cryptbot | 450624cfacc4237336833fd0d3e9eb928508224d5f1adf3b907fd3d5016526a6

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe
Size

4.1MB
MD5

a0c00db1c96524b17161060ecbbe6a87
SHA1

3eaa22467cf0f6a741d5e262c4b416db8c0a1f4b
SHA256

450624cfacc4237336833fd0d3e9eb928508224d5f1adf3b907fd3d5016526a6
SHA512

cedd14061d0d4c1035448d386f327478cfcf6bf3eb3c2c4589580e1e6ce30448f291658e50e44a5eb108caca515980e63525c008172951f7127111418374192a
SSDEEP

98304:7u6PnzjAOpAQiESlgpoWuhiB8k3rPGq8nfklad3O3+2tAcX36/p3a:77zjcllDi8qaPfklaQuFK

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

hbv01.info

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setup.exeSetupX.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SetupX.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SetupX.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exeSetupX.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SetupX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SetupX.exe

Executes dropped EXE 2 IoCs

Processes:

Setup.exeSetupX.exe

pid process

2180 Setup.exe
2540 SetupX.exe

pid	process
2180	Setup.exe
2540	SetupX.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

Setup.exeSetupX.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine	Setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Wine	SetupX.exe

Loads dropped DLL 7 IoCs

Processes:

a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exeSetup.exeSetupX.exe

pid	process
2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe
2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe
2180	Setup.exe
2180	Setup.exe
2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe
2540	SetupX.exe
2540	SetupX.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 iplogger.org
10 bitbucket.org
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Setup.exeSetupX.exe

pid process

2180 Setup.exe
2540 SetupX.exe

flow	ioc
5	iplogger.org
10	bitbucket.org

flow	ioc
3	ip-api.com

pid	process
2180	Setup.exe
2540	SetupX.exe

Drops file in Program Files directory 3 IoCs

Processes:

a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\Xedd\Setup.exe	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe
File created	C:\Program Files (x86)\Xedd\SetupX.exe	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe
File created	C:\Program Files (x86)\Xedd\DiscoveryTree.xml	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exeSetupX.exe

pid process

2180 Setup.exe
2540 SetupX.exe
Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

Setup.exe

pid process

2180 Setup.exe
2180 Setup.exe
2180 Setup.exe
2180 Setup.exe
2180 Setup.exe
2180 Setup.exe
2180 Setup.exe
2180 Setup.exe
2180 Setup.exe
2180 Setup.exe
2180 Setup.exe
2180 Setup.exe

pid	process
2180	Setup.exe
2540	SetupX.exe

pid	process
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe
2180	Setup.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe

description	pid	process	target process
PID 2140 wrote to memory of 2180	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	Setup.exe
PID 2140 wrote to memory of 2180	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	Setup.exe
PID 2140 wrote to memory of 2180	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	Setup.exe
PID 2140 wrote to memory of 2180	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	Setup.exe
PID 2140 wrote to memory of 2180	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	Setup.exe
PID 2140 wrote to memory of 2180	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	Setup.exe
PID 2140 wrote to memory of 2180	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	Setup.exe
PID 2140 wrote to memory of 2540	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	SetupX.exe
PID 2140 wrote to memory of 2540	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	SetupX.exe
PID 2140 wrote to memory of 2540	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	SetupX.exe
PID 2140 wrote to memory of 2540	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	SetupX.exe
PID 2140 wrote to memory of 2540	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	SetupX.exe
PID 2140 wrote to memory of 2540	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	SetupX.exe
PID 2140 wrote to memory of 2540	2140	a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe	SetupX.exe

C:\Users\Admin\AppData\Local\Temp\a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0c00db1c96524b17161060ecbbe6a87_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2140

C:\Program Files (x86)\Xedd\Setup.exe
"C:\Program Files (x86)\Xedd\Setup.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2180

C:\Program Files (x86)\Xedd\SetupX.exe
"C:\Program Files (x86)\Xedd\SetupX.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2540

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\BbZJgLHkhs2vK1A\Files\_Info.txt
Filesize
1KB

MD5
d3ce6e232464ad9350e9317efe83745d

SHA1
313cdfc865e8e950d53473fae61288395db3b32e

SHA256
0f2621a652e175f94838d6f8a95331447e5c0b87262c44d8745586911980faca

SHA512
33ccedf13d8557d941a8f87397791f6f5270be2bd95d1590dd392cd9b179184a3fbba7ebff4ee1fb124b5279cb3f46ae4e91b3df8bf5fb032f17d790391eaf8f

Download Submit
C:\ProgramData\BbZJgLHkhs2vK1A\umpCPHYbg.zip
Filesize
43KB

MD5
310a18346d5fdc087fe94336edbff205

SHA1
760fcd8507b5b174c6791934985d3fae2b7ea766

SHA256
43db5b912a2c6847d9e9bb275e315a3cc716c187d8905c5d142ed87594349e46

SHA512
0a9ae10d53f3497b5f9cb33dedfc58cabd8e34c917114f5f4555713e349ed134e239eaeeed075e566614cc01c3dccb36d00b3019ddc325b7c555450f6706b1db

Download Submit
\Program Files (x86)\Xedd\Setup.exe
Filesize
2.1MB

MD5
adf27669e814f5a7a6dfa36ade88c9ae

SHA1
b8dbb43c2070cf04ae6b2d62dc010564fbf3599e

SHA256
dd5ae3cc6b45057a744d2fa1f7f42b03980b7aa90154b2eebdb8b4ad5a02babc

SHA512
5cad0447d1c748424c66fb3bf7a7cf04a7ecae090cb68848f73eeff903ebf83b4431fba474f04752bef2ace9398bb538fae53ec14c3f8aeaa8c65d759f02dd95

Download Submit
\Program Files (x86)\Xedd\SetupX.exe
Filesize
2.0MB

MD5
d5f103b258b8d98e4398b82b9972deb5

SHA1
1a43a240d0b4fdc6baf88e7d1104519737b488e8

SHA256
cd19ece38b82e73c78da4b7ff39bb8518f50148adc00e8ba94ffb119e4ee6fe0

SHA512
c764aafbbcb7b6d78b937da0fbf266f9747c0242232326194812d480320dc47ebd52a2aed417a7257569cd9e2159693df00d6249226814f98e8acc59fd728351

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1768.tmp\UAC.dll
Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
memory/2140-10-0x0000000002E80000-0x00000000033B5000-memory.dmp

Filesize
5.2MB

Download
memory/2140-24-0x0000000002E80000-0x0000000003393000-memory.dmp

Filesize
5.1MB

Download
memory/2140-59-0x0000000002E80000-0x0000000003393000-memory.dmp

Filesize
5.1MB

Download
memory/2180-83-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-81-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-86-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-43-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-73-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-45-0x0000000000960000-0x0000000000E95000-memory.dmp

Filesize
5.2MB

Download
memory/2180-18-0x0000000000960000-0x0000000000E95000-memory.dmp

Filesize
5.2MB

Download
memory/2180-16-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-60-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-88-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-78-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-63-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-76-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-66-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-91-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-68-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2180-17-0x0000000000960000-0x0000000000E95000-memory.dmp

Filesize
5.2MB

Download
memory/2180-71-0x0000000001280000-0x00000000017B5000-memory.dmp

Filesize
5.2MB

Download
memory/2540-67-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-72-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-74-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-69-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-64-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-77-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-62-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-79-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-61-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-82-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-44-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-84-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-30-0x0000000001330000-0x0000000001843000-memory.dmp

Filesize
5.1MB

Download
memory/2540-87-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-31-0x0000000001330000-0x0000000001843000-memory.dmp

Filesize
5.1MB

Download
memory/2540-89-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-26-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download
memory/2540-92-0x0000000000400000-0x0000000000913000-memory.dmp

Filesize
5.1MB

Download