cryptbot | 9b720f24c3133ea2b0d5b8ef25aca41674ad918ff28102ab7bc58c854a2ade1f

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe
Size 1.9MB
Sample240724-hv2h9stdqr
SHA256 9b720f24c3133ea2b0d5b8ef25aca41674ad918ff28102ab7bc58c854a2ade1f
MD5 6aac59e965dcd02a613bc6cb9136629b
SHA1 c7326743e762d5141b14a008d37cac59c49397db
SHA512 f368f377011c34d39a5f2a9589b387aae23a050270eef9f6d5504814f48de7fb17d8c8a960b9cfe81bd78772ab6f3b40aba1780ee90a78e920cded38e3f65996
SSDEEP 49152:z5+hFsxVVx311X6DV92q2ngGee43/9bBABER6VfC1Xk5B:z5aFsxVr7qoleV3dBIm6+uB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 3 IoCs

resource	yara_rule
behavioral2/memory/4440-27-0x00000000046A0000-0x0000000004783000-memory.dmp	family_cryptbot
behavioral2/memory/4440-26-0x00000000046A0000-0x0000000004783000-memory.dmp	family_cryptbot
behavioral2/memory/4440-25-0x00000000046A0000-0x0000000004783000-memory.dmp	family_cryptbot

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Manipulates Digital Signatures 1 TTPs 3 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3640	Chinandosi.com
4440	Chinandosi.com

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3616	certutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chinandosi.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chinandosi.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4544	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Chinandosi.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Chinandosi.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4544	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4440	Chinandosi.com
4440	Chinandosi.com

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 1488	3972	6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe	87
PID 3972 wrote to memory of 1488	3972	6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe	87
PID 3972 wrote to memory of 1488	3972	6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe	87
PID 3972 wrote to memory of 4372	3972	6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe	89
PID 3972 wrote to memory of 4372	3972	6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe	89
PID 3972 wrote to memory of 4372	3972	6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe	89
PID 4372 wrote to memory of 2392	4372	cmd.exe	91
PID 4372 wrote to memory of 2392	4372	cmd.exe	91
PID 4372 wrote to memory of 2392	4372	cmd.exe	91
PID 2392 wrote to memory of 1988	2392	cmd.exe	92
PID 2392 wrote to memory of 1988	2392	cmd.exe	92
PID 2392 wrote to memory of 1988	2392	cmd.exe	92
PID 2392 wrote to memory of 3616	2392	cmd.exe	93
PID 2392 wrote to memory of 3616	2392	cmd.exe	93
PID 2392 wrote to memory of 3616	2392	cmd.exe	93
PID 2392 wrote to memory of 3640	2392	cmd.exe	94
PID 2392 wrote to memory of 3640	2392	cmd.exe	94
PID 2392 wrote to memory of 3640	2392	cmd.exe	94
PID 2392 wrote to memory of 4544	2392	cmd.exe	95
PID 2392 wrote to memory of 4544	2392	cmd.exe	95
PID 2392 wrote to memory of 4544	2392	cmd.exe	95
PID 3640 wrote to memory of 4440	3640	Chinandosi.com	96
PID 3640 wrote to memory of 4440	3640	Chinandosi.com	96
PID 3640 wrote to memory of 4440	3640	Chinandosi.com	96

C:\Users\Admin\AppData\Local\Temp\6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6aac59e965dcd02a613bc6cb9136629b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo RZlodyg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Cancellata.vstx
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^EyygdRtGYTTNfjKbHRxWDPoJPWizQHLVjQqxxmuSAaVvnDYVApSXhtAOXcmzJKQdiYBnjdriLCckULkkXjSHP$" Sua.xltm
      4⤵
      System Location Discovery: System Language Discovery
      PID:1988
  - - C:\Windows\SysWOW64\certutil.exe
      certutil -decode Ora.dot E
      4⤵
      Manipulates Digital Signatures
      Deobfuscate/Decode Files or Information
      System Location Discovery: System Language Discovery
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\vzEhTwpHbBg\Chinandosi.com
      Chinandosi.com E
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\vzEhTwpHbBg\Chinandosi.com
        
        C:\Users\Admin\AppData\Local\Temp\vzEhTwpHbBg\Chinandosi.com E
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:4440
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\SyyhDSCjKoE\_Files\_Information.txt
Size 1KB
SHA256 cee5c36ce83863ba26df08dd69048b6fb327609ee7da91ef4bdbe368d27d2a7f
MD5 d3e11236233468b858d9ee87a34957c4
SHA1 28e9592a6b6ba2900c2ec0600766c85e97d06a30
SHA512 00970d042f32c14b7870467d52e3b3a6d25db29e7e85e796b10067962405689132921c956d7223f2b65265facb497082724a6425aa2f82e6d56091ad0a4d9ea6
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\SyyhDSCjKoE\_Files\_Information.txt
Size 3KB
SHA256 ca6823b5e21ae8d6c545c18807bf2300a140fd28ece42758aa2a9f3fe0864660
MD5 6e9bab98b62ba5b94e3a9b9ab66df668
SHA1 0d338ec0f5d73b3407bb8562ba5a813418fa0185
SHA512 d71dde61d34fa8f8b7c6672872cfc3c8d792759e894917a85bbcbe2a30ac50d8f559d0104719df495526283d963bf01e60435d4a13b8059afa0621399f528fd5
MD5 SHA1 SHA512

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\SyyhDSCjKoE\_Files\_Information.txt
Size 4KB
SHA256 48c63a58f9a1d294bd1d3b4cac712b032fa9e293a843f234e2239c5ec5b81aa1
MD5 30e3013d5c0bb9a8cbc1cf00fb8c35a5
SHA1 6115333430c9e6b242db948d273cec77b48cf05f
SHA512 325c317b8355ed3ce91e3e93e5fa672bddba72b30cacbf3c3de9e017c06dd71aeb704f6d2f37005072aff123cce98bcf7e0249cbc81f0d09184a0f3e2a85c772
SSDEEP 48:sx/pUteXx7paMk7ehGYTwTZDWDe7iGqXp+be7/UHcBOOmcn+jYyrJB4Mc7AaN+A5:sJpUteBondqD8HHcZmcnmB4Mc68hp
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\SyyhDSCjKoE\_Files\_Screen_Desktop.jpeg
Size 54KB
SHA256 0855d6df6203ce38173219f6c0dc2e0234a9b63dc1e687fe692954993f4711a3
MD5 50747d7012f457f2ce8329e987e06876
SHA1 a77de18196919ef316985fcc3a9170b2cfbe5c2d
SHA512 e4f46224eaa61b2ac17d593642aef5def15adaa4097d12030fcd0aa1b86940d91cee59e8b8af4dfa2938d3296b6893a760d69f0a71d9a4dcacc6fd381b036cc1
SSDEEP 768:mXIaFPUM7gKRKvsy9vW2SFMh2j/Yr37/36FU9YSHoWcZL/6TpUJY7L0:mXILMsKRKvsUSup7D36FlSrGQL0
MD5 SHA1 SHA512 SSDEEP

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\SyyhDSCjKoE\files_\system_info.txt
Size 1KB
SHA256 39f177d44817ac2d0df3cca4e33f79c6ffc9e1f6e0e17b789a57efae70832795
MD5 23504ff5befcc1527104e65d5c41e78a
SHA1 9765b8c690fd67879c58e82ea9fb8790b033b0d6
SHA512 3100d370e7aea07be604f1ebd3f38979ce5cb1c8f883c485255a15752d54eedb26003a9d788544350e3783963451318c5b546506cf1e3045baa6c63d4efa9e82
MD5 SHA1 SHA512

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\SyyhDSCjKoE\files_\system_info.txt
Size 7KB
SHA256 46bd9e80d383c9c7a23b18a3f3176dfc70731150a91436cec4ae4311f595fa18
MD5 abf971a73ae713f70892cfb12653c9eb
SHA1 43addb4680e3240529973f251ec1b939750dbf86
SHA512 8581001ce593d4921a54bbce4379bcd2548f595ab0f2fc213e4ed62295e25ff673a111dff4bf7acef0a372d012bcff38669dc11c5829f8939d3edde6b40d7395
SSDEEP 96:6aYtewohSD8HHcZmcnmB4Mc68hE0C46HzBs6cnhrcn1wcfsoByYs:FFhfR59TUbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

mtxxqlmLCcWi.zip

Path C:\Users\Admin\AppData\Local\Temp\SyyhDSCjKoE\mtxxqlmLCcWi.zip
Size 49KB
SHA256 f16afcbab25bb4056bcbd7a2715d42fd9ccf46d304a8fa67e5d2e0e216a65121
MD5 847cc87b62cfd1bb11388c2653cfd53a
SHA1 dd19417377bd91cca00c02a67a5099e050e57c79
SHA512 8a61e6559e44a882f9ab75a17b29b1fd11d48b46c8ebfed1c00d2740455463bfeb25aa6d7d7cac5f31d982853b99d5676e67d2a4c122cde59e3dd58285bc2733
SSDEEP 1536:YNnKoQPwVF1z4aMo5bmSFmCdMtAAhm5UoPE:YNbQorZ48ZmSX4hiVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Accompagno.wbk

Path C:\Users\Admin\AppData\Local\Temp\vzEhTwpHbBg\Accompagno.wbk
Size 888KB
SHA256 403a794ade5ac63e2377d154cfdcd475f4238c7bdb33de174d8c9e822cc5b2c1
MD5 268930e4a65e309cad58ff8922259876
SHA1 3a7746d814ae8faa2bed5adb61b945dbebdadb73
SHA512 d8cdc066ff48f7f03555577eefeb74591443713da5ec82ec79d2f2aa6137ea417d0c6b94a53f1385328c5bfe14216a7fe789dd9b79df1c7146c36cf787704016
SSDEEP 24576:4QfgTH85+Y1cHmOinK5DGCe0Vi+fI2diOppwV:4AcY1cHmOiy6Ce0ViYI20OAV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cancellata.vstx

Path C:\Users\Admin\AppData\Local\Temp\vzEhTwpHbBg\Cancellata.vstx
Size 116KB
SHA256 455b3add70b44edb1ed104b70cfda794318fc2c95115c6427f4048a61b2520a2
MD5 a97d749ab189d414ee0bf8838bf27189
SHA1 021c5e8b8ec7145fe09c5d8ae4e47418e90b1824
SHA512 f0c687141522ed482e4876bfe05d128c2aa3fc809b34c0bda39ba395ffd47ac78376cd44f7ff1ef506773bf6906f6c3cea5ad7436e3616a6ca18698903be102e
SSDEEP 3072:mCN2qs8N1RypPx6kljbWeX5DcchugW0ZezZLQvIvHu:m78N1RypP0PeX5Lh/APu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chinandosi.com

Path C:\Users\Admin\AppData\Local\Temp\vzEhTwpHbBg\Chinandosi.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\vzEhTwpHbBg\E
Size 648KB
SHA256 9bf00a96a8fa06103b82a36959763a9ba71b1510037c3220053854d60061748b
MD5 89e82e378029dc7641112f6bd8ee7325
SHA1 78cf6a4dba0965cc5b26ae4782765f7401024421
SHA512 940d9c7a868bb0210bbc3a09c8699c952a55f052f46ff0ba74efc2fb2e20003eb2ee4d5d10c63d4c9b4e749edd563a9505e8de5186d73f464e277d523948e4ba
SSDEEP 12288:j38ce1KkPPydGjP6ubCK6vnFvot68oTN6O+Jw90jTz0l9UDQ6P+ChxbivRT4ob9G:TDezPyGjPzCVvn9hFl+u/S1+ChxbiNJk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ora.dot

Path C:\Users\Admin\AppData\Local\Temp\vzEhTwpHbBg\Ora.dot
Size 893KB
SHA256 19c75de43ab3c52c82a730cd4fe72d2b372edfc4c2f094900df41b674384b2eb
MD5 33bd0e86707af7071d7702d3186701fd
SHA1 92d19367f009c7dd8e835fe241cace49c8067e5c
SHA512 bd08959439aa837982b07f49f6e97723aef1dab301f3a238297edbed73e02e4cd57038f2794a252cf579506a494895ab3257c277efbbc0347543e7e68c3e40dc
SSDEEP 12288:g7u32zmKdKzkmQy05DkTqxEqu1M8MwbjsNa9PLWlLWJtMxnPM6IbsiqPJjwmOoRv:OXHq+3FOQ1on9JbvmB2jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sua.xltm

Path C:\Users\Admin\AppData\Local\Temp\vzEhTwpHbBg\Sua.xltm
Size 921KB
SHA256 ca6fee946a9e7d19777dbc20dc66159aab27e10481629081ec8239b4e2a95c4d
MD5 ecca96795fd870ead982d7ffddf4f0e2
SHA1 cbf5c600d635929be34add30dcf67ee36a010e76
SHA512 6a86ddc8e93c40168f3bbf93df078435ed1b5a45aa9498d829aa84e9a8ad64a7536f98f8739553577aa67118b881c9a214b4db81d45522426690d390f7fcf96f
SSDEEP 24576:pJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:pC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4440-25-0x00000000046A0000-0x0000000004783000-memory.dmp

Download

memory/4440-26-0x00000000046A0000-0x0000000004783000-memory.dmp

Download

memory/4440-27-0x00000000046A0000-0x0000000004783000-memory.dmp

Download

memory/4440-23-0x00000000046A0000-0x0000000004783000-memory.dmp

Download

memory/4440-24-0x00000000046A0000-0x0000000004783000-memory.dmp

Download

memory/4440-22-0x00000000046A0000-0x0000000004783000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads