cryptbot | 450624cfacc4237336833fd0d3e9eb928508224d5f1adf3b907fd3d5016526a6

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

2.1MB
MD5

adf27669e814f5a7a6dfa36ade88c9ae
SHA1

b8dbb43c2070cf04ae6b2d62dc010564fbf3599e
SHA256

dd5ae3cc6b45057a744d2fa1f7f42b03980b7aa90154b2eebdb8b4ad5a02babc
SHA512

5cad0447d1c748424c66fb3bf7a7cf04a7ecae090cb68848f73eeff903ebf83b4431fba474f04752bef2ace9398bb538fae53ec14c3f8aeaa8c65d759f02dd95
SSDEEP

49152:CBNna0auzsTnSHUHOuV22RjquJVSNlI3eILfkCxJh:aYr9OuV2+quvAI3eqfkCxJh

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

hbv01.info

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setup.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Setup.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setup.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine Setup.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setup.exe

pid process

1704 Setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine	Setup.exe

flow	ioc
3	ip-api.com

pid	process
1704	Setup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Setup.exe

pid process

1704 Setup.exe
Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

Setup.exe

pid process

1704 Setup.exe
1704 Setup.exe
1704 Setup.exe
1704 Setup.exe
1704 Setup.exe
1704 Setup.exe
1704 Setup.exe
1704 Setup.exe
1704 Setup.exe
1704 Setup.exe
1704 Setup.exe
1704 Setup.exe

pid	process
1704	Setup.exe

pid	process
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe
1704	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\bmaHvkpGLzKX\5hS3irIQymO25Ia.zip
Filesize
43KB

MD5
efb133577eb9b72ce88bc46b22bb1067

SHA1
8be6404e6070d10be4b0b7c7e5af1943b9d1bb81

SHA256
afe4100f963eb8b93285e6da6d66d85031d5557b726d04e92312990d2674522a

SHA512
37e428d534c4d99d8648f9ce17eeef89003a1a55817e836435443319a53103e2e37cc070df5af3cb325fefaef88fe23532cc37c0919ebd01f4b57e4141d036f5

Download Submit
C:\ProgramData\bmaHvkpGLzKX\Files\_Info.txt
Filesize
1KB

MD5
abf0bd3ae44c2ebbd7326df2bc838a7e

SHA1
6923f5b0e2167ea394d8e555184d89814a145c71

SHA256
e76d4274373ed192fc94d73db7e65778016f783b64caa006b2c7c77ac3de9b8a

SHA512
a59e118e9a1584151066d2ab54797b92039292a2100619756966959c17b3b59c311579658e952d75085ab3b8fb6cb179292e7930178462d8209a3a3b835a825e

Download Submit
memory/1704-35-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-13-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-4-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download
memory/1704-41-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-6-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/1704-7-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/1704-8-0x00000000011A1000-0x0000000001200000-memory.dmp

Filesize
380KB

Download
memory/1704-42-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-19-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-20-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-23-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-24-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-25-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-43-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-0-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-40-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-5-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1704-3-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1704-2-0x0000000000B70000-0x0000000000B72000-memory.dmp

Filesize
8KB

Download
memory/1704-45-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-46-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-47-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-48-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-50-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-51-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-1-0x00000000776D0000-0x00000000776D2000-memory.dmp

Filesize
8KB

Download
memory/1704-53-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-54-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-56-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-57-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-59-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-60-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download
memory/1704-62-0x00000000011A0000-0x00000000016D5000-memory.dmp

Filesize
5.2MB

Download