Analysis
-
max time kernel
9s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
30-03-2021 07:15
Static task
static1
Behavioral task
behavioral1
Sample
fcf7a9f612586c76b3597985dc5e2b79.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
fcf7a9f612586c76b3597985dc5e2b79.exe
-
Size
637KB
-
MD5
fcf7a9f612586c76b3597985dc5e2b79
-
SHA1
4a75e27a1ed940a6f27f5f2bf316f7ebf95b0858
-
SHA256
126f515316ff7d1be06266adcbbd565f18437b293b690765dcf55f500cb048e0
-
SHA512
4b6d124d27599559f84eb340d3cd7cb577bb9ed6c86306d03c26e3c9a61f5a5a1d9b4e849305ab40cb2f79e3d23215c3081262c68bde4d028abed1bbe44719cb
Malware Config
Extracted
Family
cryptbot
C2
bavyf72.top
moriol07.top
Attributes
-
payload_url
http://akshj10.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1616-4-0x0000000000910000-0x00000000009EF000-memory.dmp family_cryptbot behavioral1/memory/1616-5-0x0000000000400000-0x00000000004E3000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fcf7a9f612586c76b3597985dc5e2b79.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fcf7a9f612586c76b3597985dc5e2b79.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fcf7a9f612586c76b3597985dc5e2b79.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1616-3-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB
-
memory/1616-2-0x0000000002190000-0x00000000021A1000-memory.dmpFilesize
68KB
-
memory/1616-4-0x0000000000910000-0x00000000009EF000-memory.dmpFilesize
892KB
-
memory/1616-5-0x0000000000400000-0x00000000004E3000-memory.dmpFilesize
908KB