General

Malware Config

Signatures

Files

• Crown.zip

  .zip

  Password: crown

• Launcher.exe

  .exe windows:4 windows x86 arch:x86

  Password: crown

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• eventlog_provider.dll

  .dll windows:5 windows x64 arch:x64

  Password: crown

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  02-07-2021 00:00

  Not After

  10-07-2024 23:59

  Subject

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  93:14:42:0a:c3:d3:16:3b:04:3e:12:3d:26:6c:7c:3e:71:7d:96:0b:e6:db:33:41:ee:87:17:97:05:c0:fc:89

  Signer

  Actual PE Digest

  93:14:42:0a:c3:d3:16:3b:04:3e:12:3d:26:6c:7c:3e:71:7d:96:0b:e6:db:33:41:ee:87:17:97:05:c0:fc:89

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  C:\b\s\w\ir\cache\builder\src\out\Release_x64\eventlog_provider.dll.pdb

  Exports

  Exports

  ?fn@@YA_NXZ

  Sections

  .text

  Size: 512B - Virtual size: 86B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 644B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .retplne

  Size: 512B - Virtual size: 140B

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 36B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• libEGL.dll

  .dll windows:5 windows x64 arch:x64

  Password: crown

  592e6e55d4fe33d1bd84e3b3016fe3b2

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  02-07-2021 00:00

  Not After

  10-07-2024 23:59

  Subject

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  35:e4:a7:6d:7d:0b:bc:0c:58:60:9b:b3:46:05:72:6f:10:6c:2c:b6:77:c4:31:86:41:32:da:a6:2c:64:d1:cd

  Signer

  Actual PE Digest

  35:e4:a7:6d:7d:0b:bc:0c:58:60:9b:b3:46:05:72:6f:10:6c:2c:b6:77:c4:31:86:41:32:da:a6:2c:64:d1:cd

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  C:\b\s\w\ir\cache\builder\src\out\Release_x64\libEGL.dll.pdb

  Imports

  kernel32

  AcquireSRWLockExclusive

  CloseHandle

  CompareStringW

  CreateEventW

  CreateFileW

  DeleteCriticalSection

  EncodePointer

  EnterCriticalSection

  EnumSystemLocalesW

  ExitProcess

  FindClose

  FindFirstFileExW

  FindNextFileW

  FlsAlloc

  FlsFree

  FlsGetValue

  FlsSetValue

  FlushFileBuffers

  FreeEnvironmentStringsW

  FreeLibrary

  GetACP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetDateFormatW

  GetEnvironmentStringsW

  GetFileSizeEx

  GetFileType

  GetLastError

  GetLocaleInfoW

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExW

  GetModuleHandleW

  GetOEMCP

  GetProcAddress

  GetProcessHeap

  GetStartupInfoW

  GetStdHandle

  GetStringTypeW

  GetSystemTimeAsFileTime

  GetTimeFormatW

  GetTimeZoneInformation

  GetUserDefaultLCID

  HeapAlloc

  HeapFree

  HeapReAlloc

  HeapSize

  InitializeCriticalSectionAndSpinCount

  InitializeSListHead

  InterlockedFlushSList

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsValidCodePage

  IsValidLocale

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryExW

  LoadLibraryW

  MultiByteToWideChar

  QueryPerformanceCounter

  RaiseException

  ReadConsoleW

  ReadFile

  ReleaseSRWLockExclusive

  ResetEvent

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlPcToFileHeader

  RtlUnwind

  RtlUnwindEx

  RtlVirtualUnwind

  SetEnvironmentVariableW

  SetEvent

  SetFilePointerEx

  SetLastError

  SetStdHandle

  SetUnhandledExceptionFilter

  SleepConditionVariableSRW

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  UnhandledExceptionFilter

  WaitForSingleObjectEx

  WakeAllConditionVariable

  WideCharToMultiByte

  WriteConsoleW

  WriteFile

  Exports

  Exports

  eglAcquireExternalContextANGLE

  eglBindAPI

  eglBindTexImage

  eglChooseConfig

  eglClientWaitSync

  eglClientWaitSyncKHR

  eglCopyBuffers

  eglCopyMetalSharedEventANGLE

  eglCreateContext

  eglCreateDeviceANGLE

  eglCreateImage

  eglCreateImageKHR

  eglCreateNativeClientBufferANDROID

  eglCreatePbufferFromClientBuffer

  eglCreatePbufferSurface

  eglCreatePixmapSurface

  eglCreatePlatformPixmapSurface

  eglCreatePlatformPixmapSurfaceEXT

  eglCreatePlatformWindowSurface

  eglCreatePlatformWindowSurfaceEXT

  eglCreateStreamKHR

  eglCreateStreamProducerD3DTextureANGLE

  eglCreateSync

  eglCreateSyncKHR

  eglCreateWindowSurface

  eglDebugMessageControlKHR

  eglDestroyContext

  eglDestroyImage

  eglDestroyImageKHR

  eglDestroyStreamKHR

  eglDestroySurface

  eglDestroySync

  eglDestroySyncKHR

  eglDupNativeFenceFDANDROID

  eglExportVkImageANGLE

  eglForceGPUSwitchANGLE

  eglGetCompositorTimingANDROID

  eglGetCompositorTimingSupportedANDROID

  eglGetConfigAttrib

  eglGetConfigs

  eglGetCurrentContext

  eglGetCurrentDisplay

  eglGetCurrentSurface

  eglGetDisplay

  eglGetError

  eglGetFrameTimestampSupportedANDROID

  eglGetFrameTimestampsANDROID

  eglGetMscRateANGLE

  eglGetNativeClientBufferANDROID

  eglGetNextFrameIdANDROID

  eglGetPlatformDisplay

  eglGetPlatformDisplayEXT

  eglGetProcAddress

  eglGetSyncAttrib

  eglGetSyncAttribKHR

  eglGetSyncValuesCHROMIUM

  eglHandleGPUSwitchANGLE

  eglInitialize

  eglLabelObjectKHR

  eglLockSurfaceKHR

  eglMakeCurrent

  eglPostSubBufferNV

  eglPrepareSwapBuffersANGLE

  eglPresentationTimeANDROID

  eglProgramCacheGetAttribANGLE

  eglProgramCachePopulateANGLE

  eglProgramCacheQueryANGLE

  eglProgramCacheResizeANGLE

  eglQueryAPI

  eglQueryContext

  eglQueryDebugKHR

  eglQueryDeviceAttribEXT

  eglQueryDeviceStringEXT

  eglQueryDisplayAttribANGLE

  eglQueryDisplayAttribEXT

  eglQueryDmaBufFormatsEXT

  eglQueryDmaBufModifiersEXT

  eglQueryStreamKHR

  eglQueryStreamu64KHR

  eglQueryString

  eglQueryStringiANGLE

  eglQuerySurface

  eglQuerySurface64KHR

  eglQuerySurfacePointerANGLE

  eglReacquireHighPowerGPUANGLE

  eglReleaseDeviceANGLE

  eglReleaseExternalContextANGLE

  eglReleaseHighPowerGPUANGLE

  eglReleaseTexImage

  eglReleaseThread

  eglSetBlobCacheFuncsANDROID

  eglSetDamageRegionKHR

  eglSignalSyncKHR

  eglStreamAttribKHR

  eglStreamConsumerAcquireKHR

  eglStreamConsumerGLTextureExternalAttribsNV

  eglStreamConsumerGLTextureExternalKHR

  eglStreamConsumerReleaseKHR

  eglStreamPostD3DTextureANGLE

  eglSurfaceAttrib

  eglSwapBuffers

  eglSwapBuffersWithDamageKHR

  eglSwapBuffersWithFrameTokenANGLE

  eglSwapInterval

  eglTerminate

  eglUnlockSurfaceKHR

  eglWaitClient

  eglWaitGL

  eglWaitNative

  eglWaitSync

  eglWaitSyncKHR

  eglWaitUntilWorkScheduledANGLE

  Sections

  .text

  Size: 320KB - Virtual size: 320KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 97KB - Virtual size: 96KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gxfg

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .retplne

  Size: 512B - Virtual size: 140B

  .tls

  Size: 512B - Virtual size: 289B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  _RDATA

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ