Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
3080-583-0x0000000000DE0000-0x0000000001A56000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3080-583-0x0000000000DE0000-0x0000000001A56000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
3080-583-0x0000000000DE0000-0x0000000001A56000-memory.dmp
-
Size
12.5MB
-
MD5
0bb000bd886367d81f79056f76128009
-
SHA1
c806ea84ac50b4f7c6e91da2d734e1b3db49d553
-
SHA256
6e21a6d5edec5677dd16830432d490f90bdaee92d366e127578613091616bce2
-
SHA512
b8a04d3b26b4cc897ef4fd2b55066e57c5604a79679462c4794375ba662848cae37e99dc9203aef1b404dd10dc3e4b19347d8ce17b62ad8a2c907a3ff88ebbde
-
SSDEEP
98304:FnDYp4UvtX81QK5fcW5VmSQKHztfJNS9d8nRQU0wV/eBEhaOZL95ecA5glw:ENlYFNVBQUGBEhZZzBA5gl
Malware Config
Extracted
cryptbot
Signatures
-
Cryptbot family
-
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule sample embeds_openssl -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3080-583-0x0000000000DE0000-0x0000000001A56000-memory.dmp
Files
-
3080-583-0x0000000000DE0000-0x0000000001A56000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
Size: 2.5MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gveixubs Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cjqzbotd Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE