Analysis
-
max time kernel
10s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
10-06-2021 14:03
Static task
static1
Behavioral task
behavioral1
Sample
403de488020d2745e9492068402a2bd0.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
403de488020d2745e9492068402a2bd0.exe
-
Size
773KB
-
MD5
403de488020d2745e9492068402a2bd0
-
SHA1
bf3d5727de5063f86a540fb2932d23ab8d63f65e
-
SHA256
47c4e0194d29ba8f5cee17462aa7fac391d906a405f5fc0885d802722ac878fc
-
SHA512
08807449360d1c09c6ebd7ebaa9173768cb4c793f6da29b603b1c25ede401f6b3c95ace63da6cbd1d1af359bcaf4d063767e828dd6799ee1cb18d0682b23f643
Malware Config
Extracted
Family
cryptbot
C2
olmyad42.top
morsen04.top
Attributes
-
payload_url
http://vamcrq06.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1848-60-0x0000000001C60000-0x0000000001D41000-memory.dmp family_cryptbot behavioral1/memory/1848-61-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
403de488020d2745e9492068402a2bd0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 403de488020d2745e9492068402a2bd0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 403de488020d2745e9492068402a2bd0.exe