Overview

overview

10

Static

static

3

4a81f8193a...f5.exe

windows7-x64

10

4a81f8193a...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a81f8193a4f4bfbf1e6cca16421e0400a1a58e690a854aec5ccafb9e45e1df5.exe

  • Size

    4.2MB

  • Sample

    241119-ezv1haznez

  • MD5

    d37d3a53d7894164e6707847360399c3

  • SHA1

    965a1d3a8952f0b00258fb9f6e694774273785ea

  • SHA256

    4a81f8193a4f4bfbf1e6cca16421e0400a1a58e690a854aec5ccafb9e45e1df5

  • SHA512

    efe78b864ce2a0d48ca0770be7f3403cf2c385a1f55d46103278128cf1c1d9e8291c84bd8ce378e65e26e495753211bdd44f043281d8e1b43cc1c0fcb17d081b

  • SSDEEP

    98304:MZdMx+1giJSfKI73N+YREzLZc5X/cBORLN6IhxDt/C:wdcugisiq34C3RIoxDt/C

Score
10/10
cryptbotcredential_accessdiscoveryevasionspywarestealer

Malware Config

Targets

    • Target

      4a81f8193a4f4bfbf1e6cca16421e0400a1a58e690a854aec5ccafb9e45e1df5.exe

    • Size

      4.2MB

    • MD5

      d37d3a53d7894164e6707847360399c3

    • SHA1

      965a1d3a8952f0b00258fb9f6e694774273785ea

    • SHA256

      4a81f8193a4f4bfbf1e6cca16421e0400a1a58e690a854aec5ccafb9e45e1df5

    • SHA512

      efe78b864ce2a0d48ca0770be7f3403cf2c385a1f55d46103278128cf1c1d9e8291c84bd8ce378e65e26e495753211bdd44f043281d8e1b43cc1c0fcb17d081b

    • SSDEEP

      98304:MZdMx+1giJSfKI73N+YREzLZc5X/cBORLN6IhxDt/C:wdcugisiq34C3RIoxDt/C

    Score
    10/10
    cryptbotcredential_accessdiscoveryevasionspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • Cryptbot family

      cryptbot

    • Detects CryptBot payload

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Modify Authentication Process

1
T1556

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Authentication Process

1
T1556

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

7
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks