cryptbot | 1996-64-0x0000000000540000-0x0000000000602000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1996-64-0x0000000000540000-0x0000000000602000-memory.dmp
Size 776KB
Sample240304-jmfr9sec39
SHA256 14e9f374380293a8d10a529c3501206a769fa3120c36c86c6e44384d0817eb7c
MD5 0d050d2cf8e4075828a868ef7f3a9891
SHA1 8d5be0719cdffe2a68f0fffca21487aac43ca198
SHA512 4488152e1c21dbbe1e27bbd672211e29aac8445719d11c3858c8476e5f941e9166bbbbc387d1d3925c33003d835318d54fd113ede9b9483d832a6ce46df0f9f4
SSDEEP 24576:8RlgaNf/4V2eJnZIRWdxM4k78RwOD00etOnbB9:WvXKrM4zwOD0/AP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot

Malware Config

Extracted

Family

cryptbot

http://ivyves72.top/gate.php

Attributes

payload_url
http://womuyt10.top/thraep.dat

Signatures

Cryptbot family
cryptbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1996-64-0x0000000000540000-0x0000000000602000-memory.dmp

File Explorer

1996-64-0x0000000000540000-0x0000000000602000-memory.dmp

.exe 776KB

1996-64-0x0000000000540000-0x0000000000602000-memory.dmp

IMPHASH 1ba8890870a33e6a5652a3b4669d2447
SHA256 14e9f374380293a8d10a529c3501206a769fa3120c36c86c6e44384d0817eb7c
MD5 0d050d2cf8e4075828a868ef7f3a9891
SHA1 8d5be0719cdffe2a68f0fffca21487aac43ca198
SHA512 4488152e1c21dbbe1e27bbd672211e29aac8445719d11c3858c8476e5f941e9166bbbbc387d1d3925c33003d835318d54fd113ede9b9483d832a6ce46df0f9f4
SSDEEP 24576:8RlgaNf/4V2eJnZIRWdxM4k78RwOD00etOnbB9:WvXKrM4zwOD0/AP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454962

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindClose CreateFileW DeleteFileW GetFileSize lstrcmpW SetFilePointer GetCurrentThreadId LocalAlloc MultiByteToWideChar GetLastError FileTimeToSystemTime LocalFree FreeLibrary CreateDirectoryW GetModuleFileNameW SetErrorMode GetTempPathW WaitForSingleObject GetModuleHandleA GlobalAlloc GlobalFree ExitProcess GetComputerNameW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetFileAttributesW GetVersionExW UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile FindNextFileW WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers lstrlenW GetTempFileNameW WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindFirstFileW ReadFile GlobalMemoryStatus GetCurrentProcess GetDiskFreeSpaceExA GetProcAddress GetLogicalDriveStringsA GetLocalTime LoadLibraryW GetSystemInfo LoadLibraryA GetLocaleInfoA GetLocaleInfoW GetEnvironmentVariableW GetDriveTypeA GetModuleHandleExW GetSystemDefaultLCID GetLogicalDrives GetTimeZoneInformation SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleMode GetConsoleCP GetFileType GetACP GetStdHandle GetTickCount GetModuleHandleW CloseHandle Process32FirstW Process32NextW Sleep CreateToolhelp32Snapshot CreateFileA GetModuleFileNameA FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind RaiseException LoadLibraryExW GetCPInfo GetStringTypeW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError DecodePointer EncodePointer TerminateProcess InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter SetEvent ResetEvent CreateEventW IsDebuggerPresent ReadConsoleW

user32

ReleaseDC SetThreadDesktop MessageBoxW GetWindowRect GetDesktopWindow OpenWindowStationA SetProcessWindowStation OpenInputDesktop GetWindowDC GetProcessWindowStation GetThreadDesktop

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

advapi32

GetTokenInformation RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA OpenProcessToken ConvertSidToStringSidW GetUserNameW RegQueryValueExW

shell32

SHFileOperationW ShellExecuteExW SHGetFolderPathW

ole32

CreateStreamOnHGlobal

crypt32

CryptUnprotectData CertFindChainInStore CertOpenSystemStoreA CertGetCertificateChain CertFreeCertificateContext CertCloseStore CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetSetOptionA HttpEndRequestA InternetWriteFile HttpOpenRequestA HttpSendRequestExA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile

ws2_32

send WSAGetLastError getaddrinfo closesocket WSACleanup ioctlsocket freeaddrinfo recv connect socket WSAStartup

Name

.text

Size

564KB

Virtual Size

564KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.cppor

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

1996-64-0x0000000000540000-0x0000000000602000-memory.dmp

kernel32

user32

gdi32

advapi32

shell32

ole32

crypt32

wininet

ws2_32

generic