cryptbot | 8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452

Analysis

max time kernel
141s
max time network
153s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
17/02/2025, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
Size

3.8MB
MD5

b80fe721ecebeaaf99eb4fa7485644a7
SHA1

18b6d820d5636f68f1e4b788db8500f8553629c2
SHA256

8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452
SHA512

fc46e8bf1f5721dd3feb5f0703272bb66006aa1dbec3fcfa3aa58cdcb2324399e2bbb385d02041cdb0e5a2d5e492805a6a4924c8db8132b4255d03cd07c97f27
SSDEEP

98304:Zs2we8EipV6574GYxThZN+5o4ZQGhNvYH3:wEipS4Ge7N+5m

Score

10^/10

cryptbot defense_evasion discovery execution spyware stealer

Malware Config

Extracted

Family

cryptbot

http://home.elvncc11vs.top/XBsnAZXLtQYcAoRtYQZi18

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	VC_redist.x86.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4944	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2608	VC_redist.x64.exe
5056	VC_redist.x86.exe
1976	Key.exe

Loads dropped DLL 6 IoCs

pid	Process
2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
1736	taskeng.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0008000000015d18-2811.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4944	powershell.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
1976	Key.exe
5056	VC_redist.x86.exe
5056	VC_redist.x86.exe
5056	VC_redist.x86.exe
5056	VC_redist.x86.exe
5056	VC_redist.x86.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	VC_redist.x64.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	1976	Key.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2608	2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	30
PID 2016 wrote to memory of 2608	2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	30
PID 2016 wrote to memory of 2608	2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	30
PID 2016 wrote to memory of 2608	2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	30
PID 4912 wrote to memory of 4944	4912	taskeng.exe	35
PID 4912 wrote to memory of 4944	4912	taskeng.exe	35
PID 4912 wrote to memory of 4944	4912	taskeng.exe	35
PID 2016 wrote to memory of 5056	2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	37
PID 2016 wrote to memory of 5056	2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	37
PID 2016 wrote to memory of 5056	2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	37
PID 2016 wrote to memory of 5056	2016	8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe	37
PID 1736 wrote to memory of 1976	1736	taskeng.exe	39
PID 1736 wrote to memory of 1976	1736	taskeng.exe	39
PID 1736 wrote to memory of 1976	1736	taskeng.exe	39
PID 1976 wrote to memory of 4972	1976	Key.exe	40
PID 1976 wrote to memory of 4972	1976	Key.exe	40
PID 1976 wrote to memory of 4972	1976	Key.exe	40
PID 1976 wrote to memory of 5004	1976	Key.exe	41
PID 1976 wrote to memory of 5004	1976	Key.exe	41
PID 1976 wrote to memory of 5004	1976	Key.exe	41
PID 1976 wrote to memory of 2996	1976	Key.exe	42
PID 1976 wrote to memory of 2996	1976	Key.exe	42
PID 1976 wrote to memory of 2996	1976	Key.exe	42
PID 1976 wrote to memory of 4964	1976	Key.exe	43
PID 1976 wrote to memory of 4964	1976	Key.exe	43
PID 1976 wrote to memory of 4964	1976	Key.exe	43
PID 1976 wrote to memory of 4948	1976	Key.exe	44
PID 1976 wrote to memory of 4948	1976	Key.exe	44
PID 1976 wrote to memory of 4948	1976	Key.exe	44
PID 1976 wrote to memory of 4940	1976	Key.exe	45
PID 1976 wrote to memory of 4940	1976	Key.exe	45
PID 1976 wrote to memory of 4940	1976	Key.exe	45
PID 1976 wrote to memory of 2708	1976	Key.exe	46
PID 1976 wrote to memory of 2708	1976	Key.exe	46
PID 1976 wrote to memory of 2708	1976	Key.exe	46
PID 1976 wrote to memory of 5072	1976	Key.exe	47
PID 1976 wrote to memory of 5072	1976	Key.exe	47
PID 1976 wrote to memory of 5072	1976	Key.exe	47
PID 1976 wrote to memory of 5048	1976	Key.exe	48
PID 1976 wrote to memory of 5048	1976	Key.exe	48
PID 1976 wrote to memory of 5048	1976	Key.exe	48
PID 1976 wrote to memory of 5104	1976	Key.exe	49
PID 1976 wrote to memory of 5104	1976	Key.exe	49
PID 1976 wrote to memory of 5104	1976	Key.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe
"C:\Users\Admin\AppData\Local\Temp\8520d7d21039b7bbd73d0ccc72d27da6aae62dd88bf2e759046baca8c0fbd452.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5056

C:\Windows\system32\taskeng.exe
taskeng.exe {21F07ED1-363C-4B2E-BCA2-205D0A355332} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:S4U:
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc YQBEAEQALQBNAFAAUAByAEUAZgBFAFIAZQBOAGMAZQAgAC0ARQBYAEMATAB1AHMAaQBvAG4AcABhAFQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBlAHMAcwBhAGcAZQBcAEsAZQB5AC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXAAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcACAALQBmAG8AcgBjAGUAOwAgAEEAZABkAC0AbQBQAFAAUgBFAEYARQBSAGUAbgBjAEUAIAAtAGUAeABjAEwAdQBTAEkATwBOAFAAcgBPAEMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGUAcwBzAGEAZwBlAFwASwBlAHkALgBlAHgAZQAgAC0ARgBvAFIAQwBFAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4944

C:\Windows\system32\taskeng.exe
taskeng.exe {F5E21942-BB1B-4581-ADE3-5026F7CF5A0E} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Roaming\Message\Key.exe
  C:\Users\Admin\AppData\Roaming\Message\Key.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:4972
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:5004
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:2996
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:4964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:4948
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:4940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:2708
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:5072
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:5048
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe

Filesize
653KB

MD5
fbde224ef7968af7fab765fd06c4b704

SHA1
db28eaf767625e31891d224eb1f325edabbb0c13

SHA256
14731cefeffd3d90816d3769a00cdea8c42f7adec9c4a81af5fcabf6c184123f

SHA512
41d2c3e5c4dc3f9b04f3d2133dbe365a00bbe9ccbae24bc03ff243b00c28b7671f4d483258cfb2015c93a76f3da348ade7f383403566749e2b4ee19c6d606d18

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe

Filesize
9.7MB

MD5
ffe4ea851fa231ed77b908e5ed8ccf98

SHA1
aa2a0aaaf3e75c22bf7ff2eda7e56b0f942e9f49

SHA256
6966d14c23c8f79da7b9eb8648add32dd1a32527929749e5a3689360d70e663c

SHA512
f794d90fdb6548eda31d4d9ade0cc088ff5275d81fe7fcfa762e8c85ad7f7baf966576a152466edc3a7b04c23add45f9a02464b099780d68db0219e35224b761

Download Submit
memory/1976-2829-0x0000000000980000-0x0000000000A28000-memory.dmp

Filesize
672KB

Download
memory/2608-37-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-2798-0x00000000008D0000-0x0000000000926000-memory.dmp

Filesize
344KB

Download
memory/2608-68-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-66-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-75-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-79-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-77-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-73-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-71-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-69-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-63-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-61-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-53-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-49-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-47-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-45-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-43-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-31-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-39-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-14-0x0000000002520000-0x000000000262A000-memory.dmp

Filesize
1.0MB

Download
memory/2608-15-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2608-35-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-41-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-2799-0x000000001ADE0000-0x000000001AE2C000-memory.dmp

Filesize
304KB

Download
memory/2608-29-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-23-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-21-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-60-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-58-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-56-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-51-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-19-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-33-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-17-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-27-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-25-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-16-0x0000000002520000-0x0000000002626000-memory.dmp

Filesize
1.0MB

Download
memory/2608-2800-0x000000001AE30000-0x000000001AE84000-memory.dmp

Filesize
336KB

Download
memory/2608-12-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/2608-13-0x00000000001E0000-0x0000000000288000-memory.dmp

Filesize
672KB

Download
memory/2608-2809-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/4944-2806-0x00000000013D0000-0x00000000013D8000-memory.dmp

Filesize
32KB

Download
memory/4944-2805-0x000000001A210000-0x000000001A4F2000-memory.dmp

Filesize
2.9MB

Download