cryptbot | 8d321c9812c60b1b23a5103e408031bd856b78cd9c3bca192c7cc8dd8251e9f4

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

2.6MB
MD5

e1188dcf1d263848bbc3a9e0e000fa5d
SHA1

30ec0f03ff134f6835e5a1f9ac50d2f1f203f3b9
SHA256

143baeea153f94dec6b4ae148ce7f7db97b1aa8d034803a945e069143504263e
SHA512

021f52ab015eabe04443efe38d848760d971352a422c93ead6ca15566d377e015ff16decd45c62047eeaf76a13959956127d4763b59190d777e8d6249f3b6adf
SSDEEP

49152:cvm6WWeedeXKl+GlMfZDebimoMpgeAwXYjb/D652jYdJT0:4mVWVfl+GqZDBmoDU9bT

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 15 IoCs

Processes:

resource	yara_rule
behavioral13/memory/1868-219-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-220-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-221-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-224-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-225-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-227-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-228-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-230-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-231-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-233-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-234-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-236-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-237-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-239-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot
behavioral13/memory/1868-240-0x000000013F3C0000-0x000000013FA6B000-memory.dmp	family_cryptbot

Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

1.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1.exe
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

1.exe

pid process

1868 1.exe
1868 1.exe

pid	process
1868	1.exe
1868	1.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:1868

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PrBDveJ0ZUY\_Files\_Information.txt
Filesize
8KB

MD5
50ffe660d834465417f8c3b283c9b4fc

SHA1
ee3f800cc37bbbc13f93c2d456a0d2ce1abe3041

SHA256
441ff50d8e0d69c2b5271001bb308cee398c2adeef89f032ef12e86430ad231b

SHA512
25f2f0d150adba5bfb0fe47f3b1e74be73e2aa55e6a118c3f4467058657bf96e45e9dc54af6e8793ce0772253b432750118277695913fe619ecc6632ffab9cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\PrBDveJ0ZUY\_Files\_Screen_Desktop.jpeg
Filesize
41KB

MD5
5ea71c20623286d672c07b06252bf8b7

SHA1
ccbb52628c2fb94c688279dd34f4f05208190089

SHA256
5d234bbcd1905bd0c199d40a857bec7d4eedc294dd9e6d021eb3e8010cd18ba2

SHA512
d3c20cf19b8d7aeadc35134f4ac9a9f7d12028af0454628e92fe6410e4bde53ff88f36b96e9572d3a31cdac714d3bd14683a39c3691a229742ec5564ae528c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\PrBDveJ0ZUY\e8BDN6M3ZJv.zip
Filesize
34KB

MD5
e33df67d64baab71feb0a663a39a9cea

SHA1
b5737010d7493c91e41f956c768bc5867ef3ebc6

SHA256
1e217a87c6aa0890b7316a430f3ef8fb0cef3c384a9b60374825373fcc546cd6

SHA512
cddbf1ad27ab5aa2546abf41b3020881da83c6f9ceb3c1c93bbfa4c0f3abe14796ba199ad7cfd1880cf87749a9c949ba32e9279643cbdee4b88a8c743bab373f

Download Submit
C:\Users\Admin\AppData\Local\Temp\PrBDveJ0ZUY\files_\system_info.txt
Filesize
2KB

MD5
1f68e9b7539e2f582e199a6a78c23ba2

SHA1
c6ca74f1ce672a98f7a5a41cd412ca824d29d177

SHA256
701514601950e75e6a4cee86a31ef481e8defa0a1a436fcccc18480d0d362271

SHA512
bd96003e2a07673d251a8817f57a0544044b5a5e3bff1adceb6466c81d7620acc502e151b206f4cb62520e30afb8f3c0ef2655854c3cdfc8b8759a35f7e2525d

Download Submit
C:\Users\Admin\AppData\Local\Temp\PrBDveJ0ZUY\files_\system_info.txt
Filesize
3KB

MD5
bd76d135189d9dc061340db6818538b0

SHA1
61798b84febfb44c52f2c61b8d60c93238c7fe05

SHA256
3a66c194a897906e7341e35ef1454f511cc99bf4d394fa982f2e90ff24008120

SHA512
b407fc3e14dfe66d294babd3afacd51f9e31ed9771f4cee4a2d7f87560aef888a2a184d59967f4e0200e9b5e4cadbfd41ae1ecd842bca4d14478f9e0f453ca42

Download Submit
C:\Users\Admin\AppData\Local\Temp\PrBDveJ0ZUY\files_\system_info.txt
Filesize
5KB

MD5
817497bef9e9bcd51376971f94200059

SHA1
8a14c532945bc1688a35f267418985efadc856e2

SHA256
1175ba9ebd416acb39a7a1c44bac638f1a16e591268f52639eb2aad777bcc7ab

SHA512
da8b2ecb450a518092dd07f52b3e92429d5a449f17bb44d61b746bc6fff703f91e5157d3fdf8de7b0a226b4b94ed70405afed89488592a3ee875fb09684302a2

Download Submit
memory/1868-224-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-228-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-219-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-220-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-221-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-223-0x0000000077C60000-0x0000000077E09000-memory.dmp

Filesize
1.7MB

Download
memory/1868-0-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-225-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-227-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-2-0x0000000077C60000-0x0000000077E09000-memory.dmp

Filesize
1.7MB

Download
memory/1868-1-0x0000000077CB0000-0x0000000077CB2000-memory.dmp

Filesize
8KB

Download
memory/1868-230-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-231-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-233-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-234-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-236-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-237-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-239-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download
memory/1868-240-0x000000013F3C0000-0x000000013FA6B000-memory.dmp

Filesize
6.7MB

Download