cryptbot | d6255b4b18e6f07c4708cf6344163dfe3197cf403957bf3085a6a737bb37b038

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sub_d6255b4b18e6.exe
Size 750KB
Sample260524-b58a8set9l
SHA256 d6255b4b18e6f07c4708cf6344163dfe3197cf403957bf3085a6a737bb37b038
MD5 979d1d97ef97c7ae5737a88e87757ec4
SHA1 90d243cb67821975da1b13582476779eff5be9a5
SHA512 05c60e3714d906ea985a923ebda9e2efca17dfe29bfe9169f8e14f7053dd2871d9fa6bafb1d56919c07041be8841cfba82811ac1868398e2587ca25433727b4f
SSDEEP 12288:7RC0TWlTuoyPO3DwWUhREG4HR7cOIiatuSgw8ibKmYjoCM0G3Pll93USBfC:vWlTuzWNOiarzYjoj0G/ll9o
TLSH
T1E1F4F1207790C434F5F652F849BA83B9A93C7EB06B3461CB62D52EEE46342E4AC31757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery cryptbot spyware stealer

Malware Config

Extracted

Family

cryptbot

smarew72.top
moriwi07.top

Attributes

payload_url
http://guruzo10.top/download.php?file=lv.exe

Signatures

Family: CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 3 IoCs

resource	yara_rule
behavioral1/memory/668-2-0x00000000021B0000-0x0000000002291000-memory.dmp	family_cryptbot
behavioral1/memory/668-224-0x0000000000400000-0x00000000004E5000-memory.dmp	family_cryptbot
behavioral1/memory/668-225-0x00000000021B0000-0x0000000002291000-memory.dmp	family_cryptbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	sub_d6255b4b18e6.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	668	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sub_d6255b4b18e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sub_d6255b4b18e6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sub_d6255b4b18e6.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
796	timeout.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
668	sub_d6255b4b18e6.exe
668	sub_d6255b4b18e6.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2868	668	sub_d6255b4b18e6.exe	92
PID 2868 wrote to memory of 796	2868	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\sub_d6255b4b18e6.exe
"C:\Users\Admin\AppData\Local\Temp\sub_d6255b4b18e6.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\XqckIOmwu & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\sub_d6255b4b18e6.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1656
  2⤵
  - Program crash
  PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 668 -ip 668
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CLNHSS~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\XqckIOmwu\CLNHSS~1.ZIP
Size 47KB
SHA256 bc7895679d8d9672941280ec31056ee057d7e2d1d352454d85ed11daa4a8fb44
MD5 eff8ed3eaecd06edf2746c19643ca08f
SHA1 891a448435c22a5fda5cfec2d75f97fb6ea2039b
SHA512 120e65bad09a3eb1137f7370bbc798c30e6b7bec3c87ccf080c3ebb6f42e86d3fe03f3f3f1af2e3ad31e86ad756dbfae3eacb6b49cc7c5172c7eec6e848b896a
SSDEEP 768:GRhyJn7JLKW5rIYVpmI3bmUEkOVbM+ATbT/4qs580w+DieVcUnVyhkmRc9CqH:HdLKW5rZpDbm79VgpTJoxieGUnVEur
TLSH
T1B92301ABDF6A0DD7935131757502211E2E7690A368E5578A4AE8FF9E10E43021FACD33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBQZUC~1.ZIP

Path C:\Users\Admin\AppData\Local\Temp\XqckIOmwu\MBQZUC~1.ZIP
Size 47KB
SHA256 856faae2046a265f66572f5cdc2be947cff92923d77d240b907e200c52a17d8b
MD5 1e513a87fca4ad651125231ee813f27f
SHA1 df56a652b699777fba10dfbb20763d306925f33a
SHA512 d3eece4f887b96fd08ee395ff159a7228b3f7f7b70e01b5250978b64218c5c64a3193b85fb9bea9f1d2bcbb7805a1ea861a380e7af7e59a341b7a14425ac7fad
SSDEEP 768:+hhRhyJn7JLKW5rIYVpmI3bmUEkOVbM+ATbT/4qs580w+DieVcUnVyhkmRc9b:+IdLKW5rZpDbm79VgpTJoxieGUnVEuh
TLSH
T12A2301AFCB6A09D7929231706502251E3E3B906229D5435A8EE8FFDA10E87425F6C933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_INFOR~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\XqckIOmwu\_Files\_INFOR~1.TXT
Size 7KB
SHA256 035babd32ba1311382240a94aa4d06aa6f596f2f7a5e8ef4c3f112d4aad827d7
MD5 9a3b198a0bbdabd08588ea279446e43f
SHA1 c9913c4c2d86e5f55cf1df8e251229d97d12171d
SHA512 e090e4280bea9a078086dad79b55cfc0384f8fb9740f1a538ada77e4c6d75a2441e31516f57d587938ad365c76fc4df89bec8c17c42f1ffba787e22679dcd0ad
SSDEEP 96:sgUteBfn3QyDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:h53Q795NlTUbT
TLSH
T189F1022C1BE48B16D1B2EB119DE00853B57B7816ED74CB8901E8634E87A7D12E874F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\XqckIOmwu\_Files\_Information.txt
Size 1KB
SHA256 cb0867000816f9cd642939c28a51fa0d228358babaac413ce361b2a2f23f8a83
MD5 610cf16f99468d57222c361beab798c0
SHA1 c6fff4d1124e6ed3ed507e22e5f8262eae8e95b1
SHA512 f377716db3a48bd2cf02456ec78cc4db4724c0dcab7b46819bc26a3827eca1a1f5d8453cb6a4d2fc495393d9d5eaae2eedc0444271e6d6c6ec96ad1164b65c23
TLSH
T1712121165BE40104E2BBAE026DF64532A77B7D602C38D46D20CC860D4BF7921E8347AF
MD5 SHA1 SHA512 TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\XqckIOmwu\_Files\_Information.txt
Size 3KB
SHA256 084399ce274b96e29312bd1b679bc635902cae60a1acfa47e39bb7558314de30
MD5 6f3208ba3660808349e54baa4cdb84dd
SHA1 64b967d5eae3838fb9571ee096a0bb06578b5c0f
SHA512 b6191e15be916f43623ae2b61afc0e33db4d5a86e3ac544f19c52f7711b3cdd6a865c76bbf296d02bf47f2241b2dd2a6cc9dca3327f653bf7133547126a756dc
TLSH
T11C6135191BE44315E5B6AB11ADF10923B67B3851ED78CB8D01EC624E87A3D21E834F9F
MD5 SHA1 SHA512 TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\XqckIOmwu\_Files\_Information.txt
Size 4KB
SHA256 bdbd994a48f45a8db79f8cb4a7084b012f9b642938caaf18a29fc3df840fa9ad
MD5 22ab4423e0b0f8ab9e612e783512c686
SHA1 ece9a4aad8b3bc1c79b9776ba967ce03f03355e3
SHA512 14e09b7004c472b2fe0467b763012f955a636003adcc84313001a1767e92cc58c3a360bd8adc91145025dddfc7b70991d7de10dec4814f90ae5579c0a252b2a8
SSDEEP 48:sxjQ1UteXx1aMlehGYTwTCuDQeDe7iGqXpF88be7HHcBOmjmcn+jYyrJB4McdZAh:sgUteBfn3QyDDMHcVmcnmB4Mcq4he
TLSH
T18CA146191BE48716E5B2EB119DF04813B57B7855EC74CB4901EC220E87A7D22A874FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\XqckIOmwu\_Files\_Screen_Desktop.jpeg
Size 66KB
SHA256 8fbb576347cb19a6bba88a4360f79f6bdaa90cbcb14e2c16c02ec936f55043ec
MD5 f9990fe226d1189656e7ffd6c2385379
SHA1 c2ad02531b26f39e42522b19838c6f766cc9b849
SHA512 d9e7f767781eb3b59a61847d365c9d1221c65598cbf29ba451681c1620c14830a9b8010d8cab0115243b53a02468efea31c2c8fbbace57c3b08aac107a535248
SSDEEP 1536:JYRaqWD+m/ouXfXLM4s6LslrRZa6BGVfj6Z:CReDVw8fLM4rLsl9o6BGVf+Z
TLSH
T11563B0078D089B83A53997E9BE474EAD6F4A3B1DE5523AFF41225ECB3D741120C9E02D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\XqckIOmwu\files_\system_info.txt
Size 7KB
SHA256 d27bcd9f71a7ad4febe13ca825177400525065f4c1bae9aa185e0080fd1ca922
MD5 51791de49ba2870ae3abaa84a49a3db5
SHA1 1b407cf15d051dcfafa2285315f15592e900be25
SHA512 e9c7969e2c58c149b751d8a85b990c440924191c94e18b2620d77ee5f4221c021faa7fed0a00df07804b0e0dae214d2f09d557081311da21ee914215e5a5c9c4
SSDEEP 96:mYtew/TgKDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:KyTgD95NlTUbT
TLSH
T175F1222C0BE48B16D1B2EB119DE00813B5BB7816ED74CB8901E8634E87A7D11E874F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-224-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

memory/668-225-0x00000000021B0000-0x0000000002291000-memory.dmp

Download

memory/668-223-0x00000000007E0000-0x00000000008E0000-memory.dmp

Download

memory/668-1-0x00000000007E0000-0x00000000008E0000-memory.dmp

Download

memory/668-2-0x00000000021B0000-0x0000000002291000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads