cryptbot | 64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c.exe
Size

6.9MB
MD5

d0a08b3f79d6da2c0cdc21a2f6806b94
SHA1

ab1561cc3002a01a437833ca94848fbca8194481
SHA256

64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c
SHA512

6678a98ae8206b76685943bfae468e1b2a9bc7eee7c070493ca2fdf009e14bf6a5d6accea5c52902b050a2cf0b4954af0b90e20af9d008f26912f6c2a3dafc55
SSDEEP

98304:w/nbzVQSEYQa5pWkPZBUBr2hM+xOgZpxVNSc6fRMteB4N8oFdWR:YLLcOrZp0fetlPFdW

Score

10^/10

cryptbot discovery spyware stealer themida

Malware Config

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4816-0-0x0000000000AA0000-0x000000000118C000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5032	4816	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64504594061b330e27de0aa2f671e2b05c921ad1b8ebdab77016bb8a0b5b391c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 216
  2⤵
  - Program crash
  PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4816 -ip 4816
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4816-0-0x0000000000AA0000-0x000000000118C000-memory.dmp

Filesize
6.9MB

Download