cryptbot | 6c551a1172a33d11b974f02a5e5489f851fcf1899e877c7e59abd2f650526c19

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe
Size

4.3MB
MD5

7b65065d72848703e2aa7a8788e182f8
SHA1

939281d92b016157bc32a36876a957fa141dcce3
SHA256

1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede
SHA512

cba2b883a103adaf2060138ee58f2e1a98520dca5e55b979584c49e42cf36af5915d5b95c7a00cee04766f9808a9dede3ad31d730f8f9873f44809855e3c30a3
SSDEEP

98304:TNdyDF7++aTkQE/v3+zaAZqgv8uQwr50etXoy6FB/S:TNdyDF7OpNqgvLQWtYlm

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

nkoopw11.top

moraass08.top

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 17 IoCs

resource	yara_rule
behavioral8/memory/672-49-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-265-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-267-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-268-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-271-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-274-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-277-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-280-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-283-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-286-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-289-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-292-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-298-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-302-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-305-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-307-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot
behavioral8/memory/672-310-0x00000000003E0000-0x00000000008EC000-memory.dmp	family_cryptbot

Cryptbot family
cryptbot

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	drop_9.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
15	1216	cscript.exe
17	1216	cscript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	drop_9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	drop_9.exe

Executes dropped EXE 1 IoCs

pid	Process
672	drop_9.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	drop_9.exe

Loads dropped DLL 5 IoCs

pid	Process
3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe
3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe
3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe
3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe
3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	iplogger.org
15	iplogger.org

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
672	drop_9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drop_9.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	drop_9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	drop_9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
672	drop_9.exe
672	drop_9.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
672	drop_9.exe
672	drop_9.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1216	3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe	82
PID 3936 wrote to memory of 1216	3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe	82
PID 3936 wrote to memory of 1216	3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe	82
PID 3936 wrote to memory of 672	3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe	85
PID 3936 wrote to memory of 672	3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe	85
PID 3936 wrote to memory of 672	3936	1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe	85

C:\Users\Admin\AppData\Local\Temp\1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe
"C:\Users\Admin\AppData\Local\Temp\1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\cscript.exe
  "cscript.exe" s1.vbs //e:vbscript //NOLOGO
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:1216
- C:\Users\Admin\AppData\Local\Temp\sibA70F.tmp\1\drop_9.exe
  "C:\Users\Admin\AppData\Local\Temp\sibA70F.tmp\1\drop_9.exe" /s
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TQgt8vvGCk\_Files\_Information.txt

Filesize
4KB

MD5
ab30ef9edd081f5b1175dfda2aac9bb3

SHA1
05958ae0bb7afcd488234ee8e9645e99a73bf090

SHA256
333e254880dbf359a397ca1dc606eeed8eef00f061a5e74de660b9f50f0bd85d

SHA512
1caa45b1e95f602f6897f7cae8ad3f54e97745a3f700541270320853f441f7d835439d0f405ac7b9c44433eac219c4889696045ff07387a901e503e65ae17ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TQgt8vvGCk\_Files\_Information.txt

Filesize
1KB

MD5
f6a17faae1aca841d102adfa4e9d95fe

SHA1
86e90e8c2420096f5c1992c9217b39b310ed2d8a

SHA256
5e9858cf1e96ab145741e70de4afe284d8856428e1ac319604f94bebacf5ca4e

SHA512
97737124fcbe12fd44edbee743e986bb14603a2d89af993d5f97e48a797893e658775538024d9b1fa65bc566f67d7d69b9098f772eb237717de667bb56918a47

Download Submit
C:\Users\Admin\AppData\Local\Temp\TQgt8vvGCk\_Files\_Information.txt

Filesize
2KB

MD5
536f4b43cdc1fc86f6ef9558c20b1e28

SHA1
9568cadf5c857238d91ee2f7e12e8ad21eec15cf

SHA256
def0c161bd14d1dd99e7586ac5a3a87db2451c62489cada8220c5fc913d4c525

SHA512
b8cfffbe1af8075339e95bf6434932f7c2ed5cbcea818638599488d5559f16431a13830a2a358b169de6f738cabd2a4db7490b4e096af184d8f03d6faccd2892

Download Submit
C:\Users\Admin\AppData\Local\Temp\TQgt8vvGCk\_Files\_Screen_Desktop.jpeg

Filesize
51KB

MD5
cda0b12e71023f9f1577d6a398cae6f2

SHA1
4c681a9c76047a009d3c492a4c71da85dbb6b433

SHA256
609b8d5919f4275bacf68e8ad564011da108fea203627ae66cb66ec3c7fe9f62

SHA512
955377b58ce641e721e51e631011e4bdb38b838910e268e001b9beb9f3d930ed4c2acef1002e37b64ec1d5487f7c56104919b96da1ca0cf00a17016a098ee999

Download Submit
C:\Users\Admin\AppData\Local\Temp\TQgt8vvGCk\files_\system_info.txt

Filesize
1KB

MD5
123ec9e7993b1f0ea6dcb6cebc607393

SHA1
b2ea76c9662ab7e33150d0852dc8f7529aa569a1

SHA256
c5d2ec266d62c99615caf100accc4b6ebd0425d49065b61e471b0c3db17f05e9

SHA512
4d34d64ad9f852570b4cb6c8f81315913153e640ec5661ae9616858bb67e9d0a30c0ec5f1b7449adc0b7760390e333587c6ae85b15690457195bd74866d6b655

Download Submit
C:\Users\Admin\AppData\Local\Temp\TQgt8vvGCk\files_\system_info.txt

Filesize
7KB

MD5
1f7802e72bb65e0668f9e65e2d9daecd

SHA1
29e031d53663679ee17062ffb4993a9ee9d7da0b

SHA256
0a2725fb4209f9767f961e658241bf0f1f96b4c85a1da8e48c55eb5b3e101fbf

SHA512
0383b0d467a2e69e0f406ac03abeecbb14f8caf55cce79020d6e06c4c503808f791a1ff0ee63f32d01d49a7d8007caec7ab182cc0278d215f599be0333b66df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TQgt8vvGCk\rFOqwqSTXzmq.zip

Filesize
46KB

MD5
b176ce9e029c36c2f9fbc118692bef97

SHA1
1f6698d0c8e63abe47341cd4f00b7f8b011426ca

SHA256
b18d0b8a86ec5b8c1ac52bec1b97947fec46158febe589562e8edf4541e75b0f

SHA512
dde721ef9525ad60a356eb1138e623944e77d2f1e8cee73a91dd637f5986ef3902151507b103377e2ad62aa93491414ed1c57766ee9f5f92cd63006d88d051b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TQgt8vvGCk\z6iKgPnU3F.zip

Filesize
46KB

MD5
d03b522a4d48a47bde7705fd1b7300cf

SHA1
8a315b9220bae278737bfefe695da4a48d4b93ac

SHA256
e0a5dbcbe6bf8cfc4e19f668e4db6fe2546771835f7c8a71bb27dabb2d5b37a2

SHA512
ffa59034816d24a61dd0304b608bde2af17c21a6f8a4e19200e8536194b94dad3638061b435e547682af00203db3299e7d6002d5947c609cb46a48d4123b3b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA663.tmp\Sibuia.dll

Filesize
524KB

MD5
6a3c3c97e92a5949f88311e80268bbb5

SHA1
48c11e3f694b468479bc2c978749d27b5d03faa2

SHA256
7938db73242aafbe80915e4ca886d38be9b7e872b93bdae1e8ee6cf4a005b7d9

SHA512
6141886a889825ccdfa59a419f7670a34ef240c4f90a83bc17223c415f2fbd983280e98e67485710e449746b5bf3284907537bef6ab698a48954dd4910ddf693

Download Submit
C:\Users\Admin\AppData\Local\Temp\sibA70F.tmp\0\s1.vbs

Filesize
128B

MD5
1cf3e84b845eb5445709cfe1ddc132f7

SHA1
3a7949cb63194b5b5104efa14db9ef7a0a98a75c

SHA256
375c39454e63e5be7265734d48eca452dd841c71fceec240795d22e8b9bde9f0

SHA512
86616c5df3c1fae184cf0d0f0d8051dfcbf4c843f07a93da9eeb16d27a38e28acf72b1dab7ffcff56e07f672f0b5c41c036f6b59f9ab4fb78abcacd522ad6249

Download Submit
C:\Users\Admin\AppData\Local\Temp\sibA70F.tmp\1\drop_9.exe

Filesize
2.1MB

MD5
ed71169dab161fb6c36c7b74e9abc06b

SHA1
5b46dd11936835f69804c91417052400bd3c5987

SHA256
2e0598f56a2e828f1369af9120aa1561d8e0a367879e555f5b2ef9a433007566

SHA512
62e70ff27257b363dfa50295ddc2e8af1f8750c5faf14a172fc1ff1cfc040a832075e169d2308766a21fc3b96b6232b04102db805ff31e4f601f0113b62c1085

Download Submit
C:\Users\Admin\AppData\Local\Temp\sibA70F.tmp\SibCa.dll

Filesize
4KB

MD5
9387a23581b2d69d911958e615a65481

SHA1
c7477e70b87f168bc30e29446e0a7f9c7fd20b3e

SHA256
85930be70ceb7d6a4933558dde9d91f84b12db4a9f8515f949fecfb4b1609bc2

SHA512
846e3bb85f81fce9be861e5f9edce3dd8a080fcbc4052cf281723b659ab86fa5d17500ec799873b0b5f6a2a7d14773577fee74f64e2f88f5c212345b7a44052f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sibA70F.tmp\SibClr.dll

Filesize
51KB

MD5
5ea6d2ffeb1be3fc0571961d0c4c2b5f

SHA1
902dfe9ae735c83fb0cb46b3e110bbf2aa80209e

SHA256
508336b6a7c3226738e74f6ce969e828da904ad9f7610b9112f883a316ee9222

SHA512
e81657087f451a37f06a07bf84175117fdaf75d5d8b84cbdc49497fcf88f96e259074518ea3037680d27c9eaeebd7a8df496297593fead88d7edea202a572585

Download Submit
memory/672-274-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-280-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-43-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/672-42-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/672-46-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/672-45-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/672-44-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/672-47-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/672-48-0x00000000003E1000-0x000000000043C000-memory.dmp

Filesize
364KB

Download
memory/672-49-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-310-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-307-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-40-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-305-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-302-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-298-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-292-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-289-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-265-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-267-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-268-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-286-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-271-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-283-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-277-0x00000000003E0000-0x00000000008EC000-memory.dmp

Filesize
5.0MB

Download
memory/672-41-0x00000000771F4000-0x00000000771F6000-memory.dmp

Filesize
8KB

Download
memory/3936-14-0x0000000010D00000-0x0000000010D12000-memory.dmp

Filesize
72KB

Download
memory/3936-15-0x0000000010D20000-0x0000000010DDA000-memory.dmp

Filesize
744KB

Download
memory/3936-16-0x00000000739D0000-0x0000000074180000-memory.dmp

Filesize
7.7MB

Download
memory/3936-23-0x000000001CA10000-0x000000001CA18000-memory.dmp

Filesize
32KB

Download
memory/3936-20-0x00000000739D0000-0x0000000074180000-memory.dmp

Filesize
7.7MB

Download
memory/3936-10-0x00000000739DE000-0x00000000739DF000-memory.dmp

Filesize
4KB

Download
memory/3936-24-0x00000000739D0000-0x0000000074180000-memory.dmp

Filesize
7.7MB

Download
memory/3936-25-0x00000000739D0000-0x0000000074180000-memory.dmp

Filesize
7.7MB

Download
memory/3936-51-0x00000000739D0000-0x0000000074180000-memory.dmp

Filesize
7.7MB

Download
memory/3936-50-0x00000000739DE000-0x00000000739DF000-memory.dmp

Filesize
4KB

Download