Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 11:46 UTC

General

  • Target

    ef4ab48d31eca3dfa890c87e4d687630N.exe

  • Size

    6.3MB

  • MD5

    ef4ab48d31eca3dfa890c87e4d687630

  • SHA1

    1fb9c069eceb828df207941be87e34e7912c301c

  • SHA256

    2ccc475f47740d76ffeb6ea4bb1b5a90aebdf3fcd94f6393ffc8ae2fb9599a7e

  • SHA512

    33d9aed20f49ac8a66f503d9b6be0a90116ad742d23b642a5a48ff11b41e4217f12b35b5692c7fa55b5df16ff9d9fb74df1bbb211ee25e3f9a68be571b6aa46a

  • SSDEEP

    49152:EjfykHS5DhSaJ4OV4D0kweKFPjcF11Uu2zeEfxguFRiLwydMd4gru6D47PY058T5:EP2S0V4D07eKhj0agEfjr13jePG

Malware Config

Extracted

Family

cryptbot

C2

twelvev12vt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef4ab48d31eca3dfa890c87e4d687630N.exe
    "C:\Users\Admin\AppData\Local\Temp\ef4ab48d31eca3dfa890c87e4d687630N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2156

Network

  • flag-us
    DNS
    twelvev12vt.top
    ef4ab48d31eca3dfa890c87e4d687630N.exe
    Remote address:
    8.8.8.8:53
    Request
    twelvev12vt.top
    IN A
    Response
No results found
  • 8.8.8.8:53
    twelvev12vt.top
    dns
    ef4ab48d31eca3dfa890c87e4d687630N.exe
    61 B
    139 B
    1
    1

    DNS Request

    twelvev12vt.top

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2156-0-0x0000000000400000-0x0000000001066000-memory.dmp

    Filesize

    12.4MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.