cryptbot | 74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d

Analysis

max time kernel
144s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe
Size

4.5MB
MD5

17caf50a89e0ca1e1e3e85cf7b14c509
SHA1

b4703fe095593e0978964c64db00cc142a0c672b
SHA256

74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d
SHA512

6acc0627291e232e89e5f2b8db73550e134d8cf7c217c4ab55fee1293f9c01537f9d8e13b05c0fa6e6e4143e7de35bdda754b6706ee6cf0be655be9392bd119e
SSDEEP

98304:z27lsFWcG7V95lWEw58NQM8mxozibMW+kt1bPaf1FA1kOf2fBPxO41EEqCI4:zSjvV95oEGoQM8mezibMmdatTO61EEqC

Score

10^/10

cryptbot discovery evasion spyware stealer

Malware Config

Extracted

Family

cryptbot

verf04.info

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

setup.exepatch.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ patch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	patch.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

patch.exesetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	patch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	patch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe

Executes dropped EXE 3 IoCs

Processes:

setup.exeNotepad2.exepatch.exe

pid process

2944 setup.exe
3440 Notepad2.exe
2132 patch.exe

pid	process
2944	setup.exe
3440	Notepad2.exe
2132	patch.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

patch.exesetup.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Wine	patch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Wine	setup.exe

Loads dropped DLL 2 IoCs

Processes:

74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe

pid process

2532 74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe
2532 74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

setup.exepatch.exe

pid process

2944 setup.exe
2132 patch.exe

pid	process
2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe
2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe

flow	ioc
3	ip-api.com

pid	process
2944	setup.exe
2132	patch.exe

Drops file in Program Files directory 4 IoCs

Processes:

74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe

description	ioc	process
File created	C:\Program Files (x86)\Inner\win\bin\Two.vbs	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe
File created	C:\Program Files (x86)\Inner\win\bin\setup.exe	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe
File created	C:\Program Files (x86)\Inner\win\bin\patch.exe	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe
File created	C:\Program Files (x86)\Inner\win\bin\Notepad2.exe	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

setup.exepatch.exe

pid process

2944 setup.exe
2944 setup.exe
2132 patch.exe
2132 patch.exe
Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

setup.exe

pid process

2944 setup.exe
2944 setup.exe
2944 setup.exe
2944 setup.exe
2944 setup.exe
2944 setup.exe
2944 setup.exe
2944 setup.exe
2944 setup.exe
2944 setup.exe
2944 setup.exe
2944 setup.exe

pid	process
2944	setup.exe
2944	setup.exe
2132	patch.exe
2132	patch.exe

pid	process
2944	setup.exe
2944	setup.exe
2944	setup.exe
2944	setup.exe
2944	setup.exe
2944	setup.exe
2944	setup.exe
2944	setup.exe
2944	setup.exe
2944	setup.exe
2944	setup.exe
2944	setup.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe

description	pid	process	target process
PID 2532 wrote to memory of 2944	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	setup.exe
PID 2532 wrote to memory of 2944	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	setup.exe
PID 2532 wrote to memory of 2944	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	setup.exe
PID 2532 wrote to memory of 4604	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	CScript.exe
PID 2532 wrote to memory of 4604	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	CScript.exe
PID 2532 wrote to memory of 4604	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	CScript.exe
PID 2532 wrote to memory of 3440	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	Notepad2.exe
PID 2532 wrote to memory of 3440	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	Notepad2.exe
PID 2532 wrote to memory of 3440	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	Notepad2.exe
PID 2532 wrote to memory of 2132	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	patch.exe
PID 2532 wrote to memory of 2132	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	patch.exe
PID 2532 wrote to memory of 2132	2532	74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe	patch.exe

C:\Users\Admin\AppData\Local\Temp\74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe
"C:\Users\Admin\AppData\Local\Temp\74723b8f53fca55f5e0b5755465a69d78960131ec9dd49445b8bde4354d0c94d.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2532

C:\Program Files (x86)\Inner\win\bin\setup.exe
"C:\Program Files (x86)\Inner\win\bin\setup.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2944

C:\Windows\SysWOW64\CScript.exe
"C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\Inner\win\bin\Two.vbs" //e:vbscript //B //NOLOGO
2⤵
PID:4604

C:\Program Files (x86)\Inner\win\bin\Notepad2.exe
"C:\Program Files (x86)\Inner\win\bin\Notepad2.exe"
2⤵
- Executes dropped EXE
PID:3440

C:\Program Files (x86)\Inner\win\bin\patch.exe
"C:\Program Files (x86)\Inner\win\bin\patch.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2132

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Inner\win\bin\Notepad2.exe
Filesize
693KB

MD5
b60d390ba42c0109ee38de2e0ca56e1a

SHA1
735a4eb61fe695c9bd2c9961f5fa41ac5a73d833

SHA256
9ac61841c5a9716c04d632f9d107a17e94af751573a50b9d2c1d5ce26e32b477

SHA512
97d17a96a5773f2c8c78a1b985e75314c0ad8a5d9188b6e3d327b1445c04b15b99bd1697b8b12e4f3e56d040e5570f9e7b938e4d67cacca03a947093a082dc24

Download Submit
C:\Program Files (x86)\Inner\win\bin\Two.vbs
Filesize
120B

MD5
dce4476454d12f8906cfa1db72722e2d

SHA1
4437a74ae0fcf7a4a636c04b7c0b80880871816a

SHA256
53908a91a2c298fcfd2cd278d4e273ecd55a3b5c81f10775307352aca5e211e8

SHA512
5a13b419813e768be03069332d3f655609221391b7faab5ed8c90ea57a7a26861ed0b5a256619ce9b8e62579e9e3ef9b0e8a37d6a688cb3795c62ea8cd55786f

Download Submit
C:\Program Files (x86)\Inner\win\bin\patch.exe
Filesize
2.1MB

MD5
5da43c1e12289a6ee23c690404359d32

SHA1
d20ddb31c9c1c7c9bfd2c77890fb13608aac2c42

SHA256
554d5c274a401ab86387b8feadaa30f95b9bfa5873434b7592a96b932aebc025

SHA512
4a51da8e684688ce08a9bfc9ce1107ce30865fb171770269402bfa07df35a4db3eb79a8e54892855f1867f995691b5d52591971b8befb5870b9aa22945a40763

Download Submit
C:\Program Files (x86)\Inner\win\bin\setup.exe
Filesize
2.1MB

MD5
3657f6fadee899005c6556c07a890bba

SHA1
bb532f5420c5baacb7b19f508ec29440135c3c74

SHA256
0ab71f45b1e9c6f5eba7ce76b31285a18e7a2851870e551b6aa3dbd8cd756aae

SHA512
3158f42fc30ee5425a252dd976c0d3634b1df124cf364c5790071677e33082343be4f117f05c8cc725cfd566f87229c4d2fdd235849b1b34b13d9a7285324068

Download Submit
C:\ProgramData\LWaceld0a2rI\8NhvjinpTKFga.zip
Filesize
47KB

MD5
bf362bcb5f587130e977697732cfe39d

SHA1
29afdca2ef04ab1b3a171378ba1cbd7b541bac44

SHA256
a0414a354c282c73c59dde94bdcc7bcdcc0a21210a7a5e898512537012d53812

SHA512
e4a1fba902f6e1262c2c36586b0b647cbd2546b26fa89decced47e39439d77e426067e6c3c420c5ff30d5a811eb600e48f5cd86de858055083fc767f08fc59e5

Download Submit
C:\ProgramData\LWaceld0a2rI\Files\Browsers\_FilePasswords.txt
Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
C:\ProgramData\LWaceld0a2rI\Files\_Info.txt
Filesize
2KB

MD5
57ddf7592078adf8490045ba3be47c4d

SHA1
e003992508adb858688419fc7cd619e898279056

SHA256
444f3e5110c4a069f43caf0b31bc94a185ee1b2289f25c5469fafc0ed4a35683

SHA512
b4cf10cecc7090b055309de5f2297d6e35e0f2970fb3afb43ca2e34a8dedefb2eff13fcbd0d729e831ca5ee9e280481ed353232a999d08c2d3830c6130824594

Download Submit
C:\ProgramData\LWaceld0a2rI\Files\_Info.txt
Filesize
7KB

MD5
193d33b7349da753726df5185d658918

SHA1
cbea0d9faaf5eac7f05c4acb7df765c1e434b827

SHA256
3528db5f49a7ab72020f4656e7ad528819bb5f33c93d023049340f8dbb00260b

SHA512
47d159cd9f2b9627f57090966e7f0acb10e61a478cf1c612f5eea583ac1ba23d1d2591efa3839deed5d8e402ebe1ab8108e0415ec95c5b76332f8ac59d8f52e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5322.tmp\UAC.dll
Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp5322.tmp\nsExec.dll
Filesize
6KB

MD5
132e6153717a7f9710dcea4536f364cd

SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

Download Submit
memory/2132-314-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-308-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-301-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-306-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-298-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-296-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-293-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-303-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-311-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-153-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-317-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-320-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-290-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2132-287-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/2944-285-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-34-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-286-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-272-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-288-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-271-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-291-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-292-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-147-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-294-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-146-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-297-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-143-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-138-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-300-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-284-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-302-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-21-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/2944-305-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-22-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/2944-307-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-23-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/2944-310-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-24-0x0000000000B31000-0x0000000000B93000-memory.dmp

Filesize
392KB

Download
memory/2944-312-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-20-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/2944-316-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-19-0x0000000077D04000-0x0000000077D06000-memory.dmp

Filesize
8KB

Download
memory/2944-319-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download
memory/2944-17-0x0000000000B30000-0x0000000001050000-memory.dmp

Filesize
5.1MB

Download