Overview

overview

10

Static

static

3

51ad49a33d...c0.exe

windows7-x64

10

51ad49a33d...c0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 02:32 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe

  • Size

    4.2MB

  • MD5

    0c9ac016b38263da875782e7fd32cd5c

  • SHA1

    c81138a0fd251982dd17ec26efa677a84babbc39

  • SHA256

    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0

  • SHA512

    b0f023a55887b60c1eb432caf2db4a4d90eab5838fd8411e7e7b606da3fa9a53ce8a65f153f9d3ce30cfce82d848a5aae3637bbfca01872233a304efff99a197

  • SSDEEP

    98304:5GAdFqYLoMHlz3zc1V4nplSNwmo4Fd3mFR3c6iSPpp:lXqfIjc1Vypl5m1mP3JX

Score
10/10
cryptbotdiscoveryevasionspywarestealer

Malware Config

Extracted

Family

cryptbot

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    "C:\Users\Admin\AppData\Local\Temp\51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2672

Network

  • flag-us
    DNS
    httpbin.org
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    Remote address:
    8.8.8.8:53
    Request
    httpbin.org
    IN A
    Response
    httpbin.org
    IN A
    34.226.108.155
    httpbin.org
    IN A
    98.85.100.80
  • flag-us
    DNS
    httpbin.org
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    Remote address:
    8.8.8.8:53
    Request
    httpbin.org
    IN AAAA
    Response
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    85.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    85.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    home.fivetk5pn.top
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fivetk5pn.top
    IN A
    Response
  • flag-us
    DNS
    home.fivetk5pn.top
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fivetk5pn.top
    IN AAAA
    Response
    home.fivetk5pn.top
    IN A
    81.29.149.45
  • flag-us
    DNS
    155.108.226.34.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    155.108.226.34.in-addr.arpa
    IN PTR
    Response
    155.108.226.34.in-addr.arpa
    IN PTR
    ec2-34-226-108-155 compute-1 amazonawscom
  • flag-no
    POST
    http://home.fivetk5pn.top/vJNDHPUXPCEIZZjTPbLp1734325090
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    Remote address:
    81.29.149.45:80
    Request
    POST /vJNDHPUXPCEIZZjTPbLp1734325090 HTTP/1.1
    Host: home.fivetk5pn.top
    Accept: */*
    Content-Type: application/json
    Content-Length: 453365
    Response
    HTTP/1.0 503 Service Unavailable
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
  • flag-us
    DNS
    45.149.29.81.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    45.149.29.81.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    home.fivetk5pn.top
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fivetk5pn.top
    IN A
    Response
  • flag-us
    DNS
    home.fivetk5pn.top
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fivetk5pn.top
    IN AAAA
    Response
    home.fivetk5pn.top
    IN A
    81.29.149.45
  • flag-no
    POST
    http://home.fivetk5pn.top/vJNDHPUXPCEIZZjTPbLp1734325090
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    Remote address:
    81.29.149.45:80
    Request
    POST /vJNDHPUXPCEIZZjTPbLp1734325090 HTTP/1.1
    Host: home.fivetk5pn.top
    Accept: */*
    Content-Type: application/json
    Content-Length: 143
    Response
    HTTP/1.0 503 Service Unavailable
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    29.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 34.226.108.155:443
    httpbin.org
    tls
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    1.5kB
     6.4kB
     14
    14
  • 81.29.149.45:80
    http://home.fivetk5pn.top/vJNDHPUXPCEIZZjTPbLp1734325090
    http
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    25.3kB
     784 B
     21
    14

    HTTP Request

    POST http://home.fivetk5pn.top/vJNDHPUXPCEIZZjTPbLp1734325090

    HTTP Response

    503
  • 81.29.149.45:80
    http://home.fivetk5pn.top/vJNDHPUXPCEIZZjTPbLp1734325090
    http
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    514 B
     344 B
     5
    3

    HTTP Request

    POST http://home.fivetk5pn.top/vJNDHPUXPCEIZZjTPbLp1734325090

    HTTP Response

    503
  • 8.8.8.8:53
    httpbin.org
    dns
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    160 B
     250 B
     2
    2

    DNS Request

    httpbin.org

    DNS Request

    httpbin.org

    DNS Response

    34.226.108.155
    98.85.100.80

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    85.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    85.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    home.fivetk5pn.top
    dns
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    174 B
     226 B
     2
    2

    DNS Request

    home.fivetk5pn.top

    DNS Request

    home.fivetk5pn.top

    DNS Response

    81.29.149.45

  • 8.8.8.8:53
    155.108.226.34.in-addr.arpa
    dns
    73 B
     129 B
     1
    1

    DNS Request

    155.108.226.34.in-addr.arpa

  • 8.8.8.8:53
    45.149.29.81.in-addr.arpa
    dns
    71 B
     136 B
     1
    1

    DNS Request

    45.149.29.81.in-addr.arpa

  • 8.8.8.8:53
    73.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    73.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    home.fivetk5pn.top
    dns
    51ad49a33d4116003b1bbfa4be0009c232eb8309728e6903ceebeac326def1c0.exe
    174 B
     226 B
     2
    2

    DNS Request

    home.fivetk5pn.top

    DNS Request

    home.fivetk5pn.top

    DNS Response

    81.29.149.45

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    29.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    29.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2672-0-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-1-0x0000000077A14000-0x0000000077A16000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2672-2-0x0000000000C31000-0x0000000000EB4000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/2672-3-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-4-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-5-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-6-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-7-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-8-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-9-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-10-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-11-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-12-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-13-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-14-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

  • memory/2672-15-0x0000000000C30000-0x00000000018A3000-memory.dmp

    Filesize

    12.4MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.