Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
16-01-2024 05:18
Static task
static1
Behavioral task
behavioral1
Sample
5f0f316459cf8e92f8705124acdbe3e4.exe
Resource
win7-20231215-en
General
-
Target
5f0f316459cf8e92f8705124acdbe3e4.exe
-
Size
746KB
-
MD5
5f0f316459cf8e92f8705124acdbe3e4
-
SHA1
dd8ec58e0fb787491eae153bd02d3be825fa8f3a
-
SHA256
b118e2deb33dc46a4ae01ba586feafcae96251267ab36dee8aa7f282b7263d13
-
SHA512
5af5e66c8de74c941337d44315beb9ded9bf9ada0b8348820c87516ef5eb507ab44586afc7401d72e61b829d1bc2e87034cfe82eaf4353a3772653c4677854c4
-
SSDEEP
12288:7n5IQdj9J0t1CIQklyPGt0dPf2OgiCjwnRl/1T7xu8+3oIa1oDVLBTv5NKrk52mB:7Nut1CIHlgGOgwnTu3zRtTX2kLB
Malware Config
Extracted
cryptbot
ewapyc22.top
morzup02.top
-
payload_url
http://winqoz02.top/download.php?file=lv.exe
Signatures
-
CryptBot payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2224-2-0x0000000001C10000-0x0000000001CF1000-memory.dmp family_cryptbot behavioral1/memory/2224-3-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot behavioral1/memory/2224-6-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot behavioral1/memory/2224-7-0x0000000001C10000-0x0000000001CF1000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5f0f316459cf8e92f8705124acdbe3e4.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5f0f316459cf8e92f8705124acdbe3e4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5f0f316459cf8e92f8705124acdbe3e4.exe