Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
26/03/2025, 03:33
Static task
static1
Behavioral task
behavioral1
Sample
6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe
Resource
win7-20241023-en
General
-
Target
6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe
-
Size
361KB
-
MD5
724e8026fcd687cbd7808408ffbdd3ab
-
SHA1
d9243d3b0aa7a8d6b58b7f6f7065c9e55d4fcb34
-
SHA256
6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a
-
SHA512
28b183e5b55f2e6d57d33b571119400f149910077156b5ecd46cef95b6b6ec1e449bba05f4e2a61948d2ea55b667982e0b8a7e2f339ef7c7ac1f34fe437fc6a3
-
SSDEEP
6144:haYcHyGtkpjwwj9azy/DcWWrktaxJwPR3:gTHXt279+y/DcWWrFxJM
Malware Config
Extracted
cryptbot
befyum42.top
morkoe04.top
-
payload_url
http://mindoi05.top/download.php?file=lv.exe
Signatures
-
Cryptbot family
-
Deletes itself 1 IoCs
pid Process 2636 cmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2864 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2636 2852 6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe 30 PID 2852 wrote to memory of 2636 2852 6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe 30 PID 2852 wrote to memory of 2636 2852 6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe 30 PID 2852 wrote to memory of 2636 2852 6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe 30 PID 2636 wrote to memory of 2864 2636 cmd.exe 32 PID 2636 wrote to memory of 2864 2636 cmd.exe 32 PID 2636 wrote to memory of 2864 2636 cmd.exe 32 PID 2636 wrote to memory of 2864 2636 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe"C:\Users\Admin\AppData\Local\Temp\6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\qhFHBUlJfk & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2864
-
-