ccminer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ccminer.exe
Size

30.5MB
MD5

fe8aad59708d67f8030f2f36dfc0017b
SHA1

bf59a9116dae7288345d4fb2047f1536c5aa5b3f
SHA256

1f985f9bd51a1d8b83146b648838e3ffd55dc63105c202222a11d648909a4b8b
SHA512

207cd46901ddd47a0093d9c50fa97f9bfa070e371bb1af09f36b1427956255a9f5ee3fe9f2de4459044278b6e8845b56a94daab85a2138f2a4f12e2c9c744b6e
SSDEEP

393216:cZvlHw+ZfIZyLrJSdQGTAmvZh6n5zIVUbjN8XcpoAkZgYeJVjLM/uk2m9uZcH3/e:B+HHcx6xT5QlAMFMp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ccminer.exe

Files

ccminer.exe
.exe windows:6 windows x64 arch:x64

1175bc63dfe070ab278799f38c5b0259

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetConsoleScreenBufferInfo
WaitForSingleObject
CloseHandle
SetWaitableTimer
QueryPerformanceFrequency
CreateWaitableTimerA
GetSystemTimeAsFileTime
QueryPerformanceCounter
FillConsoleOutputCharacterA
SetConsoleTextAttribute
MultiByteToWideChar
WriteConsoleW
SetThreadAffinityMask
SetConsoleCtrlHandler
SetPriorityClass
GetCurrentProcess
SetProcessAffinityMask
SetThreadPriority
GetCurrentThread
FreeConsole
GetSystemInfo
SetThreadExecutionState
GetConsoleWindow
GetLastError
FreeLibrary
ExpandEnvironmentStringsA
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
LoadLibraryExA
GetModuleHandleW
WriteFile
GetFileType
RtlVirtualUnwind
CreateSemaphoreA
WaitForMultipleObjects
GetSystemDirectoryA
SetThreadContext
LoadLibraryA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
GetThreadPriority
GetCurrentThreadId
GetCurrentProcessId
CreateEventA
ReleaseSemaphore
ResetEvent
SetEvent
SetLastError
DuplicateHandle
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SwitchToThread
VerSetConditionMask
GetFileAttributesW
GetFullPathNameW
GetSystemDirectoryW
GetModuleFileNameW
LoadLibraryExW
LocalAlloc
LocalFree
VerifyVersionInfoW
EncodePointer
GetThreadTimes
LoadLibraryW
WaitForSingleObjectEx
GetStdHandle
GetProcAddress
GetThreadContext
Sleep
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeSListHead
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSectionAndSpinCount
CreateEventW
InitializeCriticalSection

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
ShowWindow

libcurl

curl_slist_free_all
curl_easy_recv
curl_slist_append
curl_easy_getinfo
curl_easy_reset
curl_global_cleanup
curl_easy_setopt
curl_easy_send
curl_easy_perform
curl_easy_cleanup
curl_easy_init
curl_global_init
curl_version
curl_version_info

ws2_32

sendto
htons
htonl
recvfrom
inet_ntoa
setsockopt
inet_addr
listen
closesocket
bind
accept
socket
WSAIoctl
send
select
recv
ntohs
WSAGetLastError

winmm

timeEndPeriod
timeBeginPeriod

vcruntime140

__current_exception_context
__intrinsic_setjmp
__current_exception
__RTDynamicCast
strstr
wcsrchr
memcmp
wcsstr
longjmp
memmove
__std_terminate
strchr
__std_exception_copy
strrchr
__C_specific_handler
_CxxThrowException
memset
memchr
memcpy
__std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

__setusermatherr
fmod
_dclass
floor
llround

api-ms-win-crt-runtime-l1-1-0

exit
_invalid_parameter_noinfo_noreturn
_invoke_watson
strerror
_errno
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
raise
_beginthreadex
_getpid
_endthreadex

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
fopen
fclose
_setmode
ftell
fseek
fgets
ferror
feof
_wfopen
fwrite
fgetc
__stdio_common_vsscanf
__stdio_common_vswprintf
_set_fmode
__p__commode
__stdio_common_vfprintf
fflush
_isatty
_fileno
_getcwd
__acrt_iob_func
fread

api-ms-win-crt-heap-l1-1-0

calloc
_aligned_malloc
_callnewh
realloc
_aligned_free
free
malloc
_set_new_mode

api-ms-win-crt-utility-l1-1-0

rand
srand
qsort

api-ms-win-crt-string-l1-1-0

strncat_s
strncpy
strtok
strspn
_wcsnicmp
isspace
_strdup
toupper
isalpha
strncmp
isdigit
strcmp
_strnicmp
tolower
_stricmp
_wcsicmp

api-ms-win-crt-time-l1-1-0

_time64
_tzset
__timezone
_ftime64_s
_difftime64
_localtime64
strftime
_gmtime64
__daylight
_ftime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-convert-l1-1-0

strtod
strtol
_strtoi64
strtoul
atoi
atof
atol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-filesystem-l1-1-0

_unlink
rename
_chdir
_splitpath_s
_stat64i32
_mkdir

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW

Exports

Exports

NvOptimusEnablementCuda
argon2_ctx
argon2_error_message
argon2_hash
argon2_type2string
argon2_verify
argon2_verify_ctx
argon2d_ctx
argon2d_hash_encoded
argon2d_hash_raw
argon2d_verify
argon2d_verify_ctx
argon2i_ctx
argon2i_hash_encoded
argon2i_hash_raw
argon2i_verify
argon2i_verify_ctx
argon2id_ctx
argon2id_hash_encoded
argon2id_hash_raw
argon2id_verify
argon2id_verify_ctx

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 645KB - Virtual size: 645KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 48.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nv_fatb
Size: 27.7MB - Virtual size: 27.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nvFatBi
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ctors
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dtors
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1175bc63dfe070ab278799f38c5b0259

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

libcurl

ws2_32

winmm

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

advapi32

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 645KB - Virtual size: 645KB

.data Size: 62KB - Virtual size: 48.9MB

.pdata Size: 33KB - Virtual size: 33KB

.nv_fatb Size: 27.7MB - Virtual size: 27.7MB

.nvFatBi Size: 4KB - Virtual size: 4KB

.ctors Size: 512B - Virtual size: 8B

.dtors Size: 512B - Virtual size: 8B

.rsrc Size: 99KB - Virtual size: 98KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 645KB - Virtual size: 645KB

.data
Size: 62KB - Virtual size: 48.9MB

.pdata
Size: 33KB - Virtual size: 33KB

.nv_fatb
Size: 27.7MB - Virtual size: 27.7MB

.nvFatBi
Size: 4KB - Virtual size: 4KB

.ctors
Size: 512B - Virtual size: 8B

.dtors
Size: 512B - Virtual size: 8B

.rsrc
Size: 99KB - Virtual size: 98KB

.reloc
Size: 10KB - Virtual size: 9KB