Analysis
-
max time kernel
10s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-05-2021 19:06
Static task
static1
Behavioral task
behavioral1
Sample
a824c2611e6bb72739416b280250e64a.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
a824c2611e6bb72739416b280250e64a.exe
-
Size
726KB
-
MD5
a824c2611e6bb72739416b280250e64a
-
SHA1
3d38ca2310ddacfcff89cf56f73df8270ee21074
-
SHA256
17cb52ffccb7fb8d9480f921392f29d520ec9a7c963a7ff8791328ba7638d22f
-
SHA512
d5fa40400af85aac0d86ee8653e7b9f43b4a5a5b4aa53b1ebbcaad0b68af285abaeb96db6313ef190464a9a03392099ff778e26a17a8927bcacb6cedeb9236d8
Malware Config
Extracted
Family
cryptbot
C2
geofrz52.top
morvmz05.top
Attributes
-
payload_url
http://rogkpf07.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1944-60-0x0000000000560000-0x0000000000641000-memory.dmp family_cryptbot behavioral1/memory/1944-61-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
a824c2611e6bb72739416b280250e64a.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a824c2611e6bb72739416b280250e64a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a824c2611e6bb72739416b280250e64a.exe