cryptbot | 1b53eaa16ac6641e86a2788a36492d11eafe4713e9093ecfc915ece3520440e1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe
Size

964KB
MD5

cc5f1e5ef2d6e4248d67afcbd116a6bf
SHA1

911e7c76c4313782e657ac7da875c30d72ee4c10
SHA256

1b53eaa16ac6641e86a2788a36492d11eafe4713e9093ecfc915ece3520440e1
SHA512

f58dd447d8a47e51e20898aba1db66711e6e96eb6e0aad97e6b4ade9fd1441096166c47c765124795ec5662735a090312ab9e6e720f99951fd04de56454b5695
SSDEEP

24576:+jfEg1rhcZ4zaoanHpcR25cNcUrWnUafkJbSgjEHArn:+jfECrhw4zgck56cUin1famgjEHM

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Executes dropped EXE 2 IoCs

pid	Process
2780	Nuca.exe.com
596	Nuca.exe.com

Loads dropped DLL 2 IoCs

pid	Process
608	cmd.exe
2780	Nuca.exe.com

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nuca.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nuca.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2136	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Nuca.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Nuca.exe.com

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2708	timeout.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2136	PING.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2780	Nuca.exe.com
2780	Nuca.exe.com
2780	Nuca.exe.com
596	Nuca.exe.com
596	Nuca.exe.com
596	Nuca.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2780	Nuca.exe.com
2780	Nuca.exe.com
2780	Nuca.exe.com
596	Nuca.exe.com
596	Nuca.exe.com
596	Nuca.exe.com

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2460	784	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	31
PID 784 wrote to memory of 2460	784	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	31
PID 784 wrote to memory of 2460	784	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	31
PID 784 wrote to memory of 2460	784	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	31
PID 784 wrote to memory of 2468	784	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	32
PID 784 wrote to memory of 2468	784	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	32
PID 784 wrote to memory of 2468	784	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	32
PID 784 wrote to memory of 2468	784	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	32
PID 2468 wrote to memory of 608	2468	cmd.exe	34
PID 2468 wrote to memory of 608	2468	cmd.exe	34
PID 2468 wrote to memory of 608	2468	cmd.exe	34
PID 2468 wrote to memory of 608	2468	cmd.exe	34
PID 608 wrote to memory of 1820	608	cmd.exe	35
PID 608 wrote to memory of 1820	608	cmd.exe	35
PID 608 wrote to memory of 1820	608	cmd.exe	35
PID 608 wrote to memory of 1820	608	cmd.exe	35
PID 608 wrote to memory of 2780	608	cmd.exe	36
PID 608 wrote to memory of 2780	608	cmd.exe	36
PID 608 wrote to memory of 2780	608	cmd.exe	36
PID 608 wrote to memory of 2780	608	cmd.exe	36
PID 608 wrote to memory of 2136	608	cmd.exe	37
PID 608 wrote to memory of 2136	608	cmd.exe	37
PID 608 wrote to memory of 2136	608	cmd.exe	37
PID 608 wrote to memory of 2136	608	cmd.exe	37
PID 2780 wrote to memory of 596	2780	Nuca.exe.com	38
PID 2780 wrote to memory of 596	2780	Nuca.exe.com	38
PID 2780 wrote to memory of 596	2780	Nuca.exe.com	38
PID 2780 wrote to memory of 596	2780	Nuca.exe.com	38
PID 596 wrote to memory of 2936	596	Nuca.exe.com	39
PID 596 wrote to memory of 2936	596	Nuca.exe.com	39
PID 596 wrote to memory of 2936	596	Nuca.exe.com	39
PID 596 wrote to memory of 2936	596	Nuca.exe.com	39
PID 2936 wrote to memory of 2708	2936	cmd.exe	41
PID 2936 wrote to memory of 2708	2936	cmd.exe	41
PID 2936 wrote to memory of 2708	2936	cmd.exe	41
PID 2936 wrote to memory of 2708	2936	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\dllhost.exe
  dllhost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Tornare.vst
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:608
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^wjUhOMsarKOaotchUylODqemzoOcJuGkpaXuydplPdnUbAjekhuYumbwpxUFXVIXrCoQufoDWZZhBoeSW$" Tenerezza.vst
      4⤵
      System Location Discovery: System Language Discovery
      PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nuca.exe.com
      Nuca.exe.com v
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nuca.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nuca.exe.com v
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:596
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\gbvqchDX & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nuca.exe.com"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 4
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2708
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mani.vst

Filesize
1.1MB

MD5
0835edade38808757b7e24299676f501

SHA1
f5eae27723506abb2d0e45fade78cefc5a7b8f27

SHA256
77f1954308ce2fa1243e8598fa72a2fa21eef0dca16cbe6f805b8ef92ec8fb31

SHA512
b7b6f9fdfa0920a4555407b88a1b6aab9c8441c67af94643cc52ff21a5fcfd061207678a5faf2b11cf5ba94ce64680470a0bb4ad9917a7dd6465b78f43149ffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tenerezza.vst

Filesize
872KB

MD5
843351b501e85d27890c499f6a996356

SHA1
d2ebdcf97439eb8778cb9ae5eb3a1d03f0d2f04c

SHA256
ea7e68ff7d3d2f468379094e10f10a5600655a8c0d515476c36546b89ebc5308

SHA512
8b9f7af64adeaf92b698d4a32d720f4ba8e5690b3b8c6aef07fd3bfc58a2c34c9f1944709c416e4f54dcea181e72ed60a0d2cefbc3ddc636e9d45da9c9ebcd4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tornare.vst

Filesize
432B

MD5
4d7edf988ed7da68191339f0e3b0aa76

SHA1
5e74b02b0c6889ea08d81ca2e6391a1ee778b0c1

SHA256
7a6b9e5716530c8f9eecb98172185fbc4ce8a1a82225a91b2fa50cd70919cae0

SHA512
e3164efd9dca85f05f04d72e7ca6390c7452f34455ff9242919cdc960e86dc8b4dfb87ab0878c79649874f479a18e05922141ac57c31949b8788ba2e4bbc5437

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nuca.exe.com

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/596-21-0x00000000040B0000-0x00000000040F9000-memory.dmp

Filesize
292KB

Download
memory/596-22-0x00000000040B0000-0x00000000040F9000-memory.dmp

Filesize
292KB

Download
memory/596-23-0x00000000040B0000-0x00000000040F9000-memory.dmp

Filesize
292KB

Download
memory/596-24-0x00000000040B0000-0x00000000040F9000-memory.dmp

Filesize
292KB

Download
memory/596-25-0x00000000040B0000-0x00000000040F9000-memory.dmp

Filesize
292KB

Download
memory/596-26-0x00000000040B0000-0x00000000040F9000-memory.dmp

Filesize
292KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads