cryptbot | 2ab57b30d28ddd69e423d7df5e995549e029aa8bbf4bf57bc7c8c95f9aa8c481

General

Target

35ba0fb1e93d396134cf19eab533d9ce_JaffaCakes118.exe
Size

384KB
MD5

35ba0fb1e93d396134cf19eab533d9ce
SHA1

6c99d5a2b027e2294859bd799360bd15a336a5f1
SHA256

2ab57b30d28ddd69e423d7df5e995549e029aa8bbf4bf57bc7c8c95f9aa8c481
SHA512

7da9f54869395b82705bba6cd7836ed49323ef2422520cbdfcec201581cbe346c39fd50b6b036f64e4aca8f82eac4b0b91bc7834d78e4a7dad401ffc2a54ea95
SSDEEP

12288:pQ7JsX++47NntFlkNi0ouu1lL6vazxd6L:p+V9r0ouuPtL6L

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

C2

pactyx52.top

morekp05.top

Attributes

payload_url
http://zuksav07.top/download.php?file=lv.exe

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

35ba0fb1e93d396134cf19eab533d9ce_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35ba0fb1e93d396134cf19eab533d9ce_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

35ba0fb1e93d396134cf19eab533d9ce_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	35ba0fb1e93d396134cf19eab533d9ce_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	35ba0fb1e93d396134cf19eab533d9ce_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\35ba0fb1e93d396134cf19eab533d9ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35ba0fb1e93d396134cf19eab533d9ce_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\teyKxNhfdpOwq\_Files\_Information.txt

Filesize
3KB

MD5
720ebbe8ece22f7685f7a66edf28b836

SHA1
3104fb286a46192db9e27317701c241c9951491a

SHA256
a004f396cefca99180db5051ca162db1d58353fb39de4039b13130e46b097014

SHA512
247fe76fa9899cc76dcb5dd80feeaf9af9c309064b37ecacb1761ed75bc458f2e25b5597d0a6bf0a368ed9cc8455a45f808ce842e2565b6c722074e82a90c4fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\teyKxNhfdpOwq\_Files\_Information.txt

Filesize
2KB

MD5
251146f1b66f5b909f8c5b4520b665e0

SHA1
b6cda35f7fb479073fa29f6706d8dddb53640a7e

SHA256
9dfbfb49428d52fe1c69025a8c579eb08c658237a0562723427212b70ed24e3b

SHA512
36e306a660bbab9a0d8e035c1ff71ba24733f4883829abf792e9042f66dac255c192d589f0d1fa8e53676de6a21a3064c2ed627b213a96995e1d97934effbb7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\teyKxNhfdpOwq\_Files\_Information.txt

Filesize
4KB

MD5
71712f7c13083f95516c094e1cc66780

SHA1
b10ae4980ed79e54f0cb41981519d0dc25b3def3

SHA256
6e16fe751b7792d2cdd4e32f256198c44a42c4a520bc8049d5b8345d00aa0b74

SHA512
30f21f5f7f3068f2f27ddf540caabe349328ce6ce63ccbc2f5cf1be284dc3ab79aecea1894da8e4d966786dde000bd13499b2028d4c45f071ac3dd9dd3cc3064

Download Submit
C:\Users\Admin\AppData\Local\Temp\teyKxNhfdpOwq\_Files\_Screen_Desktop.jpeg

Filesize
48KB

MD5
e434f20c85d4b493ebf2665258b4d4ee

SHA1
7964bcec15a770e00b9e091dce0a570fa31f2259

SHA256
c86ab4a1ee91233ed592bc2ab37596610cf1f7b10604988719b96ab5ddc1ae82

SHA512
434663edb812b9f5a6453535161a51fca81f6d33d42cb4de2ceb286dff595f4b5b717583cae000db28974e6ab4d341e52fe75eeb3135d6ab9d00b5cfbf71c44e

Download Submit
C:\Users\Admin\AppData\Local\Temp\teyKxNhfdpOwq\lpkkHifqSqcF.zip

Filesize
43KB

MD5
9a20095a26aea3da0c55d76be90270c0

SHA1
70037cfdc25079b364e5c62ff8d7bf3b888f4d75

SHA256
3541b9a2d6996e266ee3522bf08c563fe340e32617edbefde79fe71c145325c9

SHA512
5bf63ca8dbcc71608bbbf9507fc7b29bf122ef3eae5ae9e073a7c280c4ecfa6ddd44424650750d4f99696cf3710ba348a945dcb798fd5d56d04c57a3ef3fef75

Download Submit
memory/2980-125-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-128-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-114-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/2980-115-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-116-0x0000000000580000-0x00000000005C6000-memory.dmp

Filesize
280KB

Download
memory/2980-117-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2980-122-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-1-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/2980-2-0x0000000000580000-0x00000000005C6000-memory.dmp

Filesize
280KB

Download
memory/2980-3-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2980-131-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-134-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-137-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-140-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-144-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-146-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-150-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-153-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-156-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2980-159-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing