Analysis
-
max time kernel
7s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 18:56
Static task
static1
Behavioral task
behavioral1
Sample
2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe
-
Size
731KB
-
MD5
105f97e06f45250a6448035b94f2ef2b
-
SHA1
3819346f3b8c05add77c89205a58533dabbc7249
-
SHA256
2051799f92fd036d6e1c8a9c06a4aea85a9509214cd0623c0df2fe62bd99986b
-
SHA512
9a57ebc3835d2abedb966a501bfb7c2d15769a8f3a95320c00dc91e892710d182fffd4f1971dda989c5129da493cb64ce329cb9b8a2aa1177167ecadd07cc3d7
Malware Config
Extracted
Family
cryptbot
C2
remdny42.top
morpgr04.top
Attributes
-
payload_url
http://sulnom06.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1200-60-0x0000000001D30000-0x0000000001E11000-memory.dmp family_cryptbot behavioral1/memory/1200-61-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2051799f92fd036d6e1c8a9c06a4aea85a9509214cd06.exe