Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/12/2024, 19:03
General
-
Target
JaffaCakes118_065a68509a213bedcc8e2cd634245ee03ac58d18f1e033902e7dcebc585cfde9.exe
-
Size
365KB
-
MD5
d97d61deafe695ca6a3f53792bd2c6b8
-
SHA1
cd54e98a58f0ac38dc9e43222fdaa6a0f0c1f3e2
-
SHA256
065a68509a213bedcc8e2cd634245ee03ac58d18f1e033902e7dcebc585cfde9
-
SHA512
6b7d17a18ae22136de7160cf4fcc13f861df587d961363b0583d29876484c0028c7cfe68fc893afb4a6102a8a0bbd6e873abbcad7faaa005f1f91c89e11795fc
-
SSDEEP
6144:RJNNuA877KXbVEsR8J82VAnCPObWPYzuPt1yhv7y:RJ187gbVEs8jQ0Yil1
Malware Config
Extracted
cryptbot
unic15m.top
unic15e.top
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_065a68509a213bedcc8e2cd634245ee03ac58d18f1e033902e7dcebc585cfde9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_065a68509a213bedcc8e2cd634245ee03ac58d18f1e033902e7dcebc585cfde9.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD50deda72fb729a5543e66c4721276e7ea
SHA1e3e6f9e554df8e543b02079aafba60091f2dad23
SHA25614e0f1e602356e1a45e5d140cb03a840cfa233e787dd9469d16caf1133b9e451
SHA5122799cef7305018e8e9d34aa1f8bcd6936656089bc3ded3293ae3112b2d0647080de3d941528f709fce93b1dcea157f517a596dde4f42353bf6dfbfa403abafe2
-
Filesize
4KB
MD57894563cc051e0249b9b12ef8b2fc77c
SHA100bc9f6880ff25c7adead1d7f901f78a505257d1
SHA256955d56d75abc4375b354489f598ced08b2394c9ec68c58b1d6f0e6197d526733
SHA512afd948a6cc314086d279942a393123c9765094baa034a671fcdd63cf67984d5de79e802d6d9d9e1ed4c5e081d07cdf9b3bb539bfbbc4b0b11165f727641fb1a9
-
Filesize
57KB
MD5f5cbb00783a683c63c168a9eb6cd852a
SHA1c77a24916946faa28663631c803c9e013364151c
SHA256837fde713d5320b2320f09dcbee32ca08c415fb21737690767fa5b9fe5b3e882
SHA512a9171554d4b24752b93da1359516154ed87eddc9862d408955d22f6e5e208d2f1feb870da73f149881ba0b0991941fc9e76160700c981e439457e8cf60ae4842
-
Filesize
52KB
MD5f67b6f07ebd530166c140922a14f7812
SHA163f55e4b3d474d381c9455cc8bf821833874d766
SHA2567ed33880af2c72aef3033493a3f3e5cf4f62dbfd1874c38d2356c6ddde4f66f1
SHA51237dade1b1d9b0cc4132bb95942c362ddd8cffc4a38c4eb7a5cf0a7baf230d68cf3aecec6e0e95b909daeccb21229bef897185df9bdb20e0df5e8335d7a2e4150
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
1024KB
-
Filesize
396KB
-
Filesize
284KB
-
Filesize
292KB
-
Filesize
396KB
-
Filesize
284KB
-
Filesize
1024KB
-
Filesize
292KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
