cryptbot | e8ce5ad5f725d815f30881cbc45cd4fecd528d4e74f18654d11816c07964bf2e

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
Size

2.1MB
MD5

79d694b6013391578dcb6b0dddd21994
SHA1

ab6ed57debc6eea81fde739926aeef08aaccae10
SHA256

e8ce5ad5f725d815f30881cbc45cd4fecd528d4e74f18654d11816c07964bf2e
SHA512

dcda7e5d2a4e3ceb70413cc18fb0c185e033541a5838643b6c620f2197691655a458a0d05604606b32a680ce9e83ff51f3f694f32dba453bdf454ca3ac7b941d
SSDEEP

49152:avQex8xXSUvxfxjO/x5f+2vMkZ2hKAh1tRF4K0pMqLtfkCxJh:avQ08xXFvxfRux5G2vdZb674K0pMqLtj

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

hbv01.info

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine 79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

pid process

1084 79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

flow	ioc
3	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

pid process

1084 79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

pid	process
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
1084	79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79d694b6013391578dcb6b0dddd21994_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\zhylDIeRziY\47283761.txt
Filesize
156B

MD5
b5089e0c5a3d5377e9bd19c0557ef04e

SHA1
9402e326be3d240e234c06892b15c24e93c93eb8

SHA256
d77789b2c49759c882f4fdd6f53e665b0d012f8f0949d0150eaba47fbf2a0eb5

SHA512
942349ccb99854f274ef1e20b623660588e15bd0d25bfc817fe9b2d010db656af340652e0e67b41edbf0cf259d55ab880d6b50acb1d7e8ab394f1393f7956c13

Download Submit
C:\ProgramData\zhylDIeRziY\Files\_Info.txt
Filesize
1KB

MD5
0aa67eac8e00419eacf900a288ea6359

SHA1
5418b5cc34a60084a74ed1a00bb4cd51f4a3c134

SHA256
e9bfb7c83eca99e3509d7a330fa30ef2d8f76e70706b2f31853587544732cc29

SHA512
cd38428694ea4ba4a92de1c1641d30636e2b4cbcf3d81d4f8bb68886274b1beac36ccbad325291501204a19c156f331215aea306f31d1c99457b06ca1eefd874

Download Submit
C:\ProgramData\zhylDIeRziY\mOjCwWSu5gXQoiWt.zip
Filesize
42KB

MD5
53e9948fbe9565b8cc8b2cf622df9a69

SHA1
72d044ff372e9354b845402ef455936590d9a287

SHA256
d0022d2dc4d30335ebbefa6973a8e638a9219963744ccb6140e52d73c49d6260

SHA512
170678821d3fbf96d01377ea27597667ea8363e41cd7f4e77fc8dd0c4a33ac79c7f3ff1422a951caafbe6704b302c5b60c2fabe0153f5bf200b8e39bf34b8b12

Download Submit
memory/1084-50-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-8-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1084-7-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/1084-53-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-9-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/1084-56-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-11-0x0000000000811000-0x0000000000870000-memory.dmp

Filesize
380KB

Download
memory/1084-12-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-18-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-21-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-22-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-25-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-5-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1084-4-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1084-45-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-0-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-84-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-6-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/1084-10-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/1084-55-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-57-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-1-0x00000000776F0000-0x00000000776F2000-memory.dmp

Filesize
8KB

Download
memory/1084-59-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-60-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-62-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-65-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-67-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-69-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-72-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-74-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-77-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-79-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-81-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-52-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download
memory/1084-86-0x0000000000810000-0x0000000000D44000-memory.dmp

Filesize
5.2MB

Download