Analysis
- max time kernel
9s - max time network
12s - platform
windows7_x64 - resource
win7v20210408 - submitted
04/05/2021, 00:02
General
- Target 5eadc3d4c02b8b1ea765adca519d9031.exe
- Size 742KB
- Sample210504-rmtelnxlsx
- SHA256 a74f7f37ceedc57d0b8024d1e92efd40b023f8fce090dc80853f9ba88f61e7bb
Score
10/10
Malware Config
Extracted
Family
-
cryptbot
C2
-
jusvyg72.top
-
morioa07.top
Signatures
- CryptBot
A C++ stealer distributed widely in bundle with other software.
- CryptBot Payload 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eadc3d4c02b8b1ea765adca519d9031.exe"C:\Users\Admin\AppData\Local\Temp\5eadc3d4c02b8b1ea765adca519d9031.exe"1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2004-60-0x0000000075B31000-0x0000000075B33000-memory.dmp
memory/2004-61-0x00000000008C0000-0x000000000099F000-memory.dmp
memory/2004-62-0x0000000000400000-0x00000000008B2000-memory.dmp