Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-12-2023 22:03
Static task
static1
Behavioral task
behavioral1
Sample
fb660cd8294a2f697bc610d746833d91.exe
Resource
win7-20231129-en
General
-
Target
fb660cd8294a2f697bc610d746833d91.exe
-
Size
760KB
-
MD5
fb660cd8294a2f697bc610d746833d91
-
SHA1
e9cfc83ec806592a49bd094e2bbc07c937e0c9e2
-
SHA256
28877275c2c938f24cd0bf43f2c0cef090c58b7a85a988b2f6dff4970660b07d
-
SHA512
10da1e75c4aeb3df811dd22a2da4528227f8d7350bfa5992ef6cc4f3f8822e2c7ffdf897040635c1476f95b0112f13376be7cb849a8dea81455db73056329c92
-
SSDEEP
12288:n0JPFOR1iusUfrhWlR7b00lfTu+PaOpGEIyl+fnbKx/Dpclca1lUSvsNdH1GXiD:KOR1iusUT0L7fTuMNuydFaYSgHcXi
Malware Config
Extracted
cryptbot
ewaisg12.top
morvay01.top
-
payload_url
http://winezo01.top/download.php?file=lv.exe
Signatures
-
CryptBot payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2548-2-0x0000000000310000-0x00000000003F1000-memory.dmp family_cryptbot behavioral1/memory/2548-3-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot behavioral1/memory/2548-7-0x0000000000310000-0x00000000003F1000-memory.dmp family_cryptbot behavioral1/memory/2548-6-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fb660cd8294a2f697bc610d746833d91.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fb660cd8294a2f697bc610d746833d91.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fb660cd8294a2f697bc610d746833d91.exe