Analysis
-
max time kernel
6s -
max time network
41s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 18:06
Static task
static1
Behavioral task
behavioral1
Sample
dc2faa416f839bf688d9ff10efacbb30.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
dc2faa416f839bf688d9ff10efacbb30.exe
-
Size
644KB
-
MD5
dc2faa416f839bf688d9ff10efacbb30
-
SHA1
bf2fc09c4eb49b83219ca9943541c7f8004c6927
-
SHA256
4a7279e1bb036c150488d9c828fc82921e798a2f1516baf7f032b1fb398f062a
-
SHA512
a10e0e989d5acbf1d0858dc6865565d98e3ee91991b365e4683f2ee70a23727bb1b8b80b62e9db57670de2cd38310e55ee34e04bdc5dafbbc9550b10b6cbc460
Malware Config
Extracted
Family
cryptbot
C2
smasrp42.top
morbea04.top
Attributes
-
payload_url
http://gurdgo06.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1208-61-0x0000000004480000-0x0000000004561000-memory.dmp family_cryptbot behavioral1/memory/1208-62-0x0000000000400000-0x0000000002BE6000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dc2faa416f839bf688d9ff10efacbb30.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dc2faa416f839bf688d9ff10efacbb30.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dc2faa416f839bf688d9ff10efacbb30.exe