Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21-01-2024 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c0f27024f875a94386862cfb5f0d2c8.exe
Resource
win7-20231215-en
3 signatures
150 seconds
General
-
Target
6c0f27024f875a94386862cfb5f0d2c8.exe
-
Size
773KB
-
MD5
6c0f27024f875a94386862cfb5f0d2c8
-
SHA1
d104d6a3977eb2eff0a2ffdf6d6214fbfb25ce6e
-
SHA256
f2dae5d58761bc67d2fac18381a2ee7e61d5eea79c32c718a7b97ec183a2489a
-
SHA512
1f3aa6a4fa0b1ddfd009c5fcf901d51f16f9bd220ccfeb84cf9f457d3d54f5377e8e627578b5499b0726679771648bc7a56f4bff0c49a9e8d2391680ae2cdde4
-
SSDEEP
24576:FZxGgT1VmLaPXuQCyqph+y48dlT000Hp:8gTmbZhW8bTh0
Malware Config
Extracted
Family
cryptbot
C2
ewaosm65.top
moruat06.top
Attributes
-
payload_url
http://winazr08.top/download.php?file=lv.exe
Signatures
-
CryptBot payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1988-2-0x0000000004A20000-0x0000000004B01000-memory.dmp family_cryptbot behavioral1/memory/1988-3-0x0000000000400000-0x00000000032BB000-memory.dmp family_cryptbot behavioral1/memory/1988-6-0x0000000000400000-0x00000000032BB000-memory.dmp family_cryptbot behavioral1/memory/1988-7-0x0000000004A20000-0x0000000004B01000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
6c0f27024f875a94386862cfb5f0d2c8.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6c0f27024f875a94386862cfb5f0d2c8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6c0f27024f875a94386862cfb5f0d2c8.exe