Behavioral task
behavioral1
Sample
2028-91-0x0000000000400000-0x00000000004CB000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2028-91-0x0000000000400000-0x00000000004CB000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2028-91-0x0000000000400000-0x00000000004CB000-memory.dmp
-
Size
812KB
-
MD5
2f8b72897d23d83c01579135ebc35e15
-
SHA1
eb91355a1b8050bfb05eee60e16ad76ee14c1f56
-
SHA256
9a210262ec913e6b81a0f9cabded7d803863be43fe4b47920b73821d2ae0e3b2
-
SHA512
91a7a4b4045a0691aac93612de09c5da8184f2482ddc1f4c13347ab4e9b3f5ab5aaec3fdfc58ce4accebccdd3145ac0be93831b57cd3bfc79369012e2ee3b129
-
SSDEEP
24576:aZ3xNEkGSJBRjEEDpYFYjtpdw6kCrEPLXA:aZ3brvD2YDWNDXA
Malware Config
Extracted
cryptbot
http://erniku42.top/gate.php
-
payload_url
http://ovapfa05.top/unfele
Signatures
-
Cryptbot family
Files
-
2028-91-0x0000000000400000-0x00000000004CB000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 602KB - Virtual size: 601KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ