cryptbot | 3d0c53b85d752355b9185c5d43a96dc028f2a56e73fb3358dc6a7f0882329e4e

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

2.2MB
MD5

4ae318b79250c2969d663dee668f3a27
SHA1

57e5cd1eef257683efc4f82c369739621d8299ce
SHA256

753af3a9e8f98e03f71c700d6913933962a3510ffefb97cd57ccbc20991a98a4
SHA512

a925d50a05e423533a0aec8f552af0e6f55dd3c116bfbbd6ac49ae6c3dd6acd0641ca3dca70499f22a54860c2374f26c2a807f380475290220f74e53c9bf8aab
SSDEEP

49152:JgEDGPCdUgDPLBOLkqZKqwC7s4FHPIr7DhJDwKQLb:DDcC7PLBpEKqV7HdyrDef

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

tuytee16.top

moriiikk08.top

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 15 IoCs

Processes:

resource	yara_rule
behavioral13/memory/2216-222-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-224-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-226-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-229-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-231-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-233-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-236-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-238-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-240-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-242-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-244-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-246-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-249-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-251-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot
behavioral13/memory/2216-253-0x0000000001020000-0x0000000001550000-memory.dmp	family_cryptbot

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

1.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1.exe
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

1.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

1.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine 1.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

1.exe

pid process

2216 1.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	1.exe

pid	process
2216	1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1.exe

pid process

2216 1.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

1.exe

pid process

2216 1.exe
2216 1.exe

pid	process
2216	1.exe

pid	process
2216	1.exe
2216	1.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2216

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PTx6OcwdD\RGQSYrry3lET.zip
Filesize
35KB

MD5
b9c9412fe9228eb5488c4ebedc35ca46

SHA1
ca521626ec0acc8dd7c271611489e3b90b4b7576

SHA256
b86b2f3c2bd0f88b9eff203496c4e965b3698874cb9622e4431d195702802c5e

SHA512
1ff20be54fe988d54232e00049f9e2f02fadefe77bd2a3a90836296970a9d782bbbec9d59a92b9a2a74965128562bb78e8726acd3f63fd875d7615a278d8be47

Download Submit
C:\Users\Admin\AppData\Local\Temp\PTx6OcwdD\_Files\_Information.txt
Filesize
3KB

MD5
2c037954fcdb14458ad8a98aaa084710

SHA1
c37210fbf0e11d38f38ea52bb6414a770f445579

SHA256
f968f7022aa1d7ea6ca1fd7987dd3d2824965d4c94b69be173c6cd47e6afc4e3

SHA512
2a3a9e27226a1e4cdff585c47cbaa3d992eb5fbe13a7d431e2493c6a534159388db7e456cc26ab4a601c038d551d796fa87cc9b03774389e205daa15fb9b5dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\PTx6OcwdD\_Files\_Information.txt
Filesize
7KB

MD5
160c2b1c038387266b1aa9feae04f270

SHA1
c4b04f03b7cdd383327822eb99e19598fa5e5f65

SHA256
272dec94b64bfae073cd843a050fd4bab9e23b8ac5348ff182014ea7220aa0ff

SHA512
b5eb42017ae477b35337a985c806166c5460e6ed1cfa33ac5413b75d21548d0b9b59f08771cb52d9a41eb59150a7f5f5d7d7d3258b8d8f6cc2d4cf29851d500c

Download Submit
C:\Users\Admin\AppData\Local\Temp\PTx6OcwdD\_Files\_Screen_Desktop.jpeg
Filesize
42KB

MD5
fb20c0155f5d06a3100c4efad0cf7eca

SHA1
0c17c005b7b1fd7275d7e628fadc6af163e4b533

SHA256
fa927155bff97e3fd22bbf24de21af99eb8d68fcf16179917448a6d2d560e3b3

SHA512
d64b11cfd42c01fc82f7c710045683900d3a63f7c892874509c08d265a30e6eaf923eb1e0d5b54b9b420720939586bfc622b472a45b069b9d2a04f37fb0284b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\PTx6OcwdD\files_\system_info.txt
Filesize
8KB

MD5
46334131bfec1f8abab5e53f5bc94d24

SHA1
4bdb77e3524d5a6d70409a3f3f2495911c9b65c9

SHA256
a48226734237a516ab6cf4730f6d1dbeda878456be572f7b136af4280e56e637

SHA512
29f762201b98f9a7dceb5e61b738b40e4b92a588c02f013624c52e5dd027667fa77bd80d12052d2c2e7f83f73beca7cbf3e9d1e4aeae6ece64381bb3ffa6c693

Download Submit
memory/2216-226-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-233-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-4-0x0000000077640000-0x0000000077642000-memory.dmp

Filesize
8KB

Download
memory/2216-3-0x0000000000A10000-0x0000000000F40000-memory.dmp

Filesize
5.2MB

Download
memory/2216-2-0x0000000000A10000-0x0000000000F40000-memory.dmp

Filesize
5.2MB

Download
memory/2216-222-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-224-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-0-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-1-0x0000000000A10000-0x0000000000F40000-memory.dmp

Filesize
5.2MB

Download
memory/2216-229-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-231-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-5-0x0000000001021000-0x000000000107C000-memory.dmp

Filesize
364KB

Download
memory/2216-236-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-238-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-240-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-242-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-244-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-246-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-249-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-251-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download
memory/2216-253-0x0000000001020000-0x0000000001550000-memory.dmp

Filesize
5.2MB

Download