Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
1700-3-0x0000000000280000-0x0000000000EEE000-memory.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1700-3-0x0000000000280000-0x0000000000EEE000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
1700-3-0x0000000000280000-0x0000000000EEE000-memory.dmp
-
Size
12.4MB
-
MD5
f8b3dd71189ed360f27919fd303d8dac
-
SHA1
8dda60b9ba1714883a2d81a3b80515d39a60d423
-
SHA256
545d3297e21fc68340742f5ddd5cf5acf1b05f0fa988237b385423dd9251cc08
-
SHA512
8f9514ea88ac7c4325841f3388752dea947e20132cf9d1d95b03e48579239216abd6dda0e633853ed57e4976e3a28a7a397f2128ed00b9b79b0cc4bb408a7c56
-
SSDEEP
98304:5gR2k29/CNunlGcCUAhOLjHBZK3LpGMuOZhfeZtpbNyfjTV8blj0pUAY+zWIF6xK:1N9/4ulYv2ZifReZtpbkjxClj0ht5
Malware Config
Extracted
cryptbot
Signatures
-
Cryptbot family
-
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule sample embeds_openssl -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1700-3-0x0000000000280000-0x0000000000EEE000-memory.dmp
Files
-
1700-3-0x0000000000280000-0x0000000000EEE000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
Size: 2.5MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fzdjmtzm Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zbhguban Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE