Behavioral task
behavioral1
Sample
63fd08783dd07959fbdaadc26058a3b7e29c1c7053b570989be352db9b541f36.exe
Resource
win10-20220812-en
General
-
Target
63fd08783dd07959fbdaadc26058a3b7e29c1c7053b570989be352db9b541f36
-
Size
128KB
-
MD5
1438557a2ce68d12cbd540d3d256c583
-
SHA1
7edf16629b924e3f479ea0e82e91a32c54706489
-
SHA256
63fd08783dd07959fbdaadc26058a3b7e29c1c7053b570989be352db9b541f36
-
SHA512
5b21a136c56265e0ac6131cdfa5bea1534d07fdff5145e8482e5ca207fc4894051e899a88ed1650ebeac2a32acd2b8789e1848d8f50fb5ce3720cba74a6a1d19
-
SSDEEP
3072:fxcoqOeiXENVK5ZsiLkPn3E1zv15dUi5:fxqOdXAVuZjLkP3EZVUi
Malware Config
Signatures
-
TargetCompany payload 1 IoCs
resource yara_rule sample family_targetcompany -
Targetcompany family
Files
-
63fd08783dd07959fbdaadc26058a3b7e29c1c7053b570989be352db9b541f36.exe windows x86
c8318053dac1b12c686403fde752954c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
GetUserDefaultLangID
InitializeCriticalSection
OpenProcess
WideCharToMultiByte
Sleep
LeaveCriticalSection
TerminateProcess
ReadFile
GetModuleFileNameW
CreateFileW
lstrcatA
lstrcmpW
MultiByteToWideChar
GetFileSizeEx
GetLastError
GetProcAddress
MoveFileW
EnterCriticalSection
FindClose
PostQueuedCompletionStatus
DeviceIoControl
GetSystemInfo
WaitForMultipleObjects
Process32NextW
lstrcmpiW
CreateIoCompletionPort
GetModuleHandleA
lstrcatW
FindNextFileW
GetCurrentThread
DeleteCriticalSection
GetCurrentThreadId
GetDiskFreeSpaceExW
CloseHandle
GetWindowsDirectoryW
GetCurrentProcessId
LocalFree
lstrcpyW
CreateThread
FindVolumeClose
SetEvent
TerminateThread
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
GetFileType
CreateEventW
QueryDosDeviceW
DuplicateHandle
FindFirstVolumeW
GetTickCount
GetModuleHandleW
FindFirstFileExW
GetLogicalDrives
WaitForSingleObject
QueryPerformanceCounter
SetFilePointerEx
GetCurrentProcess
GetQueuedCompletionStatus
InterlockedIncrement
SetErrorMode
GetDriveTypeW
lstrlenA
GetComputerNameA
GetCommandLineW
ExitProcess
CreateFileA
GetStringTypeW
CreateToolhelp32Snapshot
lstrlenW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
IsValidCodePage
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
HeapSize
RaiseException
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
advapi32
LsaClose
LsaFreeMemory
AdjustTokenPrivileges
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
CryptGenRandom
OpenProcessToken
LookupPrivilegeValueW
SetNamedSecurityInfoW
CryptReleaseContext
LsaOpenPolicy
OpenThreadToken
LsaQueryInformationPolicy
CryptAcquireContextW
shell32
CommandLineToArgvW
ShellExecuteW
shlwapi
wvnsprintfW
StrStrIW
SHDeleteKeyW
StrCmpNIW
StrCmpNW
wnsprintfA
wnsprintfW
wininet
InternetOpenW
InternetQueryOptionW
InternetQueryDataAvailable
InternetCrackUrlW
InternetReadFile
InternetConnectW
HttpSendRequestW
InternetSetOptionW
InternetCloseHandle
HttpOpenRequestW
Sections
.text Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ