Analysis
-
max time kernel
10s -
max time network
35s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-05-2021 09:36
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetect.malware1.14936.10307.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.W32.AIDetect.malware1.14936.10307.exe
-
Size
731KB
-
MD5
7a2f5bc93c259322c16e5a94f7139031
-
SHA1
d7d2408cfdc8860a52546dff71ffdbec835102d8
-
SHA256
e5dae08e748e408a4a256bd0c5d216281596a20399ea0127ac35b1661248b3ea
-
SHA512
437d1b11209d5382748ab51404b610865401309708ab7e174bef21cb984f5bad8e8ef0fb4841b58dc154abc956e3ecaf81e02a0b0d22c4abf308b7d4414e9d26
Malware Config
Extracted
Family
cryptbot
C2
geowqr42.top
morckp04.top
Attributes
-
payload_url
http://rogaow06.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-60-0x00000000004F0000-0x00000000005D1000-memory.dmp family_cryptbot behavioral1/memory/1972-61-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.W32.AIDetect.malware1.14936.10307.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SecuriteInfo.com.W32.AIDetect.malware1.14936.10307.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SecuriteInfo.com.W32.AIDetect.malware1.14936.10307.exe