Analysis
- max time kernel
9s - max time network
14s - platform
windows7_x64 - resource
win7v20201028 - submitted
30/03/2021, 07:15
General
- Target fcf7a9f612586c76b3597985dc5e2b79.exe
- Size 637KB
- Sample210330-3ctml3n9da
- SHA256 126f515316ff7d1be06266adcbbd565f18437b293b690765dcf55f500cb048e0
Score
10/10
Malware Config
Extracted
Family
-
cryptbot
C2
-
bavyf72.top
-
moriol07.top
Attributes
-
payload_url
http://akshj10.top/download.php?file=lv.exe
Signatures
- CryptBot
A C++ stealer distributed widely in bundle with other software.
- CryptBot Payload 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcf7a9f612586c76b3597985dc5e2b79.exe"C:\Users\Admin\AppData\Local\Temp\fcf7a9f612586c76b3597985dc5e2b79.exe"1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1616-3-0x00000000765A1000-0x00000000765A3000-memory.dmp
memory/1616-2-0x0000000002190000-0x00000000021A1000-memory.dmp
memory/1616-4-0x0000000000910000-0x00000000009EF000-memory.dmp
memory/1616-5-0x0000000000400000-0x00000000004E3000-memory.dmp