Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-11-2024 22:25
General
-
Target
43d43cae0a7432a80a3ea1f12b6d134ee9814a46dbe8d5d7556f6d50f0a1506f.exe
-
Size
4.0MB
-
MD5
d382233f2487e3a80ce6fe3947790698
-
SHA1
e0432fb62e612bfde6c4a177207c96e0f98a3036
-
SHA256
43d43cae0a7432a80a3ea1f12b6d134ee9814a46dbe8d5d7556f6d50f0a1506f
-
SHA512
26ef09c884d7e10d2acbc9c774d16cedad26e1f8e9c5a08b9f09b79baa001e06af7e4d28c87e0c4a091b936dea7ae482d2a730d72390f8b56dd8410929ef2c9a
-
SSDEEP
98304:TOevFArh176FXP44VgUhkB6cIvQeKuYz5mh3J5:TdFAN1anFhk4yeKuYOJ5
Malware Config
Extracted
cryptbot
briybc32.top
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43d43cae0a7432a80a3ea1f12b6d134ee9814a46dbe8d5d7556f6d50f0a1506f.exe"C:\Users\Admin\AppData\Local\Temp\43d43cae0a7432a80a3ea1f12b6d134ee9814a46dbe8d5d7556f6d50f0a1506f.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5de7d7fd8814045c08268042d2d19ee62
SHA1daa516a764b610fdfd3839ed4d71626894b8f0fe
SHA256ea3189ce72e5273d74ac81c76fffedbd121603f3f0b396eded27eb1235d978bc
SHA51270223c7b12c282dfe3e8c683fb168722718395fd88ead596149f2c5fb6f596887c523646877a92af222d2ad8fad69b501b3373c74713a580c2d9ea3b64c83584
-
Filesize
1KB
MD51ad3e5d276e33ade1328293406febc24
SHA110488a2bfda651c8a107a8bfeddb8c0f1582fb63
SHA25655914a376fb35547485125716663f7c5acd2bf7eb1dac689af6443755809058c
SHA512772ca1fdbd575bdbbf52a6dd3780292007a5395a0334dc768cba00b3fb49d8f72a4d4bc527f92b4c1a2b295fa2b3c1c6031670af56ccc6c612baf368f39740a2
-
Filesize
1KB
MD504c622d0e13672b6e7d912b4c08a9673
SHA14e68aa1a2e85d161346c2c74feb26513af6c95d3
SHA256184b0b4c354a0ac3404c770797b40c65ef4a865d6ce577657cc71db08e1658f1
SHA51279dc928bd484237c5bcf12076801b2399c5498ea13d681c1fed10f29a11d6e5193d50f651d29e24d33679c4becd667fe1639a5813f79aad11697ffd4e2c5b524
-
Filesize
7KB
MD5047edb4dacf0262b16b15652507f7909
SHA1f404a13765616c38b62103fc927215e2a148286e
SHA2568571bf7358c84ae0ca5131a18851e42f2aef6e2afbdbc4734aea1fdc184cc12f
SHA51258f06ac800482bb4dda68fa174939c2efc836038b61700efb37668641774e48349d66d4df887876f89688bacdb7c242382384e84c322988c102d8c49d2fcae9d
-
Filesize
9.3MB
-
Filesize
260KB
-
Filesize
4KB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
284KB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
8.8MB
-
Filesize
260KB
-
Filesize
9.3MB
-
Filesize
8.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
260KB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB