Analysis
- max time kernel
122s - max time network
169s - platform
windows7_x64 - resource
win7v20210410 - submitted
17/06/2021, 06:44
General
- Target 208e8dd08e5487af9ec875fef96c168a.exe
- Size 752KB
- Sample210617-2fplrncebx
- SHA256 f2da7bd4dc5321e7097af00b886cae56e28818c72d9e37a1f1988665034026df
Score
10/10
Malware Config
Extracted
Family
-
cryptbot
C2
-
kiykhd42.top
-
morzui04.top
Attributes
-
payload_url
http://peoqba05.top/download.php?file=lv.exe
Signatures
- CryptBot
A C++ stealer distributed widely in bundle with other software.
- CryptBot Payload 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\208e8dd08e5487af9ec875fef96c168a.exe"C:\Users\Admin\AppData\Local\Temp\208e8dd08e5487af9ec875fef96c168a.exe"1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2020-59-0x0000000076A81000-0x0000000076A83000-memory.dmp
memory/2020-60-0x0000000002250000-0x0000000002331000-memory.dmp
memory/2020-61-0x0000000000400000-0x000000000095A000-memory.dmp