Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18-05-2021 18:02
Static task
static1
Behavioral task
behavioral1
Sample
f9277410c46704c1c46134a3f4691a55.exe
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
f9277410c46704c1c46134a3f4691a55.exe
-
Size
741KB
-
MD5
f9277410c46704c1c46134a3f4691a55
-
SHA1
217b264811ed1ddacdc9dcca740079a1f0d756ed
-
SHA256
a82a557b2a309c745176c22353dd0d12124864765acad2d62ac655d5aeb5d8ea
-
SHA512
074388235eacd7e8fbb06a37c5a9880d79c0e1111217596293dd37d188e98ae7a1e25e5bac00becfe543d1b44c776b956a5daf48d922a0d756c17526331d545b
Malware Config
Extracted
Family
cryptbot
C2
sogwgy12.top
morkcx01.top
Attributes
-
payload_url
http://dousaj01.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1040-61-0x00000000004F0000-0x00000000005D1000-memory.dmp family_cryptbot behavioral1/memory/1040-62-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
f9277410c46704c1c46134a3f4691a55.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f9277410c46704c1c46134a3f4691a55.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f9277410c46704c1c46134a3f4691a55.exe