0000-0x0000000004493000-memory.dmp

Download

memory/3112-27-0x00000000043F0000-0x0000000004493000-memory.dmp

Download

memory/3112-26-0x00000000043F0000-0x0000000004493000-memory.dmp

Download

memory/3112-25-0x00000000043F0000-0x0000000004493000-memory.dmp

Download

memory/3112-24-0x00000000043F0000-0x0000000004493000-memory.dmp

Download

memory/3112-23-0x00000000043F0000-0x0000000004493000-memory.dmp

Download

memory/3112-236-0x00000000043F0000-0x0000000004493000-memory.dmp

Download

memory/3112-22-0x00000000043F0000-0x0000000004493000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads