Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-07-2021 06:22
Static task
static1
Behavioral task
behavioral1
Sample
395d2c345e8212d9ff97248a13824075.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
395d2c345e8212d9ff97248a13824075.exe
-
Size
641KB
-
MD5
395d2c345e8212d9ff97248a13824075
-
SHA1
8cff8ab4dd9765a60735697d86af2c5d90fdee0f
-
SHA256
7224633aec5f96349eea1bc38ae40d5cbc1d5ed120aee617efca5ba7facafa26
-
SHA512
beeb6bc8769b81df7edf5470921c5c27a686c50405a8f47a1ac00b9a65d3255b69f57094e2055db556c60cb224b133724f8edc69adc0b6b35056acb38847ff86
Malware Config
Extracted
Family
cryptbot
C2
smasrp42.top
morbea04.top
Attributes
-
payload_url
http://gurdgo06.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1864-61-0x0000000000950000-0x0000000000A31000-memory.dmp family_cryptbot behavioral1/memory/1864-62-0x0000000000400000-0x000000000090A000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
395d2c345e8212d9ff97248a13824075.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 395d2c345e8212d9ff97248a13824075.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 395d2c345e8212d9ff97248a13824075.exe