cryptbot | 72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 02:41 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe
Size

4.2MB
MD5

03ae071235d37edc3ea30848462bccbc
SHA1

d8425df6c157fc8699596f64a0bf996692ebc947
SHA256

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536
SHA512

2ef13be57bdebf61bf59e7b39a5c522f91ddb9d003a1a9a66b3fa9c7ef35ead57626858050ef2615ed87da4a32759328121e63fb46b2b4ce2f949caeea8871dc
SSDEEP

98304:96/aLUGOI+ds3fWZOf+6hrjqgYyHX83X/x6MmfIOe2AHk5JLr4D5:UyLUBI+do26hflYyHX+J6Zn0uJLr25

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2016	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2016	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe
2016	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe
2016	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe
2016	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe
2016	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe
2016	72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

C:\Users\Admin\AppData\Local\Temp\72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe
"C:\Users\Admin\AppData\Local\Temp\72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2016

Network

DNS

httpbin.org

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

8.8.8.8:53

Request

httpbin.org

IN A

Response
DNS

httpbin.org

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

8.8.8.8:53

Request

httpbin.org

IN AAAA

Response

httpbin.org

IN A

34.226.108.155

httpbin.org

IN A

98.85.100.80
DNS

home.twentytk20pn.top

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

8.8.8.8:53

Request

home.twentytk20pn.top

IN A

Response

home.twentytk20pn.top

IN A

147.45.113.159
DNS

home.twentytk20pn.top

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

8.8.8.8:53

Request

home.twentytk20pn.top

IN AAAA

Response
POST

http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

147.45.113.159:80

Request

POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1
Host: home.twentytk20pn.top
Accept: */*
Content-Type: application/json
Content-Length: 372482

Response

HTTP/1.1 200 OK

Server: nginx/1.22.1
Date: Sat, 21 Dec 2024 02:42:19 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1
Connection: close
DNS

home.twentytk20pn.top

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

8.8.8.8:53

Request

home.twentytk20pn.top

IN A

Response

home.twentytk20pn.top

IN A

147.45.113.159
DNS

home.twentytk20pn.top

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

8.8.8.8:53

Request

home.twentytk20pn.top

IN AAAA

Response
GET

http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322?argument=0

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

147.45.113.159:80

Request

GET /WEIsmPfDcpBFJozngnYN1734366322?argument=0 HTTP/1.1
Host: home.twentytk20pn.top
Accept: */*

Response

HTTP/1.1 404 NOT FOUND

Server: nginx/1.22.1
Date: Sat, 21 Dec 2024 02:42:19 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 207
Connection: close
DNS

home.twentytk20pn.top

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

8.8.8.8:53

Request

home.twentytk20pn.top

IN A

Response

home.twentytk20pn.top

IN A

147.45.113.159
DNS

home.twentytk20pn.top

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

8.8.8.8:53

Request

home.twentytk20pn.top

IN AAAA

Response
POST

http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

Remote address:

147.45.113.159:80

Request

POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1
Host: home.twentytk20pn.top
Accept: */*
Content-Type: application/json
Content-Length: 31

Response

HTTP/1.1 404 NOT FOUND

Server: nginx/1.22.1
Date: Sat, 21 Dec 2024 02:42:20 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 207
Connection: close

34.226.108.155:443

httpbin.org

tls

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

1.5kB
6.4kB
14
15
147.45.113.159:80

http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322

http

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

385.3kB
10.6kB
282
249

HTTP Request

POST http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322

HTTP Response

200
147.45.113.159:80

http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322?argument=0

http

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

331 B
544 B
5
4

HTTP Request

GET http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322?argument=0

HTTP Response

404
147.45.113.159:80

http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322

http

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

404 B
544 B
5
4

HTTP Request

POST http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322

HTTP Response

404

8.8.8.8:53

httpbin.org

dns

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

160 B
250 B
2
2

DNS Request

httpbin.org

DNS Request

httpbin.org

DNS Response

34.226.108.155

98.85.100.80
8.8.8.8:53

home.twentytk20pn.top

dns

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

180 B
232 B
2
2

DNS Request

home.twentytk20pn.top

DNS Request

home.twentytk20pn.top

DNS Response

147.45.113.159
8.8.8.8:53

home.twentytk20pn.top

dns

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

180 B
232 B
2
2

DNS Request

home.twentytk20pn.top

DNS Request

home.twentytk20pn.top

DNS Response

147.45.113.159
8.8.8.8:53

home.twentytk20pn.top

dns

72662d9e82835cb7e3210889828befd75dd7921c8bb6c45f5757c23602432536.exe

180 B
232 B
2
2

DNS Request

home.twentytk20pn.top

DNS Request

home.twentytk20pn.top

DNS Response

147.45.113.159

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-0-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-1-0x00000000779B0000-0x00000000779B2000-memory.dmp

Filesize
8KB

Download
memory/2016-2-0x0000000000FB1000-0x0000000001235000-memory.dmp

Filesize
2.5MB

Download
memory/2016-3-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-4-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-5-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-6-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-7-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-8-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-9-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-10-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-11-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-12-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-13-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download
memory/2016-14-0x0000000000FB0000-0x0000000001B09000-memory.dmp

Filesize
11.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.