Static task
static1
Behavioral task
behavioral1
Sample
winlogon.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
winlogon.exe
Resource
win10v2004-20220414-en
General
-
Target
670145b34ab8de90239590d0a76a6c8989fc586c051a5b84042a0dee029c49b7
-
Size
2.2MB
-
MD5
5b809a251488d8deda63df80ff9228a8
-
SHA1
4a35f03a154a582e7da939f6f47d3563035e6ed5
-
SHA256
670145b34ab8de90239590d0a76a6c8989fc586c051a5b84042a0dee029c49b7
-
SHA512
26b381cda5e87c44b8ba9306dbac89bae89340f4293501320a564686eb8f02b106f6e4fcd04f2f41420fd31a5699dd28a21fe3715b47d6c849a3ecf08bc3986a
-
SSDEEP
49152:HCtKKId8ufXV5VQxHXTBm4r27Hk51EAcYzsNV/n:HCud/V5VGNlri0cYOVf
Malware Config
Signatures
Files
-
670145b34ab8de90239590d0a76a6c8989fc586c051a5b84042a0dee029c49b7.zip
-
winlogon.exe.exe windows x86
17ad1051188b70b0c515d0dd4d7ae68b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ResumeThread
CreateProcessA
GetThreadContext
SetThreadContext
VirtualAlloc
VirtualFree
VirtualAllocEx
ReadProcessMemory
WriteProcessMemory
GetModuleFileNameA
TerminateProcess
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
CloseHandle
GetModuleHandleA
CreateDirectoryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
WideCharToMultiByte
GetStringTypeW
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleFileNameW
GetModuleHandleExW
HeapValidate
GetSystemInfo
RaiseException
GetLastError
LoadLibraryExW
RtlUnwind
GetCommandLineW
FatalAppExitA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
CreateSemaphoreW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
WriteFile
ExitProcess
AreFileApisANSI
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileType
ReadFile
SetFilePointerEx
SetConsoleCtrlHandler
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
OutputDebugStringA
WriteConsoleW
IsValidCodePage
GetACP
GetOEMCP
HeapFree
HeapReAlloc
HeapSize
HeapQueryInformation
GetCurrentThread
GetCurrentThreadId
HeapAlloc
GetProcessHeap
VirtualQuery
FreeLibrary
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
SetEnvironmentVariableA
SetStdHandle
ReadConsoleW
CreateFileW
SetEndOfFile
advapi32
RegCreateKeyExW
RegCloseKey
RegSetValueExW
Sections
.textbss Size: - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 881KB - Virtual size: 881KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 150KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ