cryptbot | 41ce8dc9fe52cbb66ddf436ec0d9160bf9ce9194c423fbc0397705793f8ddc2c

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Download.exe
Size

2.1MB
MD5

b8312084a400862a2c19797691c6f0a6
SHA1

d675f4ed00508ff0208f75fd6851d14348c9bed4
SHA256

9f23b60e0b3c3360a2b67cc40d977577a74d1b16306522aa306b0feb29dad07b
SHA512

beae195ed8dd2572e7299cdbe137d80f152cefa89c8bca25bafcf9527b34157833972cc3142d803e8cef33d5fe72217278253f423cc203585097a7ec1a0496ce
SSDEEP

49152:fP3lms2TDH5VBPPRmZ6riTIWQhL1iNVcKs3UqVobLeuufeoyKk0lIeDe/:X4s25VBPPRbGYL16qltSbLNm/yKk0lIP

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

cede01.info

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Download.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Download.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Download.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Download.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Download.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Download.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Download.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine Download.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Download.exe

pid process

1960 Download.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine	Download.exe

flow	ioc
3	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Download.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Download.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Download.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Download.exe

pid process

1960 Download.exe

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

Download.exe

pid	process
1960	Download.exe
1960	Download.exe
1960	Download.exe
1960	Download.exe
1960	Download.exe
1960	Download.exe
1960	Download.exe
1960	Download.exe
1960	Download.exe
1960	Download.exe
1960	Download.exe
1960	Download.exe

C:\Users\Admin\AppData\Local\Temp\Download.exe
"C:\Users\Admin\AppData\Local\Temp\Download.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\nraMsmBuZXXrHjT\02NhaQKiz.zip
Filesize
925KB

MD5
591e2451cbb28f730d16f78f0c89f855

SHA1
c38dd4ced315f3b8632cc6fdc5e8171960337e26

SHA256
c8e0e81df73faa06e35613505619b4cdba7241cb1566ca55aa86f05b792891ee

SHA512
03c8c8f401c36261a20267e92b4b09b4a6d050154821239bb0b09b44a331e17977bfe340068dc8933c2586c31a3c2ed8aa1a91394d05cf70e2aa9f43c9edf261

Download Submit
C:\ProgramData\nraMsmBuZXXrHjT\47283761.txt
Filesize
156B

MD5
b5089e0c5a3d5377e9bd19c0557ef04e

SHA1
9402e326be3d240e234c06892b15c24e93c93eb8

SHA256
d77789b2c49759c882f4fdd6f53e665b0d012f8f0949d0150eaba47fbf2a0eb5

SHA512
942349ccb99854f274ef1e20b623660588e15bd0d25bfc817fe9b2d010db656af340652e0e67b41edbf0cf259d55ab880d6b50acb1d7e8ab394f1393f7956c13

Download Submit
memory/1960-56-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-8-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/1960-13-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1960-12-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1960-0-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-10-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1960-9-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/1960-57-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-19-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-58-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-23-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-15-0x0000000000D01000-0x0000000000D60000-memory.dmp

Filesize
380KB

Download
memory/1960-43-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-51-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-53-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-54-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-11-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/1960-14-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/1960-20-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-59-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-1-0x0000000077330000-0x0000000077332000-memory.dmp

Filesize
8KB

Download
memory/1960-61-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-63-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-65-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-67-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-70-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-72-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-74-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-76-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-79-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-81-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-83-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-86-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download
memory/1960-88-0x0000000000D00000-0x000000000122C000-memory.dmp

Filesize
5.2MB

Download