ServiceHandler
ServiceMain
Behavioral task
behavioral1
Sample
5982fb0c9e888cd3be9cfdf7a2b620122d99af6414efdb115ddaa61d5c1981b1.dll
Resource
win7-20220414-en
Target
5982fb0c9e888cd3be9cfdf7a2b620122d99af6414efdb115ddaa61d5c1981b1
Size
52KB
MD5
8b2457a9e2e924c107838eef31fa8723
SHA1
74f533e3609e12f13338a38c4c3784612601b8b0
SHA256
5982fb0c9e888cd3be9cfdf7a2b620122d99af6414efdb115ddaa61d5c1981b1
SHA512
ba668dc45ab7c53b4606d126929111b3e54c5cf59a1ebba7b00106c8d36caa027a9c4bb27d83e6f8caefd9474a9e204b149669d16bab8d2de7f8ed75dab21ce2
SSDEEP
768:bZYv9D8zbyWawIWB2nl0MGY/hZcJj7HtfoTRsekoIA/L:F+EowIWBM03Y5SfoVseBt/L
gootkit
4
ewerwelk.net
neperalani.com
4
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
StrStrA
StrDupW
StrCmpIW
StrRChrW
StrStrIW
StrCatW
StrCpyW
GetProcessImageFileNameA
_vsnwprintf
strchr
strrchr
NtQuerySystemInformation
ZwQueryInformationToken
ZwOpenProcessToken
ZwOpenProcess
ZwClose
NtCreateSection
NtUnmapViewOfSection
RtlNtStatusToDosError
NtMapViewOfSection
memcpy
RtlRandom
_strupr
memset
CreateEnvironmentBlock
DestroyEnvironmentBlock
WSAStartup
gethostbyname
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpReceiveResponse
GetExitCodeThread
GetShortPathNameW
lstrcmpA
VirtualFree
lstrcmpiA
FileTimeToSystemTime
HeapReAlloc
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
GetFileAttributesA
lstrcatA
GetModuleHandleW
HeapAlloc
lstrlenW
GetProcessHeap
lstrcpyW
GetTickCount
HeapFree
CreateFileW
WriteFile
CloseHandle
GetLastError
lstrcatW
ReadFile
SetEvent
CreateEventA
GetProcAddress
LoadLibraryA
Sleep
OpenProcess
ProcessIdToSessionId
GetProcessTimes
CreateMutexA
WaitForSingleObject
CreateThread
DeleteAtom
FindAtomW
ExitThread
AddAtomW
lstrlenA
ExitProcess
GetModuleHandleA
CreateProcessW
VirtualProtect
GetCurrentProcess
VirtualAlloc
CreateRemoteThread
CreateMutexW
GetModuleFileNameW
ExpandEnvironmentStringsW
MultiByteToWideChar
lstrcpyA
GetSystemDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetEnvironmentVariableA
GlobalMemoryStatusEx
GetSystemInfo
GlobalAlloc
LocalFree
GlobalFree
SetEnvironmentVariableA
TerminateThread
SetEnvironmentVariableW
GetFileSize
SetFilePointer
SetEndOfFile
GetComputerNameA
WideCharToMultiByte
GetVersion
GetCurrentProcessId
GetComputerNameW
GetWindowsDirectoryA
wsprintfW
wsprintfA
GetForegroundWindow
CreateServiceW
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
DuplicateTokenEx
SetTokenInformation
AllocateAndInitializeSid
GetLengthSid
FreeSid
CreateProcessAsUserW
GetUserNameW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
CheckTokenMembership
GetUserNameA
RegCreateKeyA
ConvertSidToStringSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
CloseServiceHandle
DeleteService
StartServiceW
RegCreateKeyW
ChangeServiceConfig2W
ConvertStringSecurityDescriptorToSecurityDescriptorA
OpenSCManagerW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegDeleteValueW
RegOpenKeyExW
CreateWellKnownSid
ShellExecuteExW
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitialize
ServiceHandler
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ