Crime[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Crime.exe
Size 29.3MB
Sample261002-v3regsfc26
SHA256 54993ab448b3830a01be753a8458d0e2005f014d822ba169a3e7ee7d160bfa01
MD5 28f14c53ea2b0240d2a1ccdf7e9314c9
SHA1 305190fcc96cc09b82bc3ab10248ccb27911b824
SHA512 94b6c51db543cb5e81841e373fc86ff61270b1e4c12557e016e6fa0139801997feb307c48326dbcaf7431dad3bf5704372fb5517e2c27b881be5284c0c712017
SSDEEP 393216:nSvahpZCdeKs1QSPAmkZs00GaJT76mhfPAmkgML1:tQZsfJX6QfQZL
TLSH
T19B67D042F7848EA3C089977985638797D332FC4ABB1317A732987D257E93BD05E26381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Crime.exe

File Explorer

Crime.exe

.exe 29.3MB

Crime.exe

IMPHASH 9313c37c319a51be584bc61fe6f53286
SHA256 54993ab448b3830a01be753a8458d0e2005f014d822ba169a3e7ee7d160bfa01
MD5 28f14c53ea2b0240d2a1ccdf7e9314c9
SHA1 305190fcc96cc09b82bc3ab10248ccb27911b824
SHA512 94b6c51db543cb5e81841e373fc86ff61270b1e4c12557e016e6fa0139801997feb307c48326dbcaf7431dad3bf5704372fb5517e2c27b881be5284c0c712017
SSDEEP 393216:nSvahpZCdeKs1QSPAmkZs00GaJT76mhfPAmkgML1:tQZsfJX6QfQZL
TLSH
T19B67D042F7848EA3C089977985638797D332FC4ABB1317A732987D257E93BD05E26381
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2494176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sdfhdsfhshsdfsf\Downloads\crime v1.8 public source\crime public external\crime public external\crime public external\crime public external\crime public external\build\Crime.pdb

shlwapi

PathFindFileNameW

ws2_32

inet_ntop ntohl WSAIoctl freeaddrinfo getsockopt getaddrinfo inet_pton WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup bind connect getpeername getsockname htons recv setsockopt socket gethostname ioctlsocket sendto recvfrom listen htonl accept select __WSAFDIsSet send

iphlpapi

GetAdaptersInfo

advapi32

GetLengthSid CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW CryptReleaseContext CryptGetHashParam RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegQueryValueExA RegCloseKey GetTokenInformation AddAccessAllowedAce SystemFunction036 SetSecurityInfo InitializeAcl OpenProcessToken IsValidSid RegDeleteKeyA CopySid ConvertSidToStringSidA

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlUnwind RtlCaptureContext RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RtlVirtualUnwind VerSetConditionMask

kernel32

GlobalMemoryStatusEx GetDiskFreeSpaceExA GetTickCount IsDebuggerPresent GetModuleFileNameA VirtualProtect HeapFree SetDefaultDllDirectories AddDllDirectory GetCurrentProcess GetModuleFileNameW InitializeCriticalSectionEx CreateFileW GetCurrentThreadId GetSystemDirectoryW UnmapViewOfFile HeapSize GetTickCount64 GetLastError GetFileAttributesA HeapReAlloc HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile SetDllDirectoryW VirtualQuery LocalFree CreateFileA GetFileSizeEx ReadFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageW EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW InitializeCriticalSection VirtualAlloc GlobalFree FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GlobalAlloc GetTimeFormatW GetDateFormatW LoadLibraryExW GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA WriteFile SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW IsProcessorFeaturePresent UnhandledExceptionFilter Process32Next DuplicateHandle TerminateProcess ExitProcess FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo EncodePointer LCMapStringEx GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW GetVolumeInformationA FindClose FindNextFileA FindFirstFileA Process32First GetExitCodeProcess FreeConsole ReadProcessMemory GetCurrentThread SetThreadPriority lstrcmpiW CloseHandle Process32FirstW Process32NextW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency CreateToolhelp32Snapshot OpenProcess LoadLibraryA FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW Module32First GetProcessId Module32Next GetConsoleWindow VirtualQueryEx GetCurrentDirectoryW GetLocaleInfoEx WakeAllConditionVariable WakeConditionVariable FormatMessageA InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RaiseException GetLogicalProcessorInformationEx GetExitCodeThread SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared MultiByteToWideChar GetLocaleInfoA VirtualFreeEx FlushInstructionCache GetModuleHandleW VirtualAllocEx VirtualProtectEx GetLocalTime GetSystemInfo SetLastError SwitchToThread GetSystemTimePreciseAsFileTime Sleep GlobalUnlock WideCharToMultiByte GetModuleHandleA WaitForSingleObject GetTimeZoneInformation DeleteFileW CreatePipe SetStdHandle SetEndOfFile GetCurrentProcessId CreateProcessW GlobalLock IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CompareStringW WriteConsoleW

user32

SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetDC LoadCursorA GetMessageExtraInfo GetKeyState SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SendInput FindWindowA ShowWindow IsWindowVisible SetWindowDisplayAffinity EnumWindows IsWindow GetWindowThreadProcessId EndPaint BeginPaint UpdateWindow PostQuitMessage SendMessageA TranslateMessage SetWindowPos SetFocus CreateWindowExA DefWindowProcA RegisterClassA MessageBoxA SetClassLongPtrA SetWindowLongA GetAsyncKeyState GetCursorPos ReleaseDC IsDialogMessageA GetSystemMetrics FillRect PostMessageA DestroyWindow DispatchMessageA GetMessageA RegisterClassExA UnregisterClassA PeekMessageA SetLayeredWindowAttributes GetMonitorInfoA EnumDisplayMonitors GetWindowRect MonitorFromPoint IsWindowUnicode ReleaseCapture SetCursorPos GetClientRect

gdi32

CreateSolidBrush SetBkColor MoveToEx GetDeviceCaps SetBkMode TextOutA SetTextColor SelectObject CreateFontA LineTo DeleteObject CreatePen

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteA

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

winmm

waveOutUnprepareHeader waveOutClose waveOutReset waveOutOpen waveOutPrepareHeader waveOutWrite timeBeginPeriod PlaySoundA

wininet

HttpSendRequestA InternetReadFile InternetCloseHandle InternetOpenA HttpAddRequestHeadersA InternetGetConnectedState InternetConnectA HttpQueryInfoA HttpOpenRequestA InternetCheckConnectionA

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertOpenStore CertFreeCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertFindExtension CertCloseStore

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24.8MB

Virtual Size

24.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Crime.exe

shlwapi

ws2_32

iphlpapi

advapi32

d3d11

ntdll

kernel32

user32

gdi32

shell32

d3dcompiler_47

dwmapi

imm32

winmm

wininet

wintrust

dnsapi

userenv

bcrypt

crypt32

generic