File name:

LB8E6_file.exe

Full analysis: https://app.any.run/tasks/bdf10080-18d4-4629-af5b-5deb1126d34b
Verdict: Malicious activity
Threats:

CryptBot is an advanced Windows-targeting infostealer delivered via pirate sites with "cracked" software. It has been first observed in the wild in 2019.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 23:52:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
cryptbot
stealer
themida
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 7 sections
MD5:

B28F93F8C2A3273B693A5882E208F759

SHA1:

780D4F085C6A5610DB6B6BD390CD869D94CFEBC6

SHA256:

16C5D392245ACA444CAF9EEF1F862B11AB5613738B76DFAF26A6D724500EA825

SSDEEP:

98304:jPJtfdcSEq0ukQUG9jq8wM0ps28/La9Adn+Vd6+Qd4pLTETrahBrahlmMZs88BTo:7N8sLx7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • CRYPTBOT mutex has been found

      • LB8E6_file.exe (PID: 7576)
      • LB8E6_file.exe (PID: 4120)

  • SUSPICIOUS

    • Reads the BIOS version

      • LB8E6_file.exe (PID: 7576)
      • LB8E6_file.exe (PID: 4120)

    • Searches for installed software

      • LB8E6_file.exe (PID: 7576)
      • LB8E6_file.exe (PID: 4120)

    • Executes application which crashes

      • LB8E6_file.exe (PID: 7576)
      • LB8E6_file.exe (PID: 4120)

    • There is functionality for VM detection VirtualBox (YARA)

      • LB8E6_file.exe (PID: 7576)
      • LB8E6_file.exe (PID: 4120)

  • INFO

    • Checks supported languages

      • LB8E6_file.exe (PID: 7576)
      • LB8E6_file.exe (PID: 4120)

    • Reads the machine GUID from the registry

      • LB8E6_file.exe (PID: 7576)
      • LB8E6_file.exe (PID: 4120)

    • Reads the computer name

      • LB8E6_file.exe (PID: 7576)
      • LB8E6_file.exe (PID: 4120)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 4488)
      • WerFault.exe (PID: 7828)

    • Themida protector has been detected

      • LB8E6_file.exe (PID: 7576)
      • LB8E6_file.exe (PID: 4120)

    • Manual execution by a user

      • mspaint.exe (PID: 3100)
      • LB8E6_file.exe (PID: 4120)

    • Checks proxy server information

      • slui.exe (PID: 5072)

    • Reads the software policy settings

      • slui.exe (PID: 5072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:29 04:56:05+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.4
CodeSize: 5196288
InitializedDataSize: 7919616
UninitializedDataSize: 12800
EntryPoint: 0xcb2000
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #CRYPTBOT lb8e6_file.exe werfault.exe no specs slui.exe mspaint.exe no specs #CRYPTBOT lb8e6_file.exe rundll32.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3100"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\redfield.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4120"C:\Users\admin\Desktop\LB8E6_file.exe" C:\Users\admin\Desktop\LB8E6_file.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\lb8e6_file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4488C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7576 -s 1140C:\Windows\SysWOW64\WerFault.exe—LB8E6_file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5072C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5156C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7576"C:\Users\admin\Desktop\LB8E6_file.exe" C:\Users\admin\Desktop\LB8E6_file.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\lb8e6_file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7828C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4120 -s 1116C:\Windows\SysWOW64\WerFault.exe—LB8E6_file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
5 872
Read events
5 843
Write events
28
Delete events
1

Modification events

(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:WindowPlacement
Value:
2C00000000000000010000000000000000000000FFFFFFFFFFFFFFFF7F000000470000007F04000087020000
(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowThumbnail
Value:
0
(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPWidth
Value:
0
(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPHeight
Value:
0
(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbXPos
Value:
0
(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbYPos
Value:
0
(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbWidth
Value:
0
(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbHeight
Value:
0
(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:UnitSetting
Value:
0
(PID) Process:(3100) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowRulers
Value:
0
Executable files
0
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4488WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LB8E6_file.exe_978afbd942932499e4995b3dc296c4fb19a52bf_bf822a69_e80250b4-00bd-45a8-a8bb-137cdec8f91a\Report.wer —
MD5:—
SHA256:—
4488WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\LB8E6_file.exe.7576.dmp —
MD5:—
SHA256:—
7828WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LB8E6_file.exe_978afbd942932499e4995b3dc296c4fb19a52bf_bf822a69_35768cd1-ce80-4748-b269-f6723845edb4\Report.wer —
MD5:—
SHA256:—
7828WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\LB8E6_file.exe.4120.dmp —
MD5:—
SHA256:—
4488WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERB341.tmp.WERInternalMetadata.xmlbinary
MD5:95D097A9B2A356BFE5ABBF3279691C21
SHA256:48EC57512664074F86D65B022B7198A3F28682C091AC50DBD1C49045381DD5F7
4488WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERB1F7.tmp.dmpbinary
MD5:9EEEE923A97142B8FCBA6B8B6D6154A0
SHA256:8EF52921F74A9A15907800FD7A42864218D19A18513E88ADF15D72AAACB88D92
4488WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERB380.tmp.xmlxml
MD5:7331686EB1861E2A5EA3BEEAFCB74E91
SHA256:FD292E58AD3A4F638DA952576F6B98CD3608F01402320793828BA37D8B37FC21
7828WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5623.tmp.WERInternalMetadata.xmlbinary
MD5:1404182C3761F26C39C4DFCBA71B83D1
SHA256:01C2BF0E9AF855B42674BC440730C154DDDC6F616EE669791C8024939B41FDC2
7828WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5662.tmp.xmlxml
MD5:460402CDB078AEC1EBAB25EDDC55AB8E
SHA256:E89F1433FD4BF6C7CCD153C8D6923A966C846CB3B9043874EABCB6C77F37B30F
7828WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5586.tmp.dmpbinary
MD5:9DACD7D0667455AD35E05A491F3DFD0C
SHA256:C687E2B0928F1747A27C8DDE6BEF2A01D8810D52407A9BD673760F07841C954D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
46
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8044
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8044
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7576
LB8E6_file.exe
54.209.139.57:443
httpbin.org
AMAZON-AES
US
unknown
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
httpbin.org
  • 54.209.139.57
  • 54.236.92.255
  • 52.7.80.244
  • 18.211.192.27
unknown
home.twentykx20pt.top
  • —
malicious
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7576
LB8E6_file.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
7576
LB8E6_file.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
4120
LB8E6_file.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
4120
LB8E6_file.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LB8E6_file.exe