cryptbot | 6c551a1172a33d11b974f02a5e5489f851fcf1899e877c7e59abd2f650526c19

Analysis

max time kernel
143s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/12/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
Size

4.5MB
MD5

c20351b808023b220b948a520e5eb163
SHA1

6db7728a2ed6406b6d83761df9676e66f6895878
SHA256

2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b
SHA512

939433491c7df9f0fbe8017ac66f5b45b4011d4e3ae2d27fc1718751b9f14d5b1d04020ed4c2ee176be39d1145ec1c4584d6c0d54549bedf7fffdbfe7e20a390
SSDEEP

98304:9XIs5hfSlpR2IT76rtzgaE1BTW977XYg64asgvUA9A4eFEEsLlX5Z6zyavLqi:9XIUfSlpZT76rave77XSf9AF9g+yS

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 15 IoCs

resource	yara_rule
behavioral23/memory/2552-258-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-259-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-262-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-264-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-266-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-269-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-271-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-273-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-276-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-278-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-280-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-283-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-285-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-288-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot
behavioral23/memory/2552-290-0x000000013F490000-0x000000013FBAA000-memory.dmp	family_cryptbot

Cryptbot family
cryptbot

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2684	CScript.exe
6	2684	CScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1.exe

Executes dropped EXE 1 IoCs

pid	Process
2552	1.exe

Loads dropped DLL 4 IoCs

pid	Process
1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	iplogger.org
4	iplogger.org

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Jaoler\kader\1.exe	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
File created	C:\Program Files (x86)\Jaoler\kader\Setup1.exe	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
File created	C:\Program Files (x86)\Jaoler\kader\Setup1.vbs	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CScript.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2684	CScript.exe
Token: SeBackupPrivilege	2684	CScript.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2552	1.exe
2552	1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2684	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	30
PID 1940 wrote to memory of 2684	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	30
PID 1940 wrote to memory of 2684	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	30
PID 1940 wrote to memory of 2684	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	30
PID 1940 wrote to memory of 2684	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	30
PID 1940 wrote to memory of 2684	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	30
PID 1940 wrote to memory of 2684	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	30
PID 1940 wrote to memory of 2552	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	32
PID 1940 wrote to memory of 2552	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	32
PID 1940 wrote to memory of 2552	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	32
PID 1940 wrote to memory of 2552	1940	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	32

C:\Users\Admin\AppData\Local\Temp\2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
"C:\Users\Admin\AppData\Local\Temp\2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\CScript.exe
  "C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\Jaoler\kader\Setup1.vbs" //e:vbscript //B //NOLOGO
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Program Files (x86)\Jaoler\kader\1.exe
  "C:\Program Files (x86)\Jaoler\kader\1.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Jaoler\kader\Setup1.vbs

Filesize
126B

MD5
ee51612c7ca217fe6e68820b9b8ba1fa

SHA1
9764e643f489e931defe5944f35834365cb54814

SHA256
efd6ccd9ca394b96c6f418e29c97da44aa91414b2ddd4830b112f18d9239489d

SHA512
f081feae16389ba7d1445ed0b5f2e190704a687f62c86c8a00da8abbddd72868c80d5485e681a95fa84e76dbb6871c48335cc1a27f5911c6ce759976f4152b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\aixiLEgeJ6Wf\LWTGphESwPA.zip

Filesize
40KB

MD5
7dd6b7d392787fea2e136ec43d8df371

SHA1
29382233fd736ff83e7837d7c068d87eb83251c1

SHA256
65c0f60435c85adcfa229c671b0a23e390b1b9e106bad0925194467a1229db3e

SHA512
23b6fdd6c0fb2e60b6f9b961a86f2742025889a0c79436e02df268160c3ab002f6f319a9862d2c439c5baf86a27461894f9700bb846f56374c7124d035dea87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\aixiLEgeJ6Wf\_Files\_Information.txt

Filesize
1KB

MD5
bb2d6d58c0961f2a048496eeda88ebff

SHA1
e08d10e4bdf40f506cc5128ca8344e220de19a6c

SHA256
be3e674785d25ccd5c1852311ffe6d0b822b47c579489523398adcae1b2bac99

SHA512
2255194ff98aea782e0445e9e9ea1608423e511c76aa848f7f562839625ca0cdb6e579b2007555cef59f9dc0ec5bac70713b4bde34dd2f61d62bab93fbdd48f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\aixiLEgeJ6Wf\_Files\_Information.txt

Filesize
8KB

MD5
46664ba18200511ddb6af6d8de5d6d75

SHA1
95608302e4cd3546ea2759f3d57cb561de277eea

SHA256
7f734c8fad6fcdf478eba1f1d325802cc8aeb3a6db37bd84e2f03265cc1e85b2

SHA512
f76f0bee8004dbcad5e821f0c5609ee16ad9dfdfb177bd42848d1d77c857eac6bd25d8dadb94cbd4804203da167139b600466e56b205c55ee0a40945b2e3be7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\aixiLEgeJ6Wf\_Files\_Screen_Desktop.jpeg

Filesize
47KB

MD5
6488935f0e83517ad6b04e64f9d26af7

SHA1
c90ba31bd7353bd3400ca36fe39582a26beadfec

SHA256
8a0de65fa18460d33170a8377d752062a246ae9ad73fe647403fbe5e900ede0c

SHA512
b99851ce302d6705fcb629050ad7aef7bb922a58d9f28635d49f5347d24b68273757f1a2af31ecbeb1386b9fbc65810312e83f1c7d6415c72d9eeb4779858387

Download Submit
C:\Users\Admin\AppData\Local\Temp\aixiLEgeJ6Wf\files_\system_info.txt

Filesize
8KB

MD5
5b35330025b2f309f9bdd66faf3eafa2

SHA1
76982d6fc86a07240239d3fd00b6d0f1ea06d3ba

SHA256
520838000b780797a1a39248dad67d1760eafbcff0aefb6dbeabda3fa297054d

SHA512
8084e07737d4a43a47946c4f0711b7bacd774baff59cc95658ab31bc600466b64e25a9b5db8b12b849604e1c40c8563f4707ac663abb8d21e4fc224d0f322c06

Download Submit
\Program Files (x86)\Jaoler\kader\1.exe

Filesize
2.9MB

MD5
9cf620afe3cb375d0848aa96bc714135

SHA1
fabd35f75484256e6b2bc2543dff7c4603a5dbd1

SHA256
38a7d6663a1309348295db512534e986d1442efcbe71d3e6e177c895c4428de4

SHA512
f1a44fca89ef2b7bf8afeebfa55f753d7fb7ad9f2644aa0275c83fe577b499e3b6d73affdd1b740d491782065e776bfb78b68639391089b1edc483e4db2b00f7

Download Submit
\Users\Admin\AppData\Local\Temp\nso360F.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
\Users\Admin\AppData\Local\Temp\nso360F.tmp\nsExec.dll

Filesize
6KB

MD5
132e6153717a7f9710dcea4536f364cd

SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

Download Submit
memory/1940-257-0x0000000002F30000-0x000000000364A000-memory.dmp

Filesize
7.1MB

Download
memory/1940-38-0x0000000002F30000-0x000000000364A000-memory.dmp

Filesize
7.1MB

Download
memory/1940-36-0x0000000002F30000-0x000000000364A000-memory.dmp

Filesize
7.1MB

Download
memory/2552-259-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-273-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-40-0x0000000076F80000-0x0000000076F82000-memory.dmp

Filesize
8KB

Download
memory/2552-262-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-39-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-264-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-266-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-269-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-271-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-258-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-276-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-278-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-280-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-283-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-285-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-288-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download
memory/2552-290-0x000000013F490000-0x000000013FBAA000-memory.dmp

Filesize
7.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads