Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-01-2025 13:38
General
-
Target
JaffaCakes118_26a7c7a28f1ea65bf7b51351e2c6eb67.exe
-
Size
2.7MB
-
MD5
26a7c7a28f1ea65bf7b51351e2c6eb67
-
SHA1
77f410701c760731a468ae0ba3e9175aaed76299
-
SHA256
084f757c11631c23d9fc366f99f622496923703ed552b53744e98de635ac9547
-
SHA512
649ca3f6f7f4a501abac5b42e4f166737ef3cb8373129cda246d591aa93c7590ae715acdf0b8e523a87c3e30052d7f6941aac7ad92c787e4dad808ce07045cf5
-
SSDEEP
49152:+IDeFTdTS1H2BKeMN7XxztRZSJTe5XlYMjrDXg0s3p3cA/i+IXOXpVBip5yUCDR9:py+1u+ztHp+yrDw0u+ArI+ti3yUCtyPk
Malware Config
Extracted
cryptbot
veogka41.top
moruhx04.top
-
payload_url
http://tynauk05.top/download.php?file=lv.exe
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 20 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26a7c7a28f1ea65bf7b51351e2c6eb67.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26a7c7a28f1ea65bf7b51351e2c6eb67.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD594866a2f233e44882bd1a0e6ac5b67de
SHA13e8b87e3af233a9cfe04b638929c28fa49fa7c08
SHA256a22364baf76476bf97855dfaa8f5dd3b0b34acfca69151051a526cf7cc90eba2
SHA512a4e572ab91491ac928d80561d6e1a758026ea0a8e1de0f26aa2e6b154128971c5eceb5a49032b564e033af6aafd7fe07e7183a89c281bbe449844916a9c9528f
-
Filesize
7KB
MD5123cfad0448b1f38ea912342b19ba594
SHA12905504afdd55818a4a4f693afbe496520595325
SHA256c07582d0895752a042dde50f97a82a0da9d2e12b42edaf1fdb2855e91bce5954
SHA51283448cb5312449bc3740cd85c404a78ccf4b2c0b9613a9718c6a54d80312d9bdc791a625271e20f578a9754090984da291d3d9a2493637d4467b6c43d34ac3f1
-
Filesize
52KB
MD5707adc18a2d68e0f44cbe23cc1d0f65b
SHA10e6554dce57f4acc7b16a0e94c62ef015555e727
SHA2563e79336cb6684fcc7dc99b391197fc44fdd9e5017c6da51dde55673aecf7ab4c
SHA512d0385b2760911a1ce7960689d1046ea5c42feacea89866c44559e1ba980fe5a189b2e65ddd3a7021b8a4c8f6dcb1118508d94d5f26dbebd8f78b2216192247ee
-
Filesize
47KB
MD50136d9a377c32bf60cb8e039431ebe2d
SHA129d74fde16cac5f32d2cb70398519c1627677469
SHA2563e50f370a91d5f1d8918e3e99eb7c7baba482cca661e6aa595b88c1a6167a0d9
SHA5124666e610d73f0b3ac590c08d5de20fc0c0c5e95114dbc08895bc5603752307d59929af982e48eeabd7962fb49b738ba4dd29dcb3249d10c0b7875ac643c263e1
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
