cryostasis[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

cryostasis.exe
Size

8.3MB
MD5

bbff907e697e46ad74ec0c86011eef38
SHA1

c29f0c0b0a607266db698941f3b8de1063c913d7
SHA256

1c7fdab9fa4b5b69f41ebe7d22295680fca471a1aefe761fa69cd57136dc21df
SHA512

da3e7eb6c88ba06cdd17c7568f889cf8efd5e56e54c9654a3eb9f8a08c3c1ff4c3233c8e5543ccfac831d0354bb5e7852b907e700161a08f3ad7a0db98380508
SSDEEP

196608:ou1OZfMJm41MIcCgBxLZBF6sEiJmm7x4bjdJvL:tom1rWhZX6sEiJV7WbRJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cryostasis.exe

Files

cryostasis.exe
.exe windows:4 windows x86 arch:x86

afe16eb46ecc5e2d5bc3518e65aad661

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dinput8

DirectInput8Create

d3d9

Direct3DCreate9

d3dx9_39

D3DXCreateEffectFromFileA
D3DXFloat32To16Array

nxcooking

NxCookConvexMesh
NxCloseCooking
NxCookClothMesh
NxCookTriangleMesh
NxInitCooking

nxcharacter

NxReleaseControllerManager
NxCreateControllerManager

physxloader

NxGetUtilLib
NxCreatePhysicsSDK

fmodex

?createDSPByType@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PAPAVDSP@2@@Z
?addDSP@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@PAPAVDSPConnection@2@@Z
?addDSP@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@PAPAVDSPConnection@2@@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?setGeometrySettings@System@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?createGeometry@System@FMOD@@QAG?AW4FMOD_RESULT@@HHPAPAVGeometry@2@@Z
?getMaxPolygons@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
?addPolygon@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@MM_NHPBUFMOD_VECTOR@@PAH@Z
?addGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@@Z
?setPaused@Channel@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getParameterInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAD00HPAM1@Z
?getChannelsPlaying@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getDriverCaps@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAIPAH1PAW4FMOD_SPEAKERMODE@@@Z
?setSpeakerMode@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@@Z
?setDSPBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@IH@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?createChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVChannelGroup@2@@Z
?setParameter@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?remove@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
FMOD_Memory_Initialize
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z
?getUserData@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getMode@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?setLoopCount@Sound@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setLoopCount@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setMode@Channel@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?isPlaying@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?stop@Channel@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getPaused@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?set3DMinMaxDistance@Channel@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?set3DOcclusion@Channel@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?setVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DAttributes@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0@Z
?getNumParameters@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z

fmod_event

?start@Event@FMOD@@QAG?AW4FMOD_RESULT@@XZ
_FMOD_EventSystem_Create@4
?stop@Event@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getInfo@Event@FMOD@@QAG?AW4FMOD_RESULT@@PAHPAPADPAUFMOD_EVENT_INFO@@@Z
?getState@Event@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getParameter@Event@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVEventParameter@2@@Z
?setPaused@Event@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?set3DOcclusion@Event@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?getValue@EventParameter@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getRange@EventParameter@FMOD@@QAG?AW4FMOD_RESULT@@PAM0@Z
?setValue@EventParameter@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getParameterByIndex@Event@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVEventParameter@2@@Z
?keyOff@EventParameter@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getInfo@EventParameter@FMOD@@QAG?AW4FMOD_RESULT@@PAHPAPAD@Z
?getPaused@Event@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getParentGroup@Event@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVEventGroup@2@@Z
?set3DAttributes@Event@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@00@Z
?getChannelGroup@Event@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVChannelGroup@2@@Z

kernel32

GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
LCMapStringW
WideCharToMultiByte
LCMapStringA
MultiByteToWideChar
VirtualAlloc
FatalAppExitA
VirtualFree
ExitProcess
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcessId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileType
GetStdHandle
SetHandleCount
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetProcessHeap
GetVersionExA
GetCommandLineA
RtlUnwind
RaiseException
GetLastError
InterlockedExchange
LocalFree
LocalAlloc
SetStdHandle
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetTimeZoneInformation
CompareStringA
CompareStringW
IsDebuggerPresent
HeapSize
HeapAlloc
HeapFree
HeapReAlloc
LoadLibraryA
CloseHandle
TerminateProcess
GetCurrentProcess
SetThreadPriority
GetCurrentThread
CreateMutexA
OpenMutexA
GetSystemInfo
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteFileA
MoveFileExA
GetFileTime
CreateFileA
GetCurrentDirectoryA
CopyFileA
SetFileAttributesA
SetFilePointer
ReadFile
WriteFile
FlushFileBuffers
GetSystemTime
GetModuleHandleA
WritePrivateProfileStringA
GetPrivateProfileStringA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetProcAddress
GetCurrentThreadId
HeapCreate
HeapDestroy
HeapCompact
CompareFileTime
FindNextFileA
FindClose
FindFirstFileA
lstrcpyA
GetFileSize
WaitForSingleObject
SetEvent
Sleep
SetThreadAffinityMask
CreateThread
CreateEventA
GetSystemTimeAsFileTime
GetLocalTime
SetEnvironmentVariableA
GetThreadPriority
SetPriorityClass
GetFullPathNameA
FileTimeToLocalFileTime
GetPriorityClass
lstrcmpiA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
SetConsoleMode
ReadConsoleInputA
CreateDirectoryA
GetTempFileNameA
VirtualQuery
GetFileAttributesA
OpenEventA
ReleaseMutex
WaitNamedPipeA
SetNamedPipeHandleState
VirtualProtect
CreateFileW
IsBadReadPtr
GetComputerNameA
GetExitCodeProcess
GetShortPathNameA
IsBadCodePtr
OutputDebugStringA
ReadProcessMemory
WriteProcessMemory
GetProcessAffinityMask
GetWindowsDirectoryA
FileTimeToSystemTime
GlobalMemoryStatus
CreateFileMappingA
CreateProcessA
DeviceIoControl
GetDriveTypeA
GetLogicalDrives
GetSystemDirectoryA
GetVolumeInformationA
MapViewOfFile
OpenProcess
QueryDosDeviceA
SetCurrentDirectoryA
SetErrorMode
UnmapViewOfFile
GetExitCodeThread
WaitForMultipleObjects
ResetEvent
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
GetUserDefaultLangID
LockResource
LoadResource
FindResourceA
SuspendThread
ResumeThread
GetThreadContext
GetTempPathA
DuplicateHandle
RemoveDirectoryA
CreateDirectoryW
GetTempPathW
GetModuleFileNameW
GetVersion
FlushConsoleInputBuffer
lstrlenW
FlushInstructionCache
lstrlenA
IsBadWritePtr
FormatMessageA
GetEnvironmentVariableA
GlobalFree
GlobalAlloc
ReleaseSemaphore
CreateSemaphoreA
lstrcmpA
SystemTimeToFileTime
GlobalLock
LocalLock
GlobalUnlock
LocalUnlock

user32

ReleaseCapture
SetCapture
SetCursor
SetActiveWindow
GetActiveWindow
wsprintfA
GetKeyState
EnableWindow
ShowWindow
ReleaseDC
GetDC
LoadIconA
RegisterClassA
ShowCursor
MessageBoxA
PeekMessageA
TranslateMessage
SetFocus
GetWindowRect
LoadCursorA
DispatchMessageA
DestroyWindow
PostQuitMessage
SetWindowPos
DefWindowProcA
CreateWindowExA
EnumWindows
GetKeyboardType
GetProcessWindowStation
GetUserObjectInformationW
GetWindowThreadProcessId
SetSystemCursor
LoadImageA
CopyImage
wsprintfW
CharLowerA
GetCursor
DestroyCursor
EnumChildWindows
LoadCursorFromFileA
GetClassLongA
LoadStringA
GetSysColorBrush
SendDlgItemMessageA
GetSystemMetrics
DialogBoxIndirectParamA
GetClassNameA
GetDlgItem
UpdateWindow
EndDialog
SetDlgItemTextW
SetDlgItemTextA
GetSysColor
SetWindowTextA
SetWindowTextW
GetDesktopWindow
GetClientRect
FlashWindow
SetForegroundWindow
UnregisterHotKey
RegisterHotKey
GetParent
GetWindowLongA
GetWindowTextA
RegisterClassExA
UnregisterClassA
GetMessageA
KillTimer
SetTimer
GetForegroundWindow
FindWindowA
CheckMenuItem
SendMessageA
GetSubMenu
GetMenuState
GetMenu
FindWindowExA
EnableMenuItem
CharLowerBuffA

gdi32

BitBlt
SetStretchBltMode
StretchBlt
DeleteObject
DeleteDC
CreateCompatibleDC
CreateDIBSection
SelectObject
GetStockObject

shell32

ShellExecuteA
ShellExecuteExA
SHFileOperationA
SHGetSpecialFolderPathA

ole32

CoInitialize

avifil32

AVIStreamSampleToTime
AVIStreamGetFrame
AVIStreamGetFrameClose
AVIStreamRelease
AVIStreamOpenFromFileA
AVIStreamInfoA
AVIStreamLength
AVIStreamGetFrameOpen

msvfw32

DrawDibOpen
DrawDibClose
DrawDibDraw

advapi32

RegSetValueExA
RegCloseKey
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
IsValidSid
RegEnumKeyA
RegQueryInfoKeyA
CreateServiceA
StartServiceA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RevertToSelf
DeregisterEventSource
ReportEventA
RegisterEventSourceA
GetUserNameA
OpenProcessToken
RegOpenKeyA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
DeleteService
ControlService
RegDeleteValueA

shlwapi

PathRemoveExtensionW
PathCombineW
PathRemoveFileSpecW
PathStripPathW

wsock32

WSASetLastError
send
WSAGetLastError
shutdown
closesocket
recv

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Exports

Exports

?Security_AllocateResources2@@YAXXZ
?Security_AllocateResources@@YAXXZ
?Security_CreateFile@@YA_NAAVFile@@@Z
?Security_InitCommands1@@YAXXZ
?Security_InitCommands2@@YAXXZ
?Security_InitCommands3@@YAXXZ
?Security_OpenFile@@YA_NAAVFile@@@Z
?Security_ReadDword@@YAXAAVFile@@PAX@Z
AgPmDestroySourceConnection
AgPmEventEnabled
AgPmEventLoggingEnabled
AgPmSubmitEvent

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 129.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mysec
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Stext
Size: 3.5MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sitext
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Srdata
Size: 376KB - Virtual size: 373KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sdata
Size: 600KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sidata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.securom
Size: 792KB - Virtual size: 789KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

afe16eb46ecc5e2d5bc3518e65aad661

Headers

File Characteristics

Imports

dinput8

d3d9

d3dx9_39

nxcooking

nxcharacter

physxloader

fmodex

fmod_event

kernel32

user32

gdi32

shell32

ole32

avifil32

msvfw32

advapi32

shlwapi

wsock32

version

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 244KB - Virtual size: 241KB

.data Size: 136KB - Virtual size: 129.7MB

.idata Size: 12KB - Virtual size: 11KB

.didat Size: 4KB - Virtual size: 1KB

mysec Size: 8KB - Virtual size: 5KB

.rsrc Size: 48KB - Virtual size: 47KB

Stext Size: 3.5MB - Virtual size: 6.9MB

Sitext Size: 32KB - Virtual size: 28KB

Srdata Size: 376KB - Virtual size: 373KB

Sdata Size: 600KB - Virtual size: 2.4MB

Sidata Size: 24KB - Virtual size: 20KB

.securom Size: 792KB - Virtual size: 789KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 244KB - Virtual size: 241KB

.data
Size: 136KB - Virtual size: 129.7MB

.idata
Size: 12KB - Virtual size: 11KB

.didat
Size: 4KB - Virtual size: 1KB

mysec
Size: 8KB - Virtual size: 5KB

.rsrc
Size: 48KB - Virtual size: 47KB

Stext
Size: 3.5MB - Virtual size: 6.9MB

Sitext
Size: 32KB - Virtual size: 28KB

Srdata
Size: 376KB - Virtual size: 373KB

Sdata
Size: 600KB - Virtual size: 2.4MB

Sidata
Size: 24KB - Virtual size: 20KB

.securom
Size: 792KB - Virtual size: 789KB