cryptbot | fecbe8e5d8910afd9f194e553de108b17085fa3e3ce5bf4986833359b538852a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe
Size

1.6MB
MD5

ed4c7afb6f5313c21dff7d5e82cd336d
SHA1

89bf720908032564dc214f96f443b6cfe7ed9852
SHA256

fecbe8e5d8910afd9f194e553de108b17085fa3e3ce5bf4986833359b538852a
SHA512

5288b3fde5500a9b7def97e0eae3be41b81db12a28885d516a67c5e63068f0d37aba0924d840523b4339908a4451010726b836610c5ae2a6cdaeda37900c8ba6
SSDEEP

24576:fMB6KAGPVTCwXCjcQg4o68pabOU8R7EnPA8UTkYLCzb7HIQvsbU8C:UBvAoVmOVDb68IzMInIdTkDbfvuE

Score

10^/10

cryptbot credential_access defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 3 IoCs

resource	yara_rule
behavioral1/memory/668-23-0x0000000004500000-0x00000000045E3000-memory.dmp	family_cryptbot
behavioral1/memory/668-25-0x0000000004500000-0x00000000045E3000-memory.dmp	family_cryptbot
behavioral1/memory/668-24-0x0000000004500000-0x00000000045E3000-memory.dmp	family_cryptbot

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Manipulates Digital Signatures 1 TTPs 3 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe

Executes dropped EXE 2 IoCs

pid	Process
2676	Dov.com
668	Dov.com

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2904	certutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dov.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dov.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1212	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Dov.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Dov.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1212	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
668	Dov.com
668	Dov.com

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4232	4828	ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe	82
PID 4828 wrote to memory of 4232	4828	ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe	82
PID 4828 wrote to memory of 4232	4828	ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe	82
PID 4828 wrote to memory of 2400	4828	ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe	84
PID 4828 wrote to memory of 2400	4828	ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe	84
PID 4828 wrote to memory of 2400	4828	ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe	84
PID 2400 wrote to memory of 4680	2400	cmd.exe	86
PID 2400 wrote to memory of 4680	2400	cmd.exe	86
PID 2400 wrote to memory of 4680	2400	cmd.exe	86
PID 4680 wrote to memory of 2760	4680	cmd.exe	89
PID 4680 wrote to memory of 2760	4680	cmd.exe	89
PID 4680 wrote to memory of 2760	4680	cmd.exe	89
PID 4680 wrote to memory of 2904	4680	cmd.exe	90
PID 4680 wrote to memory of 2904	4680	cmd.exe	90
PID 4680 wrote to memory of 2904	4680	cmd.exe	90
PID 4680 wrote to memory of 2676	4680	cmd.exe	91
PID 4680 wrote to memory of 2676	4680	cmd.exe	91
PID 4680 wrote to memory of 2676	4680	cmd.exe	91
PID 4680 wrote to memory of 1212	4680	cmd.exe	92
PID 4680 wrote to memory of 1212	4680	cmd.exe	92
PID 4680 wrote to memory of 1212	4680	cmd.exe	92
PID 2676 wrote to memory of 668	2676	Dov.com	93
PID 2676 wrote to memory of 668	2676	Dov.com	93
PID 2676 wrote to memory of 668	2676	Dov.com	93

C:\Users\Admin\AppData\Local\Temp\ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed4c7afb6f5313c21dff7d5e82cd336d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c IlzHyPgZ
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Cuori.vssm
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^KUoEBHCMiYpopnQGPhEjiJJyoDQFPEgmqUfcHUUEsBGljdJtStLAwKjqlecXQWWCJJogocZVzZVFrmTSUMMLTOnfHgkEmWOxFrACoxVbtQu$" Hai.eps
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
  - - C:\Windows\SysWOW64\certutil.exe
      certutil -decode Rivederla.xll r
      4⤵
      Manipulates Digital Signatures
      Deobfuscate/Decode Files or Information
      System Location Discovery: System Language Discovery
      PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dov.com
      Dov.com r
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dov.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dov.com r
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:668
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Cuori.vssm

Filesize
100KB

MD5
48fc5df4b5d13cb03b387cfc3330bb7e

SHA1
7fd1af95c1cdd7905303e5fe48ddf49a52949c19

SHA256
fceefb42f8b00ffeb91c4bed145b1535f6c3c6a6877b10ea6a2b02d35862e875

SHA512
7f73209b7a09af40e284feecde82008d8cb2856fac88c0c92afb7dfd2e45d83aee3381e9ab44cfbf1af18bf4421071b81b6193394fd9fcb729d0e5ed71e099d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dov.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ero.ppt

Filesize
888KB

MD5
0ee61ffe28c99c5c20a79657fd417eb5

SHA1
dffc49856cbb46be791f2718bc698d27c301bb6c

SHA256
6d27cd28953fb629edf1c5149a4f4ff2fa31f08d097897be9573d5cc79d59dfe

SHA512
57c7a2f856546ff736789eba07aeeb2cf5ed9a4b1bf4257f0a25c5906fba3f7ef2218322f95b7a4ad846321835d3981bf654c57a55d1658e4a312d879ea0372d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hai.eps

Filesize
921KB

MD5
23b4013f4e7f7376f60cf5c77c230806

SHA1
2ea20cce8408590c1f82d933dccafea2a0124a64

SHA256
c0bd1e5073ee6d41b2474772465d7bc44f356cebbdb5a7b7adfa93331feb648a

SHA512
698a096d389a68e831e4f7b183367962c7dccd9cb9d49d94b0b41712754981c711c9b3e93cacda74783b5d9ae2154395133124e241019ec231a61b27ed8a90ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rivederla.xll

Filesize
439KB

MD5
4a90b3241e5b9515dc2cd8ba94f520f2

SHA1
b1e47d3d1f31d45b61f3bbc390afc90796f2d132

SHA256
420befdcc9129772c24e6f24c5f9bce595fe1b09eb8b774c2cf448007dc15c51

SHA512
4406f3bedba2e4ee6482853730bee225b78a9c9f665afb323acc94f83d380cbdb28340c10b696a10a2607acf45c17a0fd4514457818f23eff5e66f78ecf91a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r

Filesize
317KB

MD5
bf68de35909e11b7d601b44f732707f7

SHA1
d9bfe81b6f9b2b0743b9a868f2952948acc114f3

SHA256
3315dfb5f740dfc50d5807529d5a538274d56d215b8f07289f70f04d14ac2233

SHA512
cca962149a855280998d9d137ede3f361d3873857556c60914bcfc908c61ea2fb8faf4e6d7fbef39f8a82d015be9388b3d52e8d0e59bee0092242b22459fe865

Download Submit
C:\Users\Admin\AppData\Local\Temp\mIMnpYpN\_Files\_Information.txt

Filesize
7KB

MD5
38bb30f40a9693a0de452c9f434ea4f6

SHA1
bce091976a400055a5ee3c04ad520e75a3d5aaa0

SHA256
d5a1361723b52f9d7c23448d6e1601897ab64ddd14917c5974d273e7ac283406

SHA512
e16e22ce1ca9d861dafd9c94d222a5f6021321be5536032c402481e9eb352768cce5815cd805e478c8cda64ebfa4ac33222137f9a574e2b7114da16b20030122

Download Submit
C:\Users\Admin\AppData\Local\Temp\mIMnpYpN\_Files\_Information.txt

Filesize
7KB

MD5
88e82e650ec4f8f1fedafae754d881f1

SHA1
9c5ebd0448012f41370d33b161c0ba6a1846830d

SHA256
f2265114cb7dee332361252e5b8a1a54bf1bc5cbd735240b43e975a1c1f307ac

SHA512
a89823e36b2bf0c02d41765492d2024876bf5e75b4c5104478067db758452f886b7ed40db5d83148444387c3b3a63b0152053c820a1a4a8bbadfb05a5e94e2ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\mIMnpYpN\_Files\_Screen_Desktop.jpeg

Filesize
52KB

MD5
70a47a0cf0107538da71b6161139d97d

SHA1
b630e2162070961e9ba6e64605ab23d5cb88c451

SHA256
006f0e4892b30a0e7c4acf8136d86b2f8f529f20d02a7694e67f6265c8c9fda9

SHA512
5c196570dd1896a355649914a93bd841c30a0de18cc7e1e82c6acbafdbe682026527dcb50244e2b05ca4260ae8a7f61b5e857f0c0d5766a737892112fcbbd32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mIMnpYpN\files_\system_info.txt

Filesize
1KB

MD5
2d8085b723e2517082566ddc193a5712

SHA1
c54a1619b714cc001f9d3fdbd9b32e318bf78d30

SHA256
f95a1f947d442a28e1f99abcc4db66d9fe9a664efa87dcca42dcfad6e8949ad3

SHA512
efd017d29678f27ed83726b4f5b8f82bf5a399a65024b7244321a86123a4ff57e63f8aae998a3acfd8ba1281d17d3b26fcdf2d193bf5d4e639494353bbbf5352

Download Submit
C:\Users\Admin\AppData\Local\Temp\mIMnpYpN\files_\system_info.txt

Filesize
7KB

MD5
1a33dfc1c7f27db9345965bc29bfaf93

SHA1
3626998e54c75de5cd5ee8bc7585bc3613ab7d54

SHA256
ff114c564952aa258f04ae7db5367af4dd073352fdad08c3b2b2b463f15e1345

SHA512
7301975f16a538353278b82251ef730be934683fdbcbeceded9ec1362135c701f827cedcd2c014bf98678bb7d644544cc802fe917ef6791ea54c30497a194ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\mIMnpYpN\tPNGKUTQnBBEDv.zip

Filesize
47KB

MD5
fb4ac6a23d1cd464be47088ac7a4d487

SHA1
9559326d917d9afe7c824f64cad67cfb1270c845

SHA256
7fffd2d2b9d1f8fb592e6bb2150671ae38e4162bde9ad1f423944b78c1ed7a1a

SHA512
f6cb1b10f28a3ca31b020f2e1a9f1040d4fa18f123581f8bbc55d95717a048070c664310f671fff590d5cf05db5ce96848b391304f4d19e9f7206c6101e163f0

Download Submit
memory/668-21-0x0000000004500000-0x00000000045E3000-memory.dmp

Filesize
908KB

Download
memory/668-22-0x0000000004500000-0x00000000045E3000-memory.dmp

Filesize
908KB

Download
memory/668-23-0x0000000004500000-0x00000000045E3000-memory.dmp

Filesize
908KB

Download
memory/668-25-0x0000000004500000-0x00000000045E3000-memory.dmp

Filesize
908KB

Download
memory/668-24-0x0000000004500000-0x00000000045E3000-memory.dmp

Filesize
908KB

Download
memory/668-20-0x0000000004500000-0x00000000045E3000-memory.dmp

Filesize
908KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads