cryptbot | ab5b6f41f28835258460c41d594de4c2910af1eb7bc48bee78c51b5f676a5587

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

667KB
MD5

bd71cacc925d19e97841949480825962
SHA1

69e0bd8773accf91b5374af59394749624f21bc5
SHA256

c0e25e1afb6e8457a95d10a96a7e97191821b698481f9c73cb8468e09723e15c
SHA512

ae162ec70ccb8857f30eb22aae6b7bc3b851a246ff5e0418bef96f72569497cbf4fdb0200d5d9327e67be9f8c9f1353bc1c920854412c9b33aeb86ce0882b465
SSDEEP

12288:CextvP96hExo7PTMoHbeMGpkEBuxubk6BXrwYewmBFml1ihhCJ4VLt8/nWnDEFX:CevP96hExIivkEW3WXkYdOFmPihIkt87

Score

10^/10

cryptbot discovery spyware stealer upx

Malware Config

Extracted

Family

cryptbot

eressedb12.top

morttttk11.top

Attributes

payload_url
http://dowhhad06.top/download.php?file=lv.exe

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2080-2-0x0000000004820000-0x00000000048C0000-memory.dmp	family_cryptbot
behavioral1/memory/2080-3-0x0000000000400000-0x00000000004A3000-memory.dmp	family_cryptbot
behavioral1/memory/2080-4-0x0000000000400000-0x000000000481F000-memory.dmp	family_cryptbot
behavioral1/memory/2080-221-0x0000000000400000-0x000000000481F000-memory.dmp	family_cryptbot
behavioral1/memory/2080-222-0x0000000004820000-0x00000000048C0000-memory.dmp	family_cryptbot
behavioral1/memory/2080-224-0x0000000000400000-0x00000000004A3000-memory.dmp	family_cryptbot

Cryptbot family
cryptbot
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2080-0-0x0000000000400000-0x000000000481F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

file.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

file.exe

pid process

2080 file.exe
2080 file.exe

pid	process
2080	file.exe
2080	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\PXGK1XnrMisMGh.zip

Filesize
43KB

MD5
ccb8c288961545e7720651ada30933f7

SHA1
3f57082ef13d64e6eae5eee066a647f1bb81d3a6

SHA256
0edf0b5a54ae94c205095d71e8863dc7cb53006b93507f41951bde5b40996573

SHA512
919f66bd1ef783e64d71499a9695746bbe59a7cb6e49be0bd2cbec216d2bc805537e7f86b845981b113a28210af0e32c5fd931b1487ee79bc50cd9b0e5e135ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\_Files\_Information.txt

Filesize
2KB

MD5
df649acf29afbdd975a80afee2ecff0f

SHA1
561eb0c9e2bd171939ecafa9740b389f994db6be

SHA256
aed968f1e7c5bc709909d3e039ff64d6df6c54d3f75312be85809fcbb8aacdbd

SHA512
cb0b4b5035feac238b593c13481e462e824f1d527c980668b2d6c1c370c3c20f7b837f7a08780cf29f49b09f6aed42d51c11f5d20d2eb2926ae94377f2092869

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\_Files\_Information.txt

Filesize
3KB

MD5
7db11f274de2298c7db4a10bcc1e065c

SHA1
d510b1fb3cd693711bf24f8f7761a2bd9abde931

SHA256
26f5fd23cc1adf00da1d1d62b90ada3eba6348b46bfe6e1f88f952dd85e4db5b

SHA512
16cafdd26c8ddbd32973c83fae5e5214b25f15601081ec6fb1473110c5829237fccaaf7b2f715ba48218931b1b357ac53ad512ff39de603b9d1f3821f8938734

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\_Files\_Information.txt

Filesize
3KB

MD5
15dfd701dfe4135b8900874253fc270d

SHA1
cc2433d7c05779fb76e0902e6d9251ee99f74af8

SHA256
4ae9f90238bdc79d667686180e6f59cf9df879dcb65b894059e1dc4ff7c85d6c

SHA512
91e4ed299475025a041fb335eff307039e7fd5203c974b27833b5cfbcbad7b73a2a7cd678384a1fd8363e4ded91e2f2dea1362e544440ff0e374f5c8eebb0aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\_Files\_Information.txt

Filesize
4KB

MD5
9d05adc66a3e3548b297f593250864d5

SHA1
14b2d57b1d92e5ead242ce0ba167fe0b4475af00

SHA256
e57bb55b2efc3d00ad7397f547d1b3922be1cdc85f80db4f3999104442e687b7

SHA512
f2e824e46db3a2f0533f7e47f6c353d9e3db7b05d7c3cd9a2053396a3c756bf6b27abc35490b7c062baf4d33e9025d949af78f1b749fd0338536355b0b30748d

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\_Files\_Screen_Desktop.jpeg

Filesize
49KB

MD5
5eb5d01cce85242b91258ab0f8297ddc

SHA1
96fea6545bdd8a16946462e5d9a2e357587acde0

SHA256
77d18245e218b16dd87740ac893cd15f36166f5b06333ad9ee2528fff1d2654c

SHA512
6d8f78ea88deaa2c98eca5928f4f0de29bcae5cf56228d13a6ad90390f9d4af4594ac12573e1cb018408c1cfd599c947116147e25c5769a7aff7e689c495c562

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\files_\system_info.txt

Filesize
1KB

MD5
9af0760c31888d5ea017f7e409235cc3

SHA1
e53b21a381694eccc7d30596d1b23bbbd36d6a88

SHA256
dc9e640d062e69b04f7bb662b280a5e50405484744dc229a297a53d0a533aba0

SHA512
3df77537b62568d4669e91055cf400abb20022caabddff5c02a85b0900fadcb30a81737cade133b6c85f9ddf9534d6257e7e79aa464c1e916145fa7babf4c1f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\files_\system_info.txt

Filesize
1KB

MD5
90cc680d301904f48064c1be78e07cec

SHA1
d0350473c52da1ff9ac3ff01de3d926fa78c149f

SHA256
94ac494b4b953d5f9d893b83a29067df3ed6d2a5d9e5c27c883f7b0d9f2b2c7f

SHA512
8b573828ef49d7722102b70b00a8f0f21fc3a659edf4536dce527df6a226a9cbee0fdcd76d3ee456a372c3c45d9699cdc5845c96bd4d8f4e37070760f0084f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\files_\system_info.txt

Filesize
3KB

MD5
0e81965a28f244a89891610dbae9a992

SHA1
2437f3203d1f9e60fb4f8708ff5a52c587f76cb6

SHA256
3eb430a14071e530ef3b7882e10494c2faa7610d5aa597eb0794fce492e2b210

SHA512
ef900651040077694f28df6c28fec6e2ad2f7e43b8509ae374f7db6fb407225a83bd0d15e3afe9373439e3c91d9c388b08c4ddc5c4c1a5e6cd905c7581c7a9f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\files_\system_info.txt

Filesize
3KB

MD5
f7b73006deba647f4c71ae65d3705400

SHA1
1d3d70ba336b766d8adfdd093a06fff3a97cd704

SHA256
43be8f987e9f64be31fbec58a0df3936c270025f775c8ca5749a536058a7cfa9

SHA512
e99b327cb44d759c25ff11c41d34c8a310fc52957a3af56b9a54236b647fb03e76c2e05608acf16dc2562cb83bde41cba9542f774edb8bcb76a7fff5581bd304

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8icJpPHp2bn\files_\system_info.txt

Filesize
5KB

MD5
b7d5334357083ea0b0aaf1e06f7c04f4

SHA1
cc6133b50fe45991fe64163a1b3c3c9094583a15

SHA256
90f19e27b9820623830c13b24fd907eb2c7f9e8a76eeec54b53b4d8e25bb7c3e

SHA512
201a69dd12ce086f8a85ce85123e39755bc4e73ae9353909f762827d655390ab506ab3ed217d03831d6551d81ff6112962f91afc26a6066a0b0b42be63ddb9a7

Download Submit
memory/2080-4-0x0000000000400000-0x000000000481F000-memory.dmp

Filesize
68.1MB

Download
memory/2080-0-0x0000000000400000-0x000000000481F000-memory.dmp

Filesize
68.1MB

Download
memory/2080-1-0x0000000000300000-0x0000000000367000-memory.dmp

Filesize
412KB

Download
memory/2080-3-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2080-221-0x0000000000400000-0x000000000481F000-memory.dmp

Filesize
68.1MB

Download
memory/2080-222-0x0000000004820000-0x00000000048C0000-memory.dmp

Filesize
640KB

Download
memory/2080-224-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2080-2-0x0000000004820000-0x00000000048C0000-memory.dmp

Filesize
640KB

Download