Analysis
-
max time kernel
7s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
25-03-2021 10:03
Static task
static1
Behavioral task
behavioral1
Sample
6c219118acdf6e43d54298e2a7c268c0877a4f31c207cd29d2e038a858cea9fe.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
6c219118acdf6e43d54298e2a7c268c0877a4f31c207cd29d2e038a858cea9fe.exe
-
Size
627KB
-
MD5
8d61c500dd76f3ed117ddc54f0025d86
-
SHA1
abf5a37bc8963d5e369e18b175f5298829ec745f
-
SHA256
6c219118acdf6e43d54298e2a7c268c0877a4f31c207cd29d2e038a858cea9fe
-
SHA512
c521151f2ba2089ab1a9097d69e5bb7553f07e3a218c7f4cc09efcd5dc7b1cf081d41fa16e1d959003e668b32b8865fd5df230a5933351dc7502a94bdbe78657
Malware Config
Extracted
Family
cryptbot
C2
baqsw42.top
morryv04.top
Attributes
-
payload_url
http://aktyd05.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2008-4-0x00000000002E0000-0x00000000003BF000-memory.dmp family_cryptbot behavioral1/memory/2008-5-0x0000000000400000-0x00000000004E3000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
6c219118acdf6e43d54298e2a7c268c0877a4f31c207cd29d2e038a858cea9fe.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6c219118acdf6e43d54298e2a7c268c0877a4f31c207cd29d2e038a858cea9fe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6c219118acdf6e43d54298e2a7c268c0877a4f31c207cd29d2e038a858cea9fe.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2008-2-0x00000000023B0000-0x00000000023C1000-memory.dmpFilesize
68KB
-
memory/2008-3-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/2008-4-0x00000000002E0000-0x00000000003BF000-memory.dmpFilesize
892KB
-
memory/2008-5-0x0000000000400000-0x00000000004E3000-memory.dmpFilesize
908KB