Analysis

  • max time kernel
    93s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-12-2024 09:10

General

  • Target

    c0fa3c59100f35ac8fcf45e2905bb274.exe

  • Size

    4.2MB

  • MD5

    c0fa3c59100f35ac8fcf45e2905bb274

  • SHA1

    68511f15f8853e9c386943f9fb8bf82eb78d7b82

  • SHA256

    2d55c0295fd39fac3023f8a1e23a77dc5c5e9894cac08430a67151bc04b31151

  • SHA512

    349bb282594df0e21b67a287d484227e35a33da6fc8efe135ce83c97df3f1b9cfa693f23228a6a37ab2cc0971e02aef874847bd8817817f3891a271673f7d43a

  • SSDEEP

    98304:jQTr76WfxhRVDZZMj2rT+BwXaUPSIFIQZ24HKSi4W2yprOT:O6KxhpZMj2rJNSIaQk4H1W2e

Malware Config

Extracted

Family

cryptbot

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0fa3c59100f35ac8fcf45e2905bb274.exe
    "C:\Users\Admin\AppData\Local\Temp\c0fa3c59100f35ac8fcf45e2905bb274.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1468

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    httpbin.org
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    8.8.8.8:53
    Request
    httpbin.org
    IN A
    Response
  • flag-us
    DNS
    httpbin.org
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    8.8.8.8:53
    Request
    httpbin.org
    IN AAAA
    Response
    httpbin.org
    IN A
    3.218.7.103
    httpbin.org
    IN A
    34.226.108.155
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    103.7.218.3.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.7.218.3.in-addr.arpa
    IN PTR
    Response
    103.7.218.3.in-addr.arpa
    IN PTR
    ec2-3-218-7-103 compute-1 amazonawscom
  • flag-us
    DNS
    74.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    74.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    home.fiveth5ht.top
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fiveth5ht.top
    IN A
    Response
    home.fiveth5ht.top
    IN A
    81.29.149.125
  • flag-us
    DNS
    home.fiveth5ht.top
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fiveth5ht.top
    IN AAAA
    Response
  • flag-no
    POST
    http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    81.29.149.125:80
    Request
    POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1
    Host: home.fiveth5ht.top
    Accept: */*
    Content-Type: application/json
    Content-Length: 439593
    Response
    HTTP/1.0 503 Service Unavailable
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    125.149.29.81.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    125.149.29.81.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    home.fiveth5ht.top
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fiveth5ht.top
    IN A
    Response
    home.fiveth5ht.top
    IN A
    81.29.149.125
  • flag-us
    DNS
    home.fiveth5ht.top
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fiveth5ht.top
    IN AAAA
    Response
  • flag-no
    POST
    http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    81.29.149.125:80
    Request
    POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1
    Host: home.fiveth5ht.top
    Accept: */*
    Content-Type: application/json
    Content-Length: 439593
    Response
    HTTP/1.0 503 Service Unavailable
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    107.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    107.12.20.2.in-addr.arpa
    IN PTR
    Response
    107.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-107deploystaticakamaitechnologiescom
  • flag-us
    DNS
    home.fiveth5ht.top
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fiveth5ht.top
    IN A
    Response
    home.fiveth5ht.top
    IN A
    81.29.149.125
  • flag-us
    DNS
    home.fiveth5ht.top
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    8.8.8.8:53
    Request
    home.fiveth5ht.top
    IN AAAA
    Response
  • flag-no
    POST
    http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    Remote address:
    81.29.149.125:80
    Request
    POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1
    Host: home.fiveth5ht.top
    Accept: */*
    Content-Type: application/json
    Content-Length: 256
    Response
    HTTP/1.0 503 Service Unavailable
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • 3.218.7.103:443
    httpbin.org
    tls
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    1.6kB
    6.5kB
    15
    16
  • 81.29.149.125:80
    http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
    http
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    22.5kB
    904 B
    19
    17

    HTTP Request

    POST http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862

    HTTP Response

    503
  • 81.29.149.125:80
    http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
    http
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    19.7kB
    664 B
    17
    11

    HTTP Request

    POST http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862

    HTTP Response

    503
  • 81.29.149.125:80
    http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
    http
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    627 B
    344 B
    5
    3

    HTTP Request

    POST http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862

    HTTP Response

    503
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    httpbin.org
    dns
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    160 B
    250 B
    2
    2

    DNS Request

    httpbin.org

    DNS Request

    httpbin.org

    DNS Response

    3.218.7.103
    34.226.108.155

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    103.7.218.3.in-addr.arpa
    dns
    70 B
    123 B
    1
    1

    DNS Request

    103.7.218.3.in-addr.arpa

  • 8.8.8.8:53
    74.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    74.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    home.fiveth5ht.top
    dns
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    174 B
    226 B
    2
    2

    DNS Request

    home.fiveth5ht.top

    DNS Request

    home.fiveth5ht.top

    DNS Response

    81.29.149.125

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    125.149.29.81.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    125.149.29.81.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    home.fiveth5ht.top
    dns
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    174 B
    226 B
    2
    2

    DNS Request

    home.fiveth5ht.top

    DNS Request

    home.fiveth5ht.top

    DNS Response

    81.29.149.125

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    107.12.20.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    107.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    home.fiveth5ht.top
    dns
    c0fa3c59100f35ac8fcf45e2905bb274.exe
    174 B
    226 B
    2
    2

    DNS Request

    home.fiveth5ht.top

    DNS Request

    home.fiveth5ht.top

    DNS Response

    81.29.149.125

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1468-0-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-1-0x0000000077324000-0x0000000077326000-memory.dmp

    Filesize

    8KB

  • memory/1468-2-0x0000000000841000-0x0000000000ACA000-memory.dmp

    Filesize

    2.5MB

  • memory/1468-3-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-4-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-5-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-6-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-7-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-8-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-9-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-10-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-11-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-12-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-13-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-14-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-15-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-16-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

  • memory/1468-17-0x0000000000840000-0x0000000001460000-memory.dmp

    Filesize

    12.1MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.