cryptbot | 290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328a

Analysis

max time kernel
118s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328aN.exe
Size

6.3MB
MD5

784c9c612df0b52043fa304c680c6ec0
SHA1

f271ab69431e4b03016dee8d8c4e3231f51471c2
SHA256

290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328a
SHA512

68ade75e1118a1aadab099400e66caf20b3dc13854923654313705421c1633ad6635aba2c4cedcec39980b271a05cd6aa9646866b2624422b5e0889de51776e8
SSDEEP

49152:XNRjnEDP0twL5UP4YLmUlp1ZVYYjHPwDaAO24S4Nuhv4hE+GOEWruX4K2CPg4lEi:xcKHPHQ47E+0L4TXyw9hAIUabti

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

thirtvh13pt.top

analforeverlovyu.top

Attributes

url_path
/v1/upload.php

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328aN.exe

C:\Users\Admin\AppData\Local\Temp\290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328aN.exe
"C:\Users\Admin\AppData\Local\Temp\290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-0-0x0000000000400000-0x000000000105E000-memory.dmp

Filesize
12.4MB

Download