Analysis
-
max time kernel
6s -
max time network
45s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 16:02
Static task
static1
Behavioral task
behavioral1
Sample
fb660cd8294a2f697bc610d746833d91.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
fb660cd8294a2f697bc610d746833d91.exe
-
Size
760KB
-
MD5
fb660cd8294a2f697bc610d746833d91
-
SHA1
e9cfc83ec806592a49bd094e2bbc07c937e0c9e2
-
SHA256
28877275c2c938f24cd0bf43f2c0cef090c58b7a85a988b2f6dff4970660b07d
-
SHA512
10da1e75c4aeb3df811dd22a2da4528227f8d7350bfa5992ef6cc4f3f8822e2c7ffdf897040635c1476f95b0112f13376be7cb849a8dea81455db73056329c92
Malware Config
Extracted
Family
cryptbot
C2
ewaisg12.top
morvay01.top
Attributes
-
payload_url
http://winezo01.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1488-60-0x00000000002A0000-0x0000000000381000-memory.dmp family_cryptbot behavioral1/memory/1488-61-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fb660cd8294a2f697bc610d746833d91.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fb660cd8294a2f697bc610d746833d91.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fb660cd8294a2f697bc610d746833d91.exe