Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 04:43
General
-
Target
JaffaCakes118_2b6efbf39ea8d700b591827d0d2eaf27f29af6c4fec4f9f3f9da5ec8ec56aacd.exe
-
Size
363KB
-
MD5
0078fc3f4e4901195bfc323e4bcf2d59
-
SHA1
96de6dc9fd911a3d340287ceb66afd7e25eff8c0
-
SHA256
2b6efbf39ea8d700b591827d0d2eaf27f29af6c4fec4f9f3f9da5ec8ec56aacd
-
SHA512
13a80eb11043f653ca2d6c1cc2e544c77ecf0d002dee1c198cb70ef60d1fac033c305ae5fc38068f1cf922c7ce59bd8125ae75637d68b8d5dc62e65bb2086bdc
-
SSDEEP
6144:27smY4rQrDXbNwp83CTH8V/gctENEhKhl:27RrQ/bOjb8V/LEgK
Malware Config
Extracted
cryptbot
unic15m.top
unic15e.top
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b6efbf39ea8d700b591827d0d2eaf27f29af6c4fec4f9f3f9da5ec8ec56aacd.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2b6efbf39ea8d700b591827d0d2eaf27f29af6c4fec4f9f3f9da5ec8ec56aacd.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD542e9f53492f7b4ad960e84a796753519
SHA1b76dd5b78dcf21e91398bd1c4f8080bcfb514c48
SHA25611b7d946c63e8a4f5deb2d69890edb3bde480ddd3b76fb74d86a0a9916d13a57
SHA512d343c1405c6c852494153974afd4bc92127d337c8449f212c9e70063af5e17f30c2bd1943f067900ac2dd581f68381c62a6624ae434de00bef82a5fabecc926b
-
Filesize
3KB
MD5557a89202ac77c3506ec2e6b35667f73
SHA1a42f975b706bb76ac86937048e740dc5df8c98a8
SHA256261abb8b5c0ed76c5cdacce5aff41c30edf7c1df6b16d6903f7274b2eb3f7c58
SHA512a99802667d90f29bd54633149e44b31d2efb932c4c5b38f021f8f1403b29fb928ea832d9b4198f053bafdfa78c4d3bb712d7e6018dc6cb876c480e23fc2cf397
-
Filesize
5KB
MD57d204b2c987a82cb02cbe26fecc00852
SHA115411d1853ffc252116c2d24b16e2c2a45d5f56a
SHA256d40bfac0620bd96c647f6afbe339c12595329b5b6d9a6ea3907d8451f70d3be6
SHA512950a8b3641f548c06e59fbdf7c7b0bece3efd2bb8b190a6a4d5464ae2b2e4aa6a72659ec786fbc991ec2344059c709db63b6908a2b16f4691cc5bff443ffacec
-
Filesize
52KB
MD56d162e3ffd21c522fe0aecca03391374
SHA1d544263303380e2c0167c7d9732bf6aa0b8859c9
SHA256dc7ccfd033cf9187b34e19be755cc16ea788fd764cf4e4ac24b16c70ba7bd979
SHA51248c8c7a19a8bb0a73b47ea7a76a2d488ac8287389eee6d684e3ebd04b1a2f5def96bee631f2465b51fae61c5c1ea16e155dad09256bcf770cb1cc0310353dc7b
-
Filesize
1024KB
-
Filesize
392KB
-
Filesize
1024KB
-
Filesize
392KB
-
Filesize
284KB
-
Filesize
292KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
284KB
-
Filesize
292KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
