dd373_dll
Behavioral task
behavioral1
Sample
server.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
server.exe
Resource
win10v2004-20220812-en
General
-
Target
server.exe
-
Size
68KB
-
MD5
b6e11c84a80412f8cb7330ab9fcc149e
-
SHA1
266266241adc1907f2e6d8d1d15f8aeff89deb78
-
SHA256
3cda160efdccaa80d566e2161b0e0d1541a9cb8d282d7636093e6e249235c1b3
-
SHA512
f6a68c18e662dabdd9fa1e1eb8b92e91642fda4dae7fda4847b37b9e2408d97e45996cae14b6c0afc4c8068c18e2f945f4c0c0726c4b4009876636a4dbb46784
-
SSDEEP
768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMIBV:BHJaAoHoc2x7bZoYBAcQlwJdMF
Malware Config
Signatures
-
RunningRat payload 1 IoCs
Processes:
resource yara_rule sample family_runningrat -
Runningrat family
Files
-
server.exe.exe windows x86
1b365823829e2ac9bfb0aa5d328240a4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler
kernel32
HeapAlloc
SetUnhandledExceptionFilter
CreateThread
WaitForSingleObject
ExitProcess
CloseHandle
GetProcessHeap
GetProcAddress
LoadLibraryA
HeapReAlloc
VirtualFree
FreeLibrary
VirtualAlloc
IsBadReadPtr
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ