cryptbot | 6c551a1172a33d11b974f02a5e5489f851fcf1899e877c7e59abd2f650526c19

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
Size

4.5MB
MD5

c20351b808023b220b948a520e5eb163
SHA1

6db7728a2ed6406b6d83761df9676e66f6895878
SHA256

2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b
SHA512

939433491c7df9f0fbe8017ac66f5b45b4011d4e3ae2d27fc1718751b9f14d5b1d04020ed4c2ee176be39d1145ec1c4584d6c0d54549bedf7fffdbfe7e20a390
SSDEEP

98304:9XIs5hfSlpR2IT76rtzgaE1BTW977XYg64asgvUA9A4eFEEsLlX5Z6zyavLqi:9XIUfSlpZT76rave77XSf9AF9g+yS

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 15 IoCs

resource	yara_rule
behavioral24/memory/4776-243-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-245-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-248-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-251-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-255-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-258-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-261-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-264-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-267-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-269-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-272-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-279-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-281-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-284-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot
behavioral24/memory/4776-286-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp	family_cryptbot

Cryptbot family
cryptbot

Blocklisted process makes network request 2 IoCs

flow	pid	Process
15	4172	CScript.exe
17	4172	CScript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1.exe

Executes dropped EXE 1 IoCs

pid	Process
4776	1.exe

Loads dropped DLL 2 IoCs

pid	Process
3176	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
3176	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	iplogger.org
15	iplogger.org

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Jaoler\kader\1.exe	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
File created	C:\Program Files (x86)\Jaoler\kader\Setup1.exe	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
File created	C:\Program Files (x86)\Jaoler\kader\Setup1.vbs	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4776	1.exe
4776	1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4172	3176	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	82
PID 3176 wrote to memory of 4172	3176	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	82
PID 3176 wrote to memory of 4172	3176	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	82
PID 3176 wrote to memory of 4776	3176	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	85
PID 3176 wrote to memory of 4776	3176	2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe	85

C:\Users\Admin\AppData\Local\Temp\2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
"C:\Users\Admin\AppData\Local\Temp\2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\CScript.exe
  "C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\Jaoler\kader\Setup1.vbs" //e:vbscript //B //NOLOGO
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:4172
- C:\Program Files (x86)\Jaoler\kader\1.exe
  "C:\Program Files (x86)\Jaoler\kader\1.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Jaoler\kader\1.exe

Filesize
2.9MB

MD5
9cf620afe3cb375d0848aa96bc714135

SHA1
fabd35f75484256e6b2bc2543dff7c4603a5dbd1

SHA256
38a7d6663a1309348295db512534e986d1442efcbe71d3e6e177c895c4428de4

SHA512
f1a44fca89ef2b7bf8afeebfa55f753d7fb7ad9f2644aa0275c83fe577b499e3b6d73affdd1b740d491782065e776bfb78b68639391089b1edc483e4db2b00f7

Download Submit
C:\Program Files (x86)\Jaoler\kader\Setup1.vbs

Filesize
126B

MD5
ee51612c7ca217fe6e68820b9b8ba1fa

SHA1
9764e643f489e931defe5944f35834365cb54814

SHA256
efd6ccd9ca394b96c6f418e29c97da44aa91414b2ddd4830b112f18d9239489d

SHA512
f081feae16389ba7d1445ed0b5f2e190704a687f62c86c8a00da8abbddd72868c80d5485e681a95fa84e76dbb6871c48335cc1a27f5911c6ce759976f4152b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjB5D4.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjB5D4.tmp\nsExec.dll

Filesize
6KB

MD5
132e6153717a7f9710dcea4536f364cd

SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\udQs7bYvqo4\QfWowE2Yqm.zip

Filesize
707KB

MD5
7897791cee23ccd32a3e6d24abc0160f

SHA1
1841072a08e065853b91418444443f06b1ce7125

SHA256
de6208235542aa37a8b5175b59ad5840762f607e8590574bbba5e7873f28215d

SHA512
118f2bc972da71044164979eb020248b9879225420ecb5eda06cd93cf7ac2df633ca1ce4c0a5491537221c06eea7c2dbc92028ac8461b49decb2b54618556ca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\udQs7bYvqo4\_Files\_Files\ConvertFromUpdate.txt

Filesize
666KB

MD5
0b9a45c285cbba136975ce1715861cb7

SHA1
5e125d7c6d572c49e9bd5d03b67b4713ff9b5a08

SHA256
6b535be93f58df2fd6eb283d2f2032f41cd5c134d94ac0106580b6a87fdf8cd9

SHA512
e459d50f345553d279ab0c07d09df78e1548fed3b0e997623207651192b6e26f62162d49d68ccb1c8d6dfade6ae233e256ae80f35ac97d2f9e59fa4fcf73d77c

Download Submit
C:\Users\Admin\AppData\Local\Temp\udQs7bYvqo4\_Files\_Information.txt

Filesize
638B

MD5
165ac9f543c0646c3cb6a8f1487e6804

SHA1
073f5e7d280438f1f6d6d549469a3fd98e338200

SHA256
f2ed6274684de50d772d145e18ce368d38d50f5b485f99ffcc883f53b4245dae

SHA512
74233d1f131ea9f6c4a0402a1f6c36b60eea74335791803236224b1d4af02e535adf78a1a2bf3550902b9c750db6315ef2d65830db1e69250eba42d12cab192a

Download Submit
C:\Users\Admin\AppData\Local\Temp\udQs7bYvqo4\_Files\_Information.txt

Filesize
5KB

MD5
9629ff02272344683e932d200396f00a

SHA1
8f7672ddaa791536268711bdb7f7ac6063839521

SHA256
8ac741a8f531d78865c24d3cd4a5ab3de7ec8a53d14b0ed6183b98b95dd7ac8f

SHA512
eab1525ae20fbcc0d145d0b4f713749074713e80d714e44bfdb7457b7a58d334e0e19dd06c029f225e09d11316c6b081b7e8aea8280dc54884fdac6d10cc6c03

Download Submit
C:\Users\Admin\AppData\Local\Temp\udQs7bYvqo4\_Files\_Screen_Desktop.jpeg

Filesize
46KB

MD5
a78515ac40297ac057ae41cb98ae05c9

SHA1
18e27076dbb543780c528e6ee657d623fa6ae0c7

SHA256
e8ec357a7eb7fa8b3315b6c0f89ac4ee72052b6265b6f1ec3d54cd8850fa351c

SHA512
dac78b043e5aa17fb3660be360da6d89df095b73c7968ef018835804cee575c18e9eb4005e32658e881597762d8b38ba142e711f12f2589de5e46315e26ae546

Download Submit
C:\Users\Admin\AppData\Local\Temp\udQs7bYvqo4\aZBhZCtbi4s.zip

Filesize
707KB

MD5
a5982c2bbb9d87c2d264a34b43b9cab1

SHA1
96e3090aca1a7a79be81e7994ce9e25340c71820

SHA256
437c6f6da1008d18887561f487d2a3d84a0a49f1268947614cadb0974049a66b

SHA512
f98ca6e521ef194a1f36097a858d9d5e7d727d2394535c7eb71294cc4b9f1d0393cd27f805936d6e55b41df24d3847f9592d89e0a1f270ccc3db6febfbe1d4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\udQs7bYvqo4\files_\system_info.txt

Filesize
660B

MD5
25548eb62a21509940cbdc3301462368

SHA1
dd61d07b7c1a2477e6546a7c505fe696b7a0e26d

SHA256
f0e2a1338d558e31ac4e89779d1253dfa435ae196f6285b533593625906e1145

SHA512
508e7eae9e00862bd51371ddf79999d877e3ac1a2ca82727b6698a5074d1dbbb35b8af7b6ecc6f6ed58ca7a9ad48207595c7a76cec45d603f85ecaf1d1139f77

Download Submit
C:\Users\Admin\AppData\Local\Temp\udQs7bYvqo4\files_\system_info.txt

Filesize
4KB

MD5
b1d40655842c819d6be11c14083b2970

SHA1
2fd128ab57f2061f924b126358c7c6ec27008926

SHA256
5b7ce7f0d525198741825862fc6a5fa2aa0d4229d347823161e3f16bf7779079

SHA512
c8e83de00050ed6d79d28fdde083dfd247b37edfc33317aa3440525f873d51d22a0a2f7abdc879e5020eca65b6b7b0a839e2e093432eeb39dbfa5bdc680f6ae3

Download Submit
memory/4776-258-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-267-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-24-0x00007FFF7F410000-0x00007FFF7F412000-memory.dmp

Filesize
8KB

Download
memory/4776-248-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-251-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-255-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-243-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-261-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-264-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-245-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-269-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-272-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-279-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-281-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-23-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-284-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download
memory/4776-286-0x00007FF68EE10000-0x00007FF68F52A000-memory.dmp

Filesize
7.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads