cryptbot | 450624cfacc4237336833fd0d3e9eb928508224d5f1adf3b907fd3d5016526a6

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

2.1MB
MD5

adf27669e814f5a7a6dfa36ade88c9ae
SHA1

b8dbb43c2070cf04ae6b2d62dc010564fbf3599e
SHA256

dd5ae3cc6b45057a744d2fa1f7f42b03980b7aa90154b2eebdb8b4ad5a02babc
SHA512

5cad0447d1c748424c66fb3bf7a7cf04a7ecae090cb68848f73eeff903ebf83b4431fba474f04752bef2ace9398bb538fae53ec14c3f8aeaa8c65d759f02dd95
SSDEEP

49152:CBNna0auzsTnSHUHOuV22RjquJVSNlI3eILfkCxJh:aYr9OuV2+quvAI3eqfkCxJh

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

hbv01.info

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setup.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Setup.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setup.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Wine Setup.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setup.exe

pid process

1484 Setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Wine	Setup.exe

flow	ioc
2	ip-api.com

pid	process
1484	Setup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Setup.exe

pid process

1484 Setup.exe
1484 Setup.exe
Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

Setup.exe

pid process

1484 Setup.exe
1484 Setup.exe
1484 Setup.exe
1484 Setup.exe
1484 Setup.exe
1484 Setup.exe
1484 Setup.exe
1484 Setup.exe
1484 Setup.exe
1484 Setup.exe
1484 Setup.exe
1484 Setup.exe

pid	process
1484	Setup.exe
1484	Setup.exe

pid	process
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe
1484	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1484

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\BbZJgLHkhs2vK1A\Files\_Info.txt
Filesize
5KB

MD5
39e38f2951a7c484947c8b5f6db1ebd3

SHA1
f425d9c6a16139bed57e78b5bc20e9cc106d9cfb

SHA256
92ae0ac549d35fd0acce851bdfd0ff2aa8cbd8a8deccccb2e26b1744d3d2554c

SHA512
695cfc902ae0f57b3e99c01dcfbc0de40cf35b1c94fff491d4c9f66429b85485ad6304d9e554a3c250666dca04ca3ba05bcc916ba205a4d21843fcc17fd73ed3

Download Submit
C:\ProgramData\BbZJgLHkhs2vK1A\Files\_Info.txt
Filesize
7KB

MD5
44a610721edb8753c1ae846e4db5b57b

SHA1
c2423a026ac16cbf07a610cbeb8c4c97c8cdcd7b

SHA256
23e25e7a238e3a399dc67ade115d3602aa9e4edf4e8405f91513d3e371c00cbc

SHA512
cd9f567c972d3b2829c8711f03be859511fc6c56616696ab61e2ad823e9b5399069e6f67a164d04ef39bf4980a526c974947206bee4e0dcf791dd2cbc96659c8

Download Submit
C:\ProgramData\BbZJgLHkhs2vK1A\umpCPHYbg.zip
Filesize
269KB

MD5
200bbff9ee51e46178509b879081417e

SHA1
2fcc103ac4b9b16304e3776c39e99bcc97e5084f

SHA256
526782de162c2fdba2f56ef361074cfe4132b9b7a79c3645068382e0be6cc4c8

SHA512
d56bca3c1a7a8a0b21986bf8ad70313cd6d26f1f78209e652094236e075f303da48f30ff7d369ccae51425305686f4e12a0fe7f03de13c41eaa023bec187e9ec

Download Submit
memory/1484-147-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-149-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-9-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/1484-15-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-16-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-19-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-20-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-11-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/1484-12-0x0000000000E01000-0x0000000000E60000-memory.dmp

Filesize
380KB

Download
memory/1484-135-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-146-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-0-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-148-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-10-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/1484-152-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-153-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-1-0x0000000077D84000-0x0000000077D86000-memory.dmp

Filesize
8KB

Download
memory/1484-156-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-160-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-162-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-165-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-166-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-168-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-170-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-172-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-175-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download
memory/1484-176-0x0000000000E00000-0x0000000001335000-memory.dmp

Filesize
5.2MB

Download