cryptbot | 1908-113-0x0000000000400000-0x0000000000EFC000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1908-113-0x0000000000400000-0x0000000000EFC000-memory.dmp
Size 11.0MB
Sample240304-rd6lbsdb29
SHA256 6f88c27937990ed2a80ab7115ffc1a6bad7cd4f3acf379e8846969928c1cea53
MD5 a541c5311381f36701f28adf0e0a102a
SHA1 6075deb8929ef8c9ac38d4a5884ccfa1e4b508da
SHA512 63c2e47f206ede1a212f05979aaf243cc2cb4b48af45d80a0fea68294575f346a167e3e599b83edb122af6cd65e37bb2b08758bd421a4e998677979e2b89fb79
SSDEEP 196608:MAYIeezO76rPwuivfIjHSSL2I1Yhz8xLzQpwsOnFkRbv3LyXi:aIe176rtOfayjPt8xLzQpwsvbv3LyXi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot

Malware Config

Extracted

Family

cryptbot

http://chuawt52.top/gate.php

Attributes

payload_url
http://akiehu07.top/sunway.dat

Signatures

Cryptbot family
cryptbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1908-113-0x0000000000400000-0x0000000000EFC000-memory.dmp

File Explorer

1908-113-0x0000000000400000-0x0000000000EFC000-memory.dmp

.exe 11.0MB

1908-113-0x0000000000400000-0x0000000000EFC000-memory.dmp

SHA256 6f88c27937990ed2a80ab7115ffc1a6bad7cd4f3acf379e8846969928c1cea53
MD5 a541c5311381f36701f28adf0e0a102a
SHA1 6075deb8929ef8c9ac38d4a5884ccfa1e4b508da
SHA512 63c2e47f206ede1a212f05979aaf243cc2cb4b48af45d80a0fea68294575f346a167e3e599b83edb122af6cd65e37bb2b08758bd421a4e998677979e2b89fb79
SSDEEP 196608:MAYIeezO76rPwuivfIjHSSL2I1Yhz8xLzQpwsOnFkRbv3LyXi:aIe176rtOfayjPt8xLzQpwsvbv3LyXi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4838043

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

563KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.>Tw

Size

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.~75

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.+n:

Size

6.5MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

306KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

1908-113-0x0000000000400000-0x0000000000EFC000-memory.dmp

generic