cryptbot | 9a1d6cabb8a80b1ff7ac31d8c01f3522ca64860a8b9816eda57d44d7e994ec5a

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13842292b894939dabc62c2370c0094c_JaffaCakes118.exe
Size

4.2MB
MD5

13842292b894939dabc62c2370c0094c
SHA1

405bfa3788bcf6fbab169e90442134f4e9bedeb9
SHA256

9a1d6cabb8a80b1ff7ac31d8c01f3522ca64860a8b9816eda57d44d7e994ec5a
SHA512

6e77bea261b8100d2288f8ee8f13fef033a2dc3a8d45d4198fe955bec63b82e66d6f1d542b3767e498188251d951825caaf44e4a9a40e0f15e185f59d3e828b3
SSDEEP

98304:hFhmmnjy6kFUpuf0xK/7UqS+Xv7yn3EeeQ069sWU/:hFhvm6kykf0xK/TBXmn33eCsl

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

bibinene01.top

moraass05.top

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 20 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3548-30-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-31-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-83-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-247-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-251-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-253-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-254-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-256-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-257-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-260-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-263-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-266-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-269-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-272-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-274-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-278-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-284-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-287-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-290-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot
behavioral2/memory/3548-293-0x0000000000190000-0x0000000000697000-memory.dmp	family_cryptbot

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

d7.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d7.exe
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

d7.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d7.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d7.exe
Executes dropped EXE 1 IoCs

Processes:

d7.exe

pid process

3548 d7.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

d7.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Wine d7.exe
Loads dropped DLL 3 IoCs

Processes:

13842292b894939dabc62c2370c0094c_JaffaCakes118.exe

pid process

4508 13842292b894939dabc62c2370c0094c_JaffaCakes118.exe
4508 13842292b894939dabc62c2370c0094c_JaffaCakes118.exe
4508 13842292b894939dabc62c2370c0094c_JaffaCakes118.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

d7.exe

pid process

3548 d7.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d7.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d7.exe

pid	process
3548	d7.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Wine	d7.exe

pid	process
4508	13842292b894939dabc62c2370c0094c_JaffaCakes118.exe
4508	13842292b894939dabc62c2370c0094c_JaffaCakes118.exe
4508	13842292b894939dabc62c2370c0094c_JaffaCakes118.exe

pid	process
3548	d7.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d7.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d7.exe

pid process

3548 d7.exe
3548 d7.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

d7.exe

pid process

3548 d7.exe
3548 d7.exe

pid	process
3548	d7.exe
3548	d7.exe

pid	process
3548	d7.exe
3548	d7.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

13842292b894939dabc62c2370c0094c_JaffaCakes118.exe

description	pid	process	target process
PID 4508 wrote to memory of 3548	4508	13842292b894939dabc62c2370c0094c_JaffaCakes118.exe	d7.exe
PID 4508 wrote to memory of 3548	4508	13842292b894939dabc62c2370c0094c_JaffaCakes118.exe	d7.exe
PID 4508 wrote to memory of 3548	4508	13842292b894939dabc62c2370c0094c_JaffaCakes118.exe	d7.exe

C:\Users\Admin\AppData\Local\Temp\13842292b894939dabc62c2370c0094c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13842292b894939dabc62c2370c0094c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4508

C:\Users\Admin\AppData\Local\Temp\sib3BF2.tmp\0\d7.exe
"C:\Users\Admin\AppData\Local\Temp\sib3BF2.tmp\0\d7.exe" /s
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3548

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JUtdtAslln\4p2tMkriPvnR.zip
Filesize
41KB

MD5
c566a0215f4fde4084fa8c6488e8cabf

SHA1
c7f55c1ef2d9664eaed97102dccde6ca98824079

SHA256
2d9dc02dc6982a09e77d35829745ba047259cadeeae27e9cccd31b4373e1adc9

SHA512
bc6c52115d02f2b36f5733c43c01e60d9c49ed699c107f9f0b2fa780f457cdc694427ec3323c03489ff98d89a47c010156756304057ca12a6bc5492b7908b04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\JUtdtAslln\_Files\_Information.txt
Filesize
4KB

MD5
ce453535a80fd5808f683c93b8fb47eb

SHA1
70336889880df256a0cf766acf9b7acc192c5a17

SHA256
448f5904b702558bc2ca7d8606c09a2c51afa35a008139d6494eda379372142e

SHA512
8478978c430d6ebe73b78e14a4ec7e173cc443c92e63856e529338857ab94e32cfcd475ae5135d69a709e6987e07f32c3d24a75bc807d423df8590bf61e7303b

Download Submit
C:\Users\Admin\AppData\Local\Temp\JUtdtAslln\_Files\_Screen_Desktop.jpeg
Filesize
47KB

MD5
f21a51b520560fe687597d9ea98c0913

SHA1
e5d4975222d2a1aafbf694ca5fb99bfbcef94da9

SHA256
f874a7ab6aa6a610c0e370e7aee08f33c9c92591430d8e9a664813ea5c6d8052

SHA512
9fbef8694d59439a2dce01e21df9020a1ec5aa2df8d73415574bdbd63a7b472ac5018897434fdbfbaf99b3fb8d4367bf9e99c35e4c99a673ec829f4946a8d78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\JUtdtAslln\files_\system_info.txt
Filesize
686B

MD5
232127235a7bda67c31186b80ce5ce76

SHA1
981f48e75473a50ff547ec955a5adce6436011b2

SHA256
6114e1d6f939485496e8d8b3bb9e0f44ec009ce7da8f5cb5f7fcc65d377e4f26

SHA512
c35a7a972d489e65e49fcf506d03a5677847dfed275723566aaf2d56a12d2d5a693f36ab1381c6b945c5c3f55e5c33db44b8e4dc5dd20ffc994a9f4e7ba9de26

Download Submit
C:\Users\Admin\AppData\Local\Temp\JUtdtAslln\files_\system_info.txt
Filesize
7KB

MD5
075937a1622c8cac5dc2ab2d60641ec1

SHA1
918e599a413d138f2a8e32ba72681315c32a1885

SHA256
7429912f6523e681176ee99bb85ed8eff3368ff59b9017ba8a4b36005610eef0

SHA512
9382d02752be005d2dc5c09c3a025ec2f2af67f4538cfa0ae249e6d2969cff2db39cc1d96e6eed15aa91333b3632ce121f6859321381b709450b8512db246305

Download Submit
C:\Users\Admin\AppData\Local\Temp\JUtdtAslln\sXqGkkrz.zip
Filesize
41KB

MD5
788fc2b95040f0b65509c4b0312e3b54

SHA1
8ad75d8d29334d9daaca8d867d59c1cdd12346b9

SHA256
37a62e7a998d3a8db7867818f9b30871b4fda0e73c77d9e0694523f1c89cb949

SHA512
dee65cdabcfaa8b55144e45411743c143951d758016e89cfdf311fd29a65ef08aca972efa29df2cd3a432b13f3530861ed01d730097c786a9d991fc1b7b1c9aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv3B64.tmp\Sibuia.dll
Filesize
524KB

MD5
6a3c3c97e92a5949f88311e80268bbb5

SHA1
48c11e3f694b468479bc2c978749d27b5d03faa2

SHA256
7938db73242aafbe80915e4ca886d38be9b7e872b93bdae1e8ee6cf4a005b7d9

SHA512
6141886a889825ccdfa59a419f7670a34ef240c4f90a83bc17223c415f2fbd983280e98e67485710e449746b5bf3284907537bef6ab698a48954dd4910ddf693

Download Submit
C:\Users\Admin\AppData\Local\Temp\sib3BF2.tmp\0\d7.exe
Filesize
2.0MB

MD5
f7d357ad02e19287fbfdd8fc138a3662

SHA1
88ddb3cd546a4751d57fade705264d2b575ff35a

SHA256
848ebc63155b66409cd11733c08ab85b1886009dfa895c7dc56c63079d23125f

SHA512
873a7203e7c4ea6fdde068ab6d38d0355ea68820388bd92c33119082155d36d13f4cbbbc90aab9f1b4c4533e303e1b174b84c5f5bfe65dd2fbe154d13011abd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\sib3BF2.tmp\SibClr.dll
Filesize
51KB

MD5
5ea6d2ffeb1be3fc0571961d0c4c2b5f

SHA1
902dfe9ae735c83fb0cb46b3e110bbf2aa80209e

SHA256
508336b6a7c3226738e74f6ce969e828da904ad9f7610b9112f883a316ee9222

SHA512
e81657087f451a37f06a07bf84175117fdaf75d5d8b84cbdc49497fcf88f96e259074518ea3037680d27c9eaeebd7a8df496297593fead88d7edea202a572585

Download Submit
memory/3548-29-0x0000000000191000-0x00000000001EC000-memory.dmp

Filesize
364KB

Download
memory/3548-269-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-30-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-28-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/3548-27-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/3548-26-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/3548-25-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/3548-31-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-23-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-83-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-293-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-290-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-287-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-247-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-284-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-278-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-251-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-274-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-253-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-254-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-256-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-257-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-260-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-263-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-266-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/3548-24-0x0000000077394000-0x0000000077396000-memory.dmp

Filesize
8KB

Download
memory/3548-272-0x0000000000190000-0x0000000000697000-memory.dmp

Filesize
5.0MB

Download
memory/4508-14-0x0000000010C90000-0x0000000010CA2000-memory.dmp

Filesize
72KB

Download
memory/4508-249-0x0000000073B70000-0x0000000074320000-memory.dmp

Filesize
7.7MB

Download
memory/4508-248-0x0000000073B7E000-0x0000000073B7F000-memory.dmp

Filesize
4KB

Download
memory/4508-10-0x0000000073B7E000-0x0000000073B7F000-memory.dmp

Filesize
4KB

Download
memory/4508-15-0x0000000010CB0000-0x0000000010D6A000-memory.dmp

Filesize
744KB

Download
memory/4508-16-0x0000000073B70000-0x0000000074320000-memory.dmp

Filesize
7.7MB

Download
memory/4508-22-0x0000000073B70000-0x0000000074320000-memory.dmp

Filesize
7.7MB

Download