cryptbot | e19e0e7f8871e7acf07a37b277b5aaf2aa125f28ee11644c335eb313ec768df5

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sub_e19e0e7f8871.exe
Size 675KB
Sample260524-b58a8set9j
SHA256 e19e0e7f8871e7acf07a37b277b5aaf2aa125f28ee11644c335eb313ec768df5
MD5 dce4b1e6a5f9b6d836913013606371ce
SHA1 b451c6be54e900b27b127fdabeea76a69337081f
SHA512 2c190d087f558f89bae07c4ddd47f8ed8c23a006ebf422583f01a01d3bced22fa617762e5f3709bec48e44b1e5c23707d5c326f91f837185e6aabaede01812ed
SSDEEP 12288:z3lUN6O5j1MBpxqB8p8xsd0goski8EcwUhB5+OiCYCsdOrSb2nTBJ:z3ltO5jWBz2/gEoCY9anTBJ
TLSH
T146E4021575B1D433D9F60A705470C7A1297ABC622A60B18FB7433F6F5EB22D2B632392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery cryptbot spyware stealer

Malware Config

Extracted

Family

cryptbot

wymesc72.top
morjed07.top

Attributes

payload_url
http://hoftsi10.top/download.php?file=lv.exe

Signatures

Family: CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 3 IoCs

resource	yara_rule
behavioral1/memory/2848-2-0x0000000002630000-0x0000000002711000-memory.dmp	family_cryptbot
behavioral1/memory/2848-231-0x0000000002630000-0x0000000002711000-memory.dmp	family_cryptbot
behavioral1/memory/2848-230-0x0000000000400000-0x0000000000A08000-memory.dmp	family_cryptbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	sub_e19e0e7f8871.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3216	2848	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sub_e19e0e7f8871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sub_e19e0e7f8871.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sub_e19e0e7f8871.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4564	timeout.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2848	sub_e19e0e7f8871.exe
2848	sub_e19e0e7f8871.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 4496	2848	sub_e19e0e7f8871.exe	89
PID 4496 wrote to memory of 4564	4496	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\sub_e19e0e7f8871.exe
"C:\Users\Admin\AppData\Local\Temp\sub_e19e0e7f8871.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\gujaxLjg & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\sub_e19e0e7f8871.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 1288
  2⤵
  - Program crash
  PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2848 -ip 2848
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XLKTCX~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\gujaxLjg\XLKTCX~1.ZIP
Size 49KB
SHA256 0a60a0ee8a33e755f0a1a1d8d07aacc9b48b47b57d59da57e96e8469df94e20e
MD5 95c590056096b28ef1aeb122b8221769
SHA1 fd4bd38c2f8ced9bf440b5fd2064755981f2277a
SHA512 7b18ba30b60d7688280106be06801e1f31a1b02b27983be62d851a55e3a3154ac0230294625cd48a7de88a0be329def30dc4f2fffb13d9e47fa390d17b192ac9
SSDEEP 1536:X5Gd1l4o6+5PKf6xr/3HLbdUY6kaackwO1:swE5yfA/bZtVckww
TLSH
T1623302415DEBC2AAC9E635F5B81B84A46790FEC471DD30306ED70CD26092ACF27156CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YCTTGB~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\gujaxLjg\YCTTGB~1.ZIP
Size 49KB
SHA256 2ef156005189e53dcff16632dc100833f440b02655a03f9cd6e84033b71dc098
MD5 551bf98f17eb2a76454ab45037b7aafc
SHA1 7386d22805787972e4cb9571edf14d90d8670331
SHA512 b4478d57f16bda319adb75fdadefef9a8b68906e3c230b894394cf6b188439eaf8128560d488d8d85e844f5d59c1d523260bcbea98c2d9849f28a52ca7812f53
SSDEEP 1536:qUYKaWxmejB6TC3Cragd0QQd4qWXPBE4nA/mWPP:WKpmejw+SVd03CqWXZE4AuWPP
TLSH
T11B33F1286217D718BD0A187C27E414D123E220FD696164723E7CCBA78C678DD971F5B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_INFOR~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\gujaxLjg\_Files\_INFOR~1.TXT
Size 7KB
SHA256 c4371e6f9f3761b5ccc954d60cec919678593b91f13a4e570c794f4ebbbbec94
MD5 cddfa77554a4105d01460d944e30ad3d
SHA1 e9725b9c168563b294d66746d8d527dc5c69fbe3
SHA512 f70ab34db3a18dc0befbccdc2a9529b04df5a74ac651e8807be71509e58714dff651472f8dc429232bc175c37518135d89b40c2d0e8729b36f1c3286466d3558
SSDEEP 96:s8UteB4n3QyDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:N+3Q795NlTUbT
TLSH
T1CCF1032C1BE48B15D1B2EB119DE00853B57B7816ED74CB8901E8634E87A7D22E874F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\gujaxLjg\_Files\_Information.txt
Size 1KB
SHA256 e51aadb350763a7cfb23cd831e2a8bb62a9f2ee0f64a8603675c7b914ae019a3
MD5 8b3a9149144f757d3570181c93231b58
SHA1 12edd3dd12319eb447aaa976cf97a3736092464b
SHA512 9983d1e2e4fe49376a9f87cc8785d31ad9fa7ec1d16eed784ecb042e3115c802f4e9a686a82f70f6547df512e051a63737777dec4992ccd7cd2fd6436287034a
TLSH
T1B631F31A5BE40204E2F7EE026EF60527677B7D606C38C56D10CC961D47F3925D824BAF
MD5 SHA1 SHA512 TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\gujaxLjg\_Files\_Information.txt
Size 4KB
SHA256 78bf44637a3823198cb840395d08acbd936aafd85d8756edecba41cd6856d95d
MD5 3b98116a8feb60496039154be0670dc6
SHA1 95152a7492d35a74ad2aa246e47aea940b92b23e
SHA512 68ee3198e66cf1081486760709feaed8065853ce9d5f1e1b0e225bc1659a9af6ed7b640169a3bf395473b485dc6080800d64f2bd5c58e79cc816ae44758af5d0
SSDEEP 48:sx6UteXxFaMIehGYTwTCuDQeDe7iGqXpF88be7HHcBOmjmcn+jYyrJB4McdZAaNR:s8UteB4n3QyDDMHcVmcnmB4Mcq4
TLSH
T1219147291BE44715E5B2EB10ADF14823B57B7855EC74CB4901EC620E83A7D22E864FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\gujaxLjg\_Files\_Screen_Desktop.jpeg
Size 68KB
SHA256 9cd76e5ae92bfdab9a707686fffb9559e54132575bf0c74969f2241c6e746457
MD5 2e66b1a585b1be8ecce05fd66547c440
SHA1 1d510ffaca77357c93cb365fd962a5cce85bbefe
SHA512 e6358513c9878c8d3d7ad58ad39b09515d34fab5eec1cc8aa28b5c1b1b9a00758449b4de38f6527cf6832fbdf684fc75168df53afbdaf14152f214bbc821bfaf
SSDEEP 768:JFbVCgisCM0tv/Xj9O+UYX6hJpIkjmw39jJ7REQ8MpkApVju5L5jIjAo7cbjOptc:JJf83t16h8DQ8h5LZqPEQgH
TLSH
T10363D6078D4C9F83951997E9BF074DAC2F4A271CE9523AFF41621ECB3E201225C9E52E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\gujaxLjg\files_\system_info.txt
Size 1KB
SHA256 43cc97f4a2034c005eac620d655d5a5a8c9ac410e531b883b496751fb2fea779
MD5 89cb93de6be927977a06be8df0808c27
SHA1 0215819c7f121abe0f4fa4633c41961a1936b4e9
SHA512 0c51512c4c859570f7335bfdb22cbc6d237fa7ff0742a5b7065ed97d32d2befde18e0bdddab0bd923f494239e181da911b11403d71c9d1a6cc4d95b98ded0072
TLSH
T1B22103162BE80104F6FBAE026DF6446657BBBD602D39D06C20CC960C4BF3915E825BAF
MD5 SHA1 SHA512 TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\gujaxLjg\files_\system_info.txt
Size 7KB
SHA256 68f13e2d7ac2db6dfc50421f8371e489112c0968aa066cfd30930bd49aeffd07
MD5 59cdd7917f58a7289698cf2f565e01c1
SHA1 4f87c221dc73b110459aeaa4e17085b5fd234c47
SHA512 8d95975c541c38a35e1bcf9e269503c047a2e3b3bb42cedce741bb57a11b7cb795f137827c7a29d6b2ac6fe261d33704708ddf49866f1fd37629c433b9ff513b
SSDEEP 96:aYtewoTgKDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:GlTgD95NlTUbT
TLSH
T13DF1022C1BE48B15D1B2EB119DE00813B57B7816ED74CB8901E8634E87A7D11E864F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2848-223-0x0000000000B90000-0x0000000000C90000-memory.dmp

Download

memory/2848-1-0x0000000000B90000-0x0000000000C90000-memory.dmp

Download

memory/2848-2-0x0000000002630000-0x0000000002711000-memory.dmp

Download

memory/2848-231-0x0000000002630000-0x0000000002711000-memory.dmp

Download

memory/2848-230-0x0000000000400000-0x0000000000A08000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads