Crypted(1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Crypted(1).exe
Size 80.0MB
Sample261110-sql8wsyz7n
SHA256 0c7dc8232e38db06a2d6ae99c4e1e3f947981a2a67712e3b28488ebdc92c7cf4
MD5 b9d30a1b78df6f7f562740187318939e
SHA1 a7db068b5fff4e4816be055c4485fcf408c35a44
SHA512 3f038baed076135ee8f09368a1617366b7e48bdb81040a26bb87da5bc9845fde0cb85b2e3cb821b6fc030545f4e668628dc81d0fbaeeb15366b82af8461b974b
SSDEEP 49152:JweUnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnX:dUX
TLSH
T1DB0802A2BF09BBCBCAF94BB4310AA5842C55031CDB196F4009B7B7BCD395907A35953B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Crypted(1).exe

File Explorer

Crypted(1).exe

.exe 80.0MB

Crypted(1).exe

IMPHASH 04819e9149b2df904358e1b5156e5bd2
SHA256 0c7dc8232e38db06a2d6ae99c4e1e3f947981a2a67712e3b28488ebdc92c7cf4
MD5 b9d30a1b78df6f7f562740187318939e
SHA1 a7db068b5fff4e4816be055c4485fcf408c35a44
SHA512 3f038baed076135ee8f09368a1617366b7e48bdb81040a26bb87da5bc9845fde0cb85b2e3cb821b6fc030545f4e668628dc81d0fbaeeb15366b82af8461b974b
SSDEEP 49152:JweUnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnX:dUX
TLSH
T1DB0802A2BF09BBCBCAF94BB4310AA5842C55031CDB196F4009B7B7BCD395907A35953B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Alex\source\repos\cryptor\x64\Release\cryptor.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptHashData BCryptDestroyKey BCryptCreateHash BCryptSetProperty BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider

user32

MessageBoxA wsprintfA

advapi32

RegOpenKeyExW RegDeleteValueW RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameW RegSetValueExW

shell32

SHGetFolderPathW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

kernel32

QueryPerformanceCounter CreateFileMappingA GetCurrentProcessId MapViewOfFile GetCurrentThread FreeLibrary GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW UnmapViewOfFile DeleteFileW CreateThread WaitForSingleObject CopyFileW WideCharToMultiByte CheckRemoteDebuggerPresent Sleep GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetTickCount64 GetFileAttributesW GetTempPathW HeapCreate HeapDestroy HeapAlloc HeapFree GetModuleHandleA GetProcAddress CreateFileA WriteFile CloseHandle GetProcessHeap ExitProcess GetModuleFileNameW DeleteFileA GetLastError TerminateProcess ResumeThread CreateProcessW GetThreadContext SetThreadContext VirtualAlloc VirtualProtect VirtualFree VirtualAllocEx ReadProcessMemory WriteProcessMemory LoadLibraryA SwitchToFiber DeleteFiber CreateFiber ConvertThreadToFiber EnumSystemLocalesA AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetVolumeInformationW GetWindowsDirectoryA GetComputerNameA GetComputerNameW GetSystemDirectoryA

vcruntime140

__current_exception __current_exception_context memset __C_specific_handler _CxxThrowException __std_exception_destroy wcsstr __std_exception_copy memmove memcpy __std_type_info_destroy_list

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strlen towlower strncmp wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-runtime-l1-1-0

_cexit terminate _crt_at_quick_exit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _seh_filter_dll _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xthrx

Size

517KB

Virtual Size

517KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Crypted(1).exe

bcrypt

user32

advapi32

shell32

msvcp140

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic