Behavioral task
behavioral1
Sample
2000-69-0x0000000000400000-0x00000000004BC000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2000-69-0x0000000000400000-0x00000000004BC000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2000-69-0x0000000000400000-0x00000000004BC000-memory.dmp
-
Size
752KB
-
MD5
6c77350f4925ce318d971c50dee66cf9
-
SHA1
7d9c9838a0742d463bc20f209f9b32100652755e
-
SHA256
9b0e487c497349f389d80701d5765bc05e21a3a3403fde4df73ec386f6c46a8a
-
SHA512
baf5236af08ebb514035e05e6c069581e22733ab441238d6795bdc32f9589f83ff9fae9e5c741f2b47b1641d36888641d47280ff961b714e6da50a379fdaa130
-
SSDEEP
12288:nHeTNAjU8N/LrduS4KzYloi7Rsug7G6OGssY4vfUFpO27X8ggojrIx2dSx2jA8xP:HtN/LQhKCx7RsugidVsY4v8FQ2D8gGxc
Malware Config
Extracted
cryptbot
http://ivyhur32.top/gate.php
-
payload_url
http://womheq04.top/favism.dat
Signatures
-
Cryptbot family
Files
-
2000-69-0x0000000000400000-0x00000000004BC000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 563KB - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 516B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ