Analysis
-
max time kernel
6s -
max time network
43s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 19:32
Static task
static1
Behavioral task
behavioral1
Sample
5f0f316459cf8e92f8705124acdbe3e4.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
5f0f316459cf8e92f8705124acdbe3e4.exe
-
Size
746KB
-
MD5
5f0f316459cf8e92f8705124acdbe3e4
-
SHA1
dd8ec58e0fb787491eae153bd02d3be825fa8f3a
-
SHA256
b118e2deb33dc46a4ae01ba586feafcae96251267ab36dee8aa7f282b7263d13
-
SHA512
5af5e66c8de74c941337d44315beb9ded9bf9ada0b8348820c87516ef5eb507ab44586afc7401d72e61b829d1bc2e87034cfe82eaf4353a3772653c4677854c4
Malware Config
Extracted
Family
cryptbot
C2
ewapyc22.top
morzup02.top
Attributes
-
payload_url
http://winqoz02.top/download.php?file=lv.exe
Signatures
-
CryptBot Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1084-60-0x00000000004F0000-0x00000000005D1000-memory.dmp family_cryptbot behavioral1/memory/1084-61-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5f0f316459cf8e92f8705124acdbe3e4.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5f0f316459cf8e92f8705124acdbe3e4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5f0f316459cf8e92f8705124acdbe3e4.exe