cryptbot | 1b53eaa16ac6641e86a2788a36492d11eafe4713e9093ecfc915ece3520440e1

General

Target

cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe
Size

964KB
MD5

cc5f1e5ef2d6e4248d67afcbd116a6bf
SHA1

911e7c76c4313782e657ac7da875c30d72ee4c10
SHA256

1b53eaa16ac6641e86a2788a36492d11eafe4713e9093ecfc915ece3520440e1
SHA512

f58dd447d8a47e51e20898aba1db66711e6e96eb6e0aad97e6b4ade9fd1441096166c47c765124795ec5662735a090312ab9e6e720f99951fd04de56454b5695
SSDEEP

24576:+jfEg1rhcZ4zaoanHpcR25cNcUrWnUafkJbSgjEHArn:+jfECrhw4zgck56cUin1famgjEHM

Score

10^/10

cryptbot discovery persistence spyware stealer

Malware Config

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Executes dropped EXE 2 IoCs

pid	Process
4408	Nuca.exe.com
3280	Nuca.exe.com

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nuca.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nuca.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1080	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Nuca.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Nuca.exe.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1080	PING.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4408	Nuca.exe.com
4408	Nuca.exe.com
4408	Nuca.exe.com
3280	Nuca.exe.com
3280	Nuca.exe.com
3280	Nuca.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4408	Nuca.exe.com
4408	Nuca.exe.com
4408	Nuca.exe.com
3280	Nuca.exe.com
3280	Nuca.exe.com
3280	Nuca.exe.com

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1960	3792	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	85
PID 3792 wrote to memory of 1960	3792	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	85
PID 3792 wrote to memory of 1960	3792	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	85
PID 3792 wrote to memory of 3400	3792	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	86
PID 3792 wrote to memory of 3400	3792	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	86
PID 3792 wrote to memory of 3400	3792	cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe	86
PID 3400 wrote to memory of 4436	3400	cmd.exe	88
PID 3400 wrote to memory of 4436	3400	cmd.exe	88
PID 3400 wrote to memory of 4436	3400	cmd.exe	88
PID 4436 wrote to memory of 5060	4436	cmd.exe	89
PID 4436 wrote to memory of 5060	4436	cmd.exe	89
PID 4436 wrote to memory of 5060	4436	cmd.exe	89
PID 4436 wrote to memory of 4408	4436	cmd.exe	90
PID 4436 wrote to memory of 4408	4436	cmd.exe	90
PID 4436 wrote to memory of 4408	4436	cmd.exe	90
PID 4436 wrote to memory of 1080	4436	cmd.exe	91
PID 4436 wrote to memory of 1080	4436	cmd.exe	91
PID 4436 wrote to memory of 1080	4436	cmd.exe	91
PID 4408 wrote to memory of 3280	4408	Nuca.exe.com	92
PID 4408 wrote to memory of 3280	4408	Nuca.exe.com	92
PID 4408 wrote to memory of 3280	4408	Nuca.exe.com	92

C:\Users\Admin\AppData\Local\Temp\cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cc5f1e5ef2d6e4248d67afcbd116a6bf_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\dllhost.exe
  dllhost.exe
  2⤵
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Tornare.vst
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^wjUhOMsarKOaotchUylODqemzoOcJuGkpaXuydplPdnUbAjekhuYumbwpxUFXVIXrCoQufoDWZZhBoeSW$" Tenerezza.vst
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nuca.exe.com
      Nuca.exe.com v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nuca.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nuca.exe.com v
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3280
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mani.vst

Filesize
1.1MB

MD5
0835edade38808757b7e24299676f501

SHA1
f5eae27723506abb2d0e45fade78cefc5a7b8f27

SHA256
77f1954308ce2fa1243e8598fa72a2fa21eef0dca16cbe6f805b8ef92ec8fb31

SHA512
b7b6f9fdfa0920a4555407b88a1b6aab9c8441c67af94643cc52ff21a5fcfd061207678a5faf2b11cf5ba94ce64680470a0bb4ad9917a7dd6465b78f43149ffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nuca.exe.com

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tenerezza.vst

Filesize
872KB

MD5
843351b501e85d27890c499f6a996356

SHA1
d2ebdcf97439eb8778cb9ae5eb3a1d03f0d2f04c

SHA256
ea7e68ff7d3d2f468379094e10f10a5600655a8c0d515476c36546b89ebc5308

SHA512
8b9f7af64adeaf92b698d4a32d720f4ba8e5690b3b8c6aef07fd3bfc58a2c34c9f1944709c416e4f54dcea181e72ed60a0d2cefbc3ddc636e9d45da9c9ebcd4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tornare.vst

Filesize
432B

MD5
4d7edf988ed7da68191339f0e3b0aa76

SHA1
5e74b02b0c6889ea08d81ca2e6391a1ee778b0c1

SHA256
7a6b9e5716530c8f9eecb98172185fbc4ce8a1a82225a91b2fa50cd70919cae0

SHA512
e3164efd9dca85f05f04d72e7ca6390c7452f34455ff9242919cdc960e86dc8b4dfb87ab0878c79649874f479a18e05922141ac57c31949b8788ba2e4bbc5437

Download Submit
C:\Users\Admin\AppData\Local\Temp\KqRbAZOFesgS\_Files\_Information.txt

Filesize
7KB

MD5
850c97c23c36eaf68209b9080f13208f

SHA1
cce3608dbb77d29e68eb2d1c4564219e9c4f9a3d

SHA256
ee5402d84f3d8ab0b64af5a63dfdd6733587dd05ea78510bb7100f275b97e436

SHA512
928c9c0361b6aca02184a04879acc65c8a292c94365443e3482aca906ef4e888fcd31f5241775c5f87c98dfaeec32b1b5630ea56d2a421684f8e715792a19275

Download Submit
C:\Users\Admin\AppData\Local\Temp\KqRbAZOFesgS\_Files\_Screen_Desktop.jpeg

Filesize
53KB

MD5
5c1a8bdeb319b3824599a34b17ea3e99

SHA1
dcd03cac0b9528b16566a7769bf8197b1009f385

SHA256
37da2a6f78c1ed65d632d02cc5f707052d78bb8f99197475a036880f80162c9f

SHA512
14fc2048e5e9578ce24ba1113c8a2c4406859564411df4e998656e2cf05bb0124a1f2e6d1ac87984a379cc5a199fd1d8747c704431c181e934263c7e6383c443

Download Submit
C:\Users\Admin\AppData\Local\Temp\KqRbAZOFesgS\rnwheIvQtpJy.zip

Filesize
47KB

MD5
79d56c44e8cb30a39bfee5f959062a61

SHA1
78f0bf8ac204864b8ff202195d3ae5bba32fff9f

SHA256
c04b20f46394932467ed0a00203937fc8563d0ff1b1a67afbf16344d67aa42c0

SHA512
44546e0631b166a675f085c9eb52714a5cbac596bdaa261bc317a90ad29692e6d87539e0245fcb6d97630994fbdb103032bb25448f2c72b38677552cf58afecd

Download Submit
memory/3280-21-0x00000000046A0000-0x00000000046E9000-memory.dmp

Filesize
292KB

Download
memory/3280-23-0x00000000046A0000-0x00000000046E9000-memory.dmp

Filesize
292KB

Download
memory/3280-24-0x00000000046A0000-0x00000000046E9000-memory.dmp

Filesize
292KB

Download
memory/3280-22-0x00000000046A0000-0x00000000046E9000-memory.dmp

Filesize
292KB

Download
memory/3280-20-0x00000000046A0000-0x00000000046E9000-memory.dmp

Filesize
292KB

Download
memory/3280-19-0x00000000046A0000-0x00000000046E9000-memory.dmp

Filesize
292KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads