Analysis
-
max time kernel
9s -
max time network
47s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
31-05-2021 06:41
Static task
static1
Behavioral task
behavioral1
Sample
7893541b010d78ca63a1f443f01f7f4100f1782eabfa4.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
7893541b010d78ca63a1f443f01f7f4100f1782eabfa4.exe
-
Size
754KB
-
MD5
9f5038a906df9d9a701a19f582ebc638
-
SHA1
e94d6bce0d20babfc1c22220d4479f0d9f179cb2
-
SHA256
7893541b010d78ca63a1f443f01f7f4100f1782eabfa486d53191d53646dd150
-
SHA512
348fa99606b1bd7e8259b246a41dfab70275ad21f8ac78d5ac45a6bc202eab0077e7351f914512588cf43ce785777f77c3b3f00d7b9765db61e0e749883c2bbb
Malware Config
Extracted
Family
cryptbot
C2
geobna72.top
moryce07.top
Attributes
-
payload_url
http://rogkjs10.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1988-60-0x0000000001CB0000-0x0000000001D91000-memory.dmp family_cryptbot behavioral1/memory/1988-61-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
7893541b010d78ca63a1f443f01f7f4100f1782eabfa4.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7893541b010d78ca63a1f443f01f7f4100f1782eabfa4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7893541b010d78ca63a1f443f01f7f4100f1782eabfa4.exe