Analysis
-
max time kernel
118s -
max time network
155s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 16:06
Static task
static1
Behavioral task
behavioral1
Sample
af12a5b1fb40fb31e4f8979b0a4cb42c.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
af12a5b1fb40fb31e4f8979b0a4cb42c.exe
-
Size
758KB
-
MD5
af12a5b1fb40fb31e4f8979b0a4cb42c
-
SHA1
a1ff752ec748ca0dae13b861b8bbc3da61fc7c8c
-
SHA256
a4c1611cb53460b6e745cc05101f83a834d66d78462fff9b190cff9727784700
-
SHA512
a2107fd5547b7040ee2e584c83fc24ec6dba39d87934f18caf1161a5cfda817296758b6145452800f0ecbb23831e9b8a29f9328f22dda8eecb2f1b958880a6d1
Malware Config
Extracted
Family
cryptbot
C2
ewaisg12.top
morvay01.top
Attributes
-
payload_url
http://winezo01.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-60-0x0000000000560000-0x0000000000641000-memory.dmp family_cryptbot behavioral1/memory/1664-61-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
af12a5b1fb40fb31e4f8979b0a4cb42c.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 af12a5b1fb40fb31e4f8979b0a4cb42c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString af12a5b1fb40fb31e4f8979b0a4cb42c.exe