Play interactive tour

Edit tour

Windows Analysis Report file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	501609
MD5:	6738381ddd3d2952312af2a0f2be5157
SHA1:	40fa53df583e9b598bb2d7be716958b1f5bad0dc
SHA256:	84f4e2b346b6f5473e2c564a6f60985c5d20f621e70a982e9aafd21354ccc66f
Infos:
Most interesting Screenshot:

Detection

Cryptbot Glupteba

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Cryptbot

Detected unpacking (overwrites its own PE header)

Yara detected Glupteba

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Machine Learning detection for sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

PE file contains strange resources

Contains functionality to read the PEB

Contains functionality to download and launch executables

Contains capabilities to detect virtual machines

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 5940 cmdline: 'C:\Users\user\Desktop\file.exe' MD5: 6738381DDD3D2952312AF2A0F2BE5157)

cleanup

Malware Configuration

Threatname: Cryptbot

{"Download URL": "http://bojwfi01.top/download.php?file=lv.exe", "C2 list": ["moresh01.top/index.php", "cemnit12.top/index.php"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.666994856.0000000003360000.00000004.00000001.sdmp	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
00000000.00000002.929802806.0000000001840000.00000040.00000001.sdmp	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
00000000.00000002.929594713.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Process Memory Space: file.exe PID: 5940	JoeSecurity_Glupteba_1	Yara detected Glupteba	Joe Security
Process Memory Space: file.exe PID: 5940	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.400000.0.unpack	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
0.2.file.exe.400000.0.raw.unpack	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
0.2.file.exe.1840e50.1.unpack	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
0.3.file.exe.3360000.0.unpack	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
0.2.file.exe.1840e50.1.raw.unpack	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
0.3.file.exe.3360000.0.raw.unpack	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.file.exe.1840e50.1.raw.unpack

Malware Configuration Extractor: Cryptbot {"Download URL": "http://bojwfi01.top/download.php?file=lv.exe", "C2 list": ["moresh01.top/index.php", "cemnit12.top/index.php"]}

Multi AV Scanner detection for submitted file

Show sources

Source: file.exe

ReversingLabs: Detection: 60%

Antivirus detection for URL or domain

Show sources

Source: http://bojwfi01.top/download.php?file=lv.exe	Avira URL Cloud: Label: malware
Source: moresh01.top/index.php	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Show sources

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401220 GetFileAttributesW,CreateFileW,GetFileSizeEx,CloseHandle,CreateFileMappingW,MapViewOfFile,CloseHandle,CloseHandle,CryptUnprotectData,LocalFree,UnmapViewOfFile,CloseHandle,FindCloseChangeNotification,CloseHandle,

0_2_00401220

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack

Source: file.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: C:\pubezepimog\teyakucarurab_vijuwatizuxi_33.pdb0E source: file.exe
Source:	Binary string: C:\pubezepimog\teyakucarurab_vijuwatizuxi_33.pdb source: file.exe

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402680 Sleep,FindFirstFileW,FindNextFileW,FindClose,		0_2_00402680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042ABC1 FindFirstFileExW,		0_2_0042ABC1

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM\_Files	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: moresh01.top/index.php
Source: Malware configuration extractor	URLs: cemnit12.top/index.php

Source: unknown

DNS traffic detected: query: cemnit12.top replaycode: Server failure (2)

Source: file.exe, file.exe, 00000000.00000003.666994856.0000000003360000.00000004.00000001.sdmp	String found in binary or memory: http://bojwfi01.top/download.php?file=lv.exe
Source: file.exe, 00000000.00000002.930560853.0000000003F08000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/in-k
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.php
Source: file.exe, 00000000.00000002.929983814.0000000001A43000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.php#
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.php#An
Source: file.exe, 00000000.00000002.929983814.0000000001A43000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.php&
Source: file.exe, 00000000.00000002.929983814.0000000001A43000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.php0
Source: file.exe, 00000000.00000002.929983814.0000000001A43000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.php7
Source: file.exe, 00000000.00000002.929909251.00000000019FC000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.php?J
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpB
Source: file.exe, 00000000.00000002.929983814.0000000001A43000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpF
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpFB
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpMB
Source: file.exe, 00000000.00000002.929983814.0000000001A43000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpP
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpPB
Source: file.exe, 00000000.00000002.930535454.0000000003ED8000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpQ
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpWB
Source: file.exe, 00000000.00000002.930014729.0000000001A7C000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpX
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpZB
Source: file.exe, 00000000.00000002.930014729.0000000001A7C000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpb
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpe
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpeB
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phphB
Source: file.exe, 00000000.00000002.929909251.00000000019FC000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpl
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpoB
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phprB
Source: file.exe, 00000000.00000002.930031253.0000000001A88000.00000004.00000001.sdmp	String found in binary or memory: http://cemnit12.top/index.phpyB
Source: file.exe, 00000000.00000003.670329414.0000000001A36000.00000004.00000001.sdmp, default_webdata.db.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.670329414.0000000001A36000.00000004.00000001.sdmp, default_webdata.db.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.670329414.0000000001A36000.00000004.00000001.sdmp, default_webdata.db.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.670329414.0000000001A36000.00000004.00000001.sdmp, default_webdata.db.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.670329414.0000000001A36000.00000004.00000001.sdmp, default_webdata.db.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.670329414.0000000001A36000.00000004.00000001.sdmp, default_webdata.db.0.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: file.exe, 00000000.00000003.670329414.0000000001A36000.00000004.00000001.sdmp, default_webdata.db.0.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.670329414.0000000001A36000.00000004.00000001.sdmp, default_webdata.db.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: cemnit12.top

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040DB70 CreateFileW,CreateDirectoryW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,GetModuleFileNameW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,ExpandEnvironmentStringsW,GetFileAttributesW,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoW,LocalFree,_strftime,_strftime,GetUserNameW,GetComputerNameW,RegOpenKeyExW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CopyFileW,CreateDirectoryW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,Sleep,Sleep,Sleep,Sleep,Sleep,ExpandEnvironmentStringsW,DeleteFileW,Sleep,URLDownloadToFileW,Sleep,CreateFileW,CloseHandle,ShellExecuteW,

0_2_0040DB70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040AD20 RegQueryValueExW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,GetDesktopWindow,GetWindowRect,GetWindowDC,GetDeviceCaps,CreateCompatibleDC,CreateDIBSection,DeleteDC,DeleteDC,DeleteDC,GdiplusShutdown,SaveDC,SelectObject,BitBlt,RestoreDC,DeleteDC,DeleteDC,DeleteDC,GdipAlloc,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdiplusShutdown,CopyFileW,

0_2_0040AD20

Source: file.exe, 00000000.00000002.929870758.00000000019C8000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: file.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414000	0_2_00414000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041B72F	0_2_0041B72F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004138F0	0_2_004138F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043030F	0_2_0043030F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004223F0	0_2_004223F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00420429	0_2_00420429
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043042F	0_2_0043042F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041B4FD	0_2_0041B4FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00413580	0_2_00413580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004327BD	0_2_004327BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00433800	0_2_00433800
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041B994	0_2_0041B994
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00411A10	0_2_00411A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042DAF1	0_2_0042DAF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410E50	0_2_00410E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044EA80	0_2_0044EA80

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040F2F0 appears 57 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00416C70 appears 50 times

Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: file.exe

ReversingLabs: Detection: 60%

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\andian

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\htRscv

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/13@73/0

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \_Files	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \_Files\_Files	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \_Files\_Wallet	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \_Files\_Chrome	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \_Files\_Opera	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \_Files\_Brave	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \files_	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \files_\files	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \files_\_Chrome	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \files_\_Opera	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: \files_\_Brave	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: %Temp%\	0_2_00415BF0
Source: C:\Users\user\Desktop\file.exe	Command line argument: >.C	0_2_00432D90

Source: C:\Users\user\Desktop\file.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\pubezepimog\teyakucarurab_vijuwatizuxi_33.pdb0E source: file.exe
Source:	Binary string: C:\pubezepimog\teyakucarurab_vijuwatizuxi_33.pdb source: file.exe

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043668D push esi; ret	0_2_00436696
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408A6A push 48680000h; ret	0_2_00408A77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00416CB6 push ecx; ret	0_2_00416CC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_019DB1DD pushad ; iretd	0_2_019DB1DE

Source: initial sample

Static PE information: section name: .text entropy: 7.34053606656

Source: C:\Users\user\Desktop\file.exe

0_2_0040DB70

Source: C:\Users\user\Desktop\file.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Registry key enumerated: More than 174 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\file.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A6E3 GetFileAttributesW,GetFileAttributesW,GetSystemInfo,KiUserCallbackDispatcher,GlobalMemoryStatusEx,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,

0_2_0040A6E3

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402680 Sleep,FindFirstFileW,FindNextFileW,FindClose,		0_2_00402680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042ABC1 FindFirstFileExW,		0_2_0042ABC1

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM\_Files	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: file.exe, 00000000.00000002.929983814.0000000001A43000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllbn;G

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041D1DD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041D1DD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0042C070 GetProcessHeap,

0_2_0042C070

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004230B1 mov eax, dword ptr fs:[00000030h]		0_2_004230B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042A824 mov eax, dword ptr fs:[00000030h]		0_2_0042A824

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041D1DD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041D1DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00416A61 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00416A61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00416BF7 SetUnhandledExceptionFilter,	0_2_00416BF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00416E3D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00416E3D

Source: file.exe, 00000000.00000002.930113974.0000000001F50000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.930113974.0000000001F50000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: file.exe, 00000000.00000002.930113974.0000000001F50000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: file.exe, 00000000.00000002.930113974.0000000001F50000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM\_Files\_Chrome\default_cookies.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM\_Files\_Chrome\default_key.bin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM\_Files\_Chrome\default_logins.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM\_Files\_Chrome\default_webdata.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM\_Files\_Information.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\sqBlhapfmZnM\_Files\_Screen_Desktop.jpeg VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: CreateFileW,CreateDirectoryW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,GetModuleFileNameW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,ExpandEnvironmentStringsW,GetFileAttributesW,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoW,LocalFree,_strftime,_strftime,GetUserNameW,GetComputerNameW,RegOpenKeyExW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CopyFileW,CreateDirectoryW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,Sleep,Sleep,Sleep,Sleep,Sleep,ExpandEnvironmentStringsW,DeleteFileW,Sleep,URLDownloadToFileW,Sleep,CreateFileW,CloseHandle,ShellExecuteW,

0_2_0040DB70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00416891 cpuid

0_2_00416891

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00413A40 SetFilePointer,SetFilePointer,SetFilePointer,GetLocalTime,SystemTimeToFileTime,FileTimeToSystemTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_00413A40

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00429D74 _free,_free,_free,GetTimeZoneInformation,_free,

0_2_00429D74

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040AA30 GetFileAttributesW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,RegCloseKey,RegOpenKeyExW,RegCloseKey,GetUserNameW,ExpandEnvironmentStringsW,CreateDirectoryW,Sleep,

0_2_0040AA30

Stealing of Sensitive Information:

Yara detected Cryptbot

Show sources

Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.1840e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.3360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.1840e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.3360000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.666994856.0000000003360000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.929802806.0000000001840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.929594713.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5940, type: MEMORYSTR

Yara detected Glupteba

Show sources

Source: Yara match

File source: Process Memory Space: file.exe PID: 5940, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: file.exe	String found in binary or memory: %AppData%\Electrum-btcp\wallets
Source: file.exe	String found in binary or memory: %AppData%\ElectronCash\wallets
Source: file.exe	String found in binary or memory: %AppData%\Jaxx\Local Storage
Source: file.exe	String found in binary or memory: %AppData%\Exodus\backup
Source: file.exe	String found in binary or memory: %AppData%\Exodus\backup

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Remote Access Functionality:

Yara detected Cryptbot

Show sources

Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.1840e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.3360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.1840e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.3360000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.666994856.0000000003360000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.929802806.0000000001840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.929594713.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5940, type: MEMORYSTR

Yara detected Glupteba

Show sources

Source: Yara match

File source: Process Memory Space: file.exe PID: 5940, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Process Injection1	Deobfuscate/Decode Files or Information1	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information3	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing21	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Screen Capture1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading1	NTDS	System Information Discovery53	Distributed Component Object Model	Input Capture1	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection1	Cached Domain Credentials	Security Software Discovery31	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Virtualization/Sandbox Evasion1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Process Discovery11	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Cryptbot

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails