cryptbot | cff579e5facdd493e0b023979049f4504ffc611c352a7d97928943e61c66dd0d

Resubmissions

01/10/2024, 14:05

01/10/2024, 14:03

01/10/2024, 13:36

max time kernel
73s
max time network
80s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
01/10/2024, 14:03

Target
Set-up.exe
Size 9.5MB
Sample241001-rct6xashpl
SHA256 cff579e5facdd493e0b023979049f4504ffc611c352a7d97928943e61c66dd0d
MD5 bb85c40120dac356bfc311f4774d3439
SHA1 bdcc094a88aa8971753da0c86e05c68578e5ce84
SHA512 d15e22befdcc9de94b68552e87d3175694e5d70cc4577d9916a523e34bbaee65991730fe71cc4075561c7247ff8d8e7126ce1b4a7f795d2fa3c7276604a32e05
SSDEEP 49152:G+ACxZPpFDaaekodusejnK99nJeO+3nXn0Ext9V6qrzDTAQg0JZ+Wm+vfYM8sF1K:G+zxZxhUkIeG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2272	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 2272	4156	Set-up.exe	76
PID 4156 wrote to memory of 2272	4156	Set-up.exe	76
PID 4156 wrote to memory of 2272	4156	Set-up.exe	76

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3916