dd373_dll
Behavioral task
behavioral1
Sample
server.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
server.exe
Resource
win10v2004-20220812-en
General
-
Target
server.exe
-
Size
68KB
-
MD5
a91a3c7dab07eebc283ae3fa1f3b7227
-
SHA1
e88d92ef9354efa3c7f14e9a323e3c96bb2033ad
-
SHA256
8c210c79c2b7c4ea35fa08d0c994a3ab26f50ee639c497f341b20da965cfbd1b
-
SHA512
a74077b53023cdeff7fb6733e87ffe8f488b69be00d8ef027fdf935efaa79e5882e75956f01c6a94770b612ec0b39a2d8c08822c5f6dbecf956fadfad1f00e83
-
SSDEEP
768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMIxV:BHJaAoHoc2x7bZoYBAcQlwJdMZ
Malware Config
Signatures
-
RunningRat payload 1 IoCs
Processes:
resource yara_rule sample family_runningrat -
Runningrat family
Files
-
server.exe.exe windows x86
1b365823829e2ac9bfb0aa5d328240a4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler
kernel32
HeapAlloc
SetUnhandledExceptionFilter
CreateThread
WaitForSingleObject
ExitProcess
CloseHandle
GetProcessHeap
GetProcAddress
LoadLibraryA
HeapReAlloc
VirtualFree
FreeLibrary
VirtualAlloc
IsBadReadPtr
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ