Static task
static1
Behavioral task
behavioral1
Sample
2e88e60123f0d285a09e079326d295dc28cac76e222a3f3ad96038b31ca1ea59.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2e88e60123f0d285a09e079326d295dc28cac76e222a3f3ad96038b31ca1ea59.exe
Resource
win10v2004-20220414-en
General
-
Target
2e88e60123f0d285a09e079326d295dc28cac76e222a3f3ad96038b31ca1ea59
-
Size
961KB
-
MD5
e697d27432d8b3b691328b765c8bf9e3
-
SHA1
b631af4bc744a902a88adacb9d9361c9318dbeb9
-
SHA256
2e88e60123f0d285a09e079326d295dc28cac76e222a3f3ad96038b31ca1ea59
-
SHA512
bcba531de5106b0b6b8418dc822fc51253aab1e89647e9095c6beb3f440298e3e2c972404b505020c6248ba10cdb6943c48257a013ed30b2ac9b3eb059c5ba0b
-
SSDEEP
24576:ybcVJyJj7zIBP8yvs1u0jdQhgFqQfWilKpF8:DYjo5Xv0Y/QtkH8
Malware Config
Signatures
Files
-
2e88e60123f0d285a09e079326d295dc28cac76e222a3f3ad96038b31ca1ea59.exe windows x86
c56a993cddd1b82c1883ac86c5116c3a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
CreateEventW
InterlockedIncrement
GetOverlappedResult
RegisterWaitForSingleObjectEx
ExpandEnvironmentStringsA
GetProcessHeap
VirtualQuery
lstrcpynW
GetLogicalDriveStringsW
ReleaseActCtx
SetProcessWorkingSetSize
GlobalFree
AddRefActCtx
CreateActCtxW
GetStringTypeExW
SetConsoleMode
SetEvent
GlobalAlloc
GetCommandLineW
PurgeComm
VirtualProtect
UpdateResourceW
_lwrite
GetCommTimeouts
SetThreadPriorityBoost
lstrlenA
EnumDateFormatsExW
GetCPInfo
InitializeCriticalSection
InterlockedCompareExchange
SizeofResource
DeleteFileA
GetNativeSystemInfo
CloseHandle
DosDateTimeToFileTime
LockFile
GlobalWire
EnumDateFormatsW
lstrcmpiA
AllocConsole
SetDefaultCommConfigW
FlushFileBuffers
GetLocalTime
GetCurrentThread
AddConsoleAliasA
DnsHostnameToComputerNameW
GetProfileSectionW
FileTimeToDosDateTime
ReplaceFileW
QueryMemoryResourceNotification
GetLastError
GetSystemWindowsDirectoryA
OpenJobObjectW
ChangeTimerQueueTimer
TerminateProcess
GetCurrentDirectoryW
GetCommModemStatus
GetVersionExA
SetEnvironmentVariableA
FindFirstChangeNotificationA
RtlUnwind
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
HeapAlloc
HeapFree
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
user32
GetCaretPos
advapi32
OpenServiceW
AddAuditAccessAceEx
OpenProcessToken
RegSaveKeyW
DestroyPrivateObjectSecurity
DeleteService
LookupAccountSidW
InitializeAcl
EnumDependentServicesW
IsValidSecurityDescriptor
SetSecurityDescriptorDacl
RegDeleteValueW
ImpersonateNamedPipeClient
SetPrivateObjectSecurity
DuplicateTokenEx
RegQueryInfoKeyW
GetSidSubAuthority
SetServiceStatus
GetSidLengthRequired
RegDeleteValueA
SetAclInformation
ClearEventLogW
AreAllAccessesGranted
GetKernelObjectSecurity
OpenThreadToken
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 862KB - Virtual size: 862KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 104.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ