Crash
Static task
static1
Behavioral task
behavioral1
Sample
7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad.dll
Resource
win10-en-20211208
General
-
Target
7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad
-
Size
133KB
-
MD5
a193184e61e34e2bc36289deaafdec37
-
SHA1
94488f214b165512d2fc0438a581f5c9e3bd4d4c
-
SHA256
7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad
-
SHA512
113bccfa08798158cb8bc31eadfc0d4e91645422cadda7cc2ece753ad5a51c7260a7ff11aae25d7802965979aa996ef6428d5eb9882532a4f55518d2107b136f
-
SSDEEP
3072:McaprOfoaXmgD31r4VWBvRZoiTprUZNZ9VQ6s6W9:McuOJ2gD31QW51pgE6st9
Malware Config
Signatures
-
Industroyer 1 IoCs
Contains code associated with parsing industroyer's configuration file.
Processes:
resource yara_rule sample win_industroyer_w4 -
Industroyer IEC-104 Module 1 IoCs
Contains strings related to Industroyer module used to communicate with power transmission grids over IEC-104 protocol.
Processes:
resource yara_rule sample win_industroyer_w3 -
Industroyer family
Files
-
7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad.dll windows x86
f3fa7eda5f4e7d94a714ad0e0880245e
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
SetConsoleTextAttribute
GetStdHandle
TerminateProcess
WaitForMultipleObjects
SetThreadPriority
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32Next
CloseHandle
CreateThread
ReadConsoleW
ReadFile
SetEndOfFile
HeapReAlloc
HeapSize
WriteConsoleW
SetFilePointerEx
SetStdHandle
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
GetFileType
GetACP
WriteFile
GetConsoleCP
GetConsoleMode
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
CreateFileW
DecodePointer
ws2_32
closesocket
getaddrinfo
WSAStartup
send
socket
connect
recv
freeaddrinfo
setsockopt
WSAGetLastError
Exports
Exports
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ