cryptbot | e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73

Analysis

max time kernel
74s
max time network
31s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25/12/2024, 13:47 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe
Size

4.3MB
MD5

5fcf1c70847c8d629264384d6d6c8acf
SHA1

d9edad7806c30dd9b980d4705a0891339621cf7a
SHA256

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73
SHA512

5f317afdee88fadd924f2f3f3eb95226a627ccf8061357fe0a3fb7e2d8ace5da2bf5fc383038c2b191eea94a804e36611bcc2226b565955fa6e3d6f8510f4175
SSDEEP

98304:V+7uR57NzRP1qxQ/EprGbbEV70UA6Wmu+aUzh1Zxs:A7QLlP1eQ+rGE70UN6WW

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2116	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2116	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe
2116	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe
2116	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe
2116	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe
2116	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe
2116	e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

C:\Users\Admin\AppData\Local\Temp\e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe
"C:\Users\Admin\AppData\Local\Temp\e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2116

Network

DNS

httpbin.org

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

8.8.8.8:53

Request

httpbin.org

IN A

Response
DNS

httpbin.org

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

8.8.8.8:53

Request

httpbin.org

IN AAAA

Response

httpbin.org

IN A

98.85.100.80

httpbin.org

IN A

34.226.108.155
DNS

home.fivetk5sb.top

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

8.8.8.8:53

Request

home.fivetk5sb.top

IN A

Response

home.fivetk5sb.top

IN A

185.121.15.192
DNS

home.fivetk5sb.top

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

8.8.8.8:53

Request

home.fivetk5sb.top

IN AAAA

Response
POST

http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB1734796753

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

185.121.15.192:80

Request

POST /niCGMfnfOxUBXxpLhBBB1734796753 HTTP/1.1
Host: home.fivetk5sb.top
Accept: */*
Content-Type: application/json
Content-Length: 384625

Response

HTTP/1.1 200 OK

Server: nginx/1.22.1
Date: Wed, 25 Dec 2024 13:48:19 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1
Connection: close
DNS

home.fivetk5sb.top

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

8.8.8.8:53

Request

home.fivetk5sb.top

IN A

Response

home.fivetk5sb.top

IN A

185.121.15.192
DNS

home.fivetk5sb.top

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

8.8.8.8:53

Request

home.fivetk5sb.top

IN AAAA

Response
GET

http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB1734796753?argument=0

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

185.121.15.192:80

Request

GET /niCGMfnfOxUBXxpLhBBB1734796753?argument=0 HTTP/1.1
Host: home.fivetk5sb.top
Accept: */*

Response

HTTP/1.1 404 NOT FOUND

Server: nginx/1.22.1
Date: Wed, 25 Dec 2024 13:48:20 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 207
Connection: close
DNS

home.fivetk5sb.top

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

8.8.8.8:53

Request

home.fivetk5sb.top

IN A

Response

home.fivetk5sb.top

IN A

185.121.15.192
DNS

home.fivetk5sb.top

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

8.8.8.8:53

Request

home.fivetk5sb.top

IN AAAA

Response
POST

http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB1734796753

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

Remote address:

185.121.15.192:80

Request

POST /niCGMfnfOxUBXxpLhBBB1734796753 HTTP/1.1
Host: home.fivetk5sb.top
Accept: */*
Content-Type: application/json
Content-Length: 31

Response

HTTP/1.1 404 NOT FOUND

Server: nginx/1.22.1
Date: Wed, 25 Dec 2024 13:48:21 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 207
Connection: close

98.85.100.80:443

httpbin.org

tls

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

1.5kB
6.4kB
14
15
185.121.15.192:80

http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB1734796753

http

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

396.4kB
10.9kB
291
268

HTTP Request

POST http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB1734796753

HTTP Response

200
185.121.15.192:80

http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB1734796753?argument=0

http

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

328 B
544 B
5
4

HTTP Request

GET http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB1734796753?argument=0

HTTP Response

404
185.121.15.192:80

http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB1734796753

http

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

401 B
544 B
5
4

HTTP Request

POST http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB1734796753

HTTP Response

404

8.8.8.8:53

httpbin.org

dns

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

160 B
250 B
2
2

DNS Request

httpbin.org

DNS Request

httpbin.org

DNS Response

98.85.100.80

34.226.108.155
8.8.8.8:53

home.fivetk5sb.top

dns

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

174 B
226 B
2
2

DNS Request

home.fivetk5sb.top

DNS Request

home.fivetk5sb.top

DNS Response

185.121.15.192
8.8.8.8:53

home.fivetk5sb.top

dns

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

174 B
226 B
2
2

DNS Request

home.fivetk5sb.top

DNS Request

home.fivetk5sb.top

DNS Response

185.121.15.192
8.8.8.8:53

home.fivetk5sb.top

dns

e78ed16dc1488e89f074a3b7f92683910d50f3849c7e94531b13cccf5eface73_Sigmanly.exe

174 B
226 B
2
2

DNS Request

home.fivetk5sb.top

DNS Request

home.fivetk5sb.top

DNS Response

185.121.15.192

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-1-0x0000000077DD0000-0x0000000077DD2000-memory.dmp

Filesize
8KB

Download
memory/2116-2-0x0000000000CF1000-0x0000000000F7B000-memory.dmp

Filesize
2.5MB

Download
memory/2116-3-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-4-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-5-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-6-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-7-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-8-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-9-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-10-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-11-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-12-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-13-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-14-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-15-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download
memory/2116-17-0x0000000000CF0000-0x0000000001964000-memory.dmp

Filesize
12.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.