Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21-01-2024 01:58

General

  • Target

    6c0f27024f875a94386862cfb5f0d2c8.exe

  • Size

    773KB

  • MD5

    6c0f27024f875a94386862cfb5f0d2c8

  • SHA1

    d104d6a3977eb2eff0a2ffdf6d6214fbfb25ce6e

  • SHA256

    f2dae5d58761bc67d2fac18381a2ee7e61d5eea79c32c718a7b97ec183a2489a

  • SHA512

    1f3aa6a4fa0b1ddfd009c5fcf901d51f16f9bd220ccfeb84cf9f457d3d54f5377e8e627578b5499b0726679771648bc7a56f4bff0c49a9e8d2391680ae2cdde4

  • SSDEEP

    24576:FZxGgT1VmLaPXuQCyqph+y48dlT000Hp:8gTmbZhW8bTh0

Malware Config

Extracted

Family

cryptbot

C2

ewaosm65.top

moruat06.top

Attributes
  • payload_url

    http://winazr08.top/download.php?file=lv.exe

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 4 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c0f27024f875a94386862cfb5f0d2c8.exe
    "C:\Users\Admin\AppData\Local\Temp\6c0f27024f875a94386862cfb5f0d2c8.exe"
    1⤵
    • Checks processor information in registry
    PID:1988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1988-1-0x0000000000230000-0x0000000000330000-memory.dmp

    Filesize

    1024KB

  • memory/1988-2-0x0000000004A20000-0x0000000004B01000-memory.dmp

    Filesize

    900KB

  • memory/1988-3-0x0000000000400000-0x00000000032BB000-memory.dmp

    Filesize

    46.7MB

  • memory/1988-6-0x0000000000400000-0x00000000032BB000-memory.dmp

    Filesize

    46.7MB

  • memory/1988-7-0x0000000004A20000-0x0000000004B01000-memory.dmp

    Filesize

    900KB