Static task
static1
Behavioral task
behavioral1
Sample
f50a20fb71cb017078c3b243fad9f95be61c059745c2b0bb67ca1f3e57963aba.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f50a20fb71cb017078c3b243fad9f95be61c059745c2b0bb67ca1f3e57963aba.exe
Resource
win10v2004-20220901-en
General
-
Target
f50a20fb71cb017078c3b243fad9f95be61c059745c2b0bb67ca1f3e57963aba
-
Size
169KB
-
MD5
6f45cdcd125c29a023866b729ba63db0
-
SHA1
acaebd4d951efa110821483c79902b05113f26a2
-
SHA256
f50a20fb71cb017078c3b243fad9f95be61c059745c2b0bb67ca1f3e57963aba
-
SHA512
b0e69ac2816203bfe49b4fc7c70300398d1698fe21402505f47a0c9fcdd21be82311af9eeac8660aa100f24675ce4868e830caedc3776368195fc3534c1df169
-
SSDEEP
3072:/DG5chs3VzBPbX7roLF5Jh3V7gXOHTqtQLVnThuW+3LRD:/QcqVz5TwJh/qKLhZUp
Malware Config
Signatures
Files
-
f50a20fb71cb017078c3b243fad9f95be61c059745c2b0bb67ca1f3e57963aba.exe windows x86
16c51cd842c8761e4a4b8203b851e710
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeReleaseGuardedMutex
ExReInitializeRundownProtection
KeAcquireGuardedMutex
ExQueueWorkItem
KeInitializeEvent
ExRundownCompleted
ExWaitForRundownProtectionRelease
ExInitializeRundownProtection
memset
KeClearEvent
IoGetIoPriorityHint
ExFreePoolWithTag
ExReleaseRundownProtection
_aullshr
MmFreePagesFromMdl
MmAllocatePagesForMdlEx
memcpy
_allshr
ExAllocatePoolWithTag
bsearch
ExAcquireRundownProtection
KeSetEvent
KeSetActualBasePriorityThread
KeQueryPriorityThread
KeWaitForSingleObject
_alldiv
_allmul
FsRtlGetVirtualDiskNestingLevel
PsCreateSystemThread
qsort
KeLeaveCriticalRegion
KeEnterCriticalRegion
ObfDereferenceObject
KeCancelTimer
KeDelayExecutionThread
NtQuerySystemInformation
KeInitializeDpc
KeInitializeTimer
KeInitializeGuardedMutex
KeSetTimer
ZwQuerySystemInformation
ExfAcquirePushLockExclusive
ExfAcquirePushLockShared
ExfTryToWakePushLock
ExfReleasePushLockShared
ObReferenceObjectByHandle
ExAcquireSpinLockShared
ExReleaseSpinLockShared
RtlComputeCrc32
IofCallDriver
IofCompleteRequest
PoStartNextPowerIrp
IoGetLowerDeviceObject
ObfReferenceObject
IoGetRelatedDeviceObject
IoFileObjectType
ExEventObjectType
ExReleaseSpinLockExclusiveFromDpcLevel
RtlClearBits
ExAcquireSpinLockExclusiveAtDpcLevel
ExReleaseSpinLockSharedFromDpcLevel
RtlAreBitsSet
RtlAreBitsClear
ExAcquireSpinLockSharedAtDpcLevel
RtlSetAllBits
RtlSetBit
RtlFindNextForwardRunClear
IoReuseIrp
IoFreeIrp
IoAllocateIrp
PoCallDriver
ZwSetInformationFile
ZwQueryVolumeInformationFile
ObQueryNameString
IoGetDeviceAttachmentBaseRef
IoSetThreadHardErrorMode
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
EtwUnregister
IoDeleteDevice
memmove
IoAttachDeviceToDeviceStack
IoCreateDevice
MmUnlockPages
MmProbeAndLockPages
MmSizeOfMdl
IoForwardIrpSynchronously
MmBuildMdlForNonPagedPool
KeReadStateEvent
KeWaitForMultipleObjects
ObCloseHandle
KeSetTimerEx
EtwRegister
PsInitialSystemProcess
MmUnmapLockedPages
KeBugCheckEx
KdDebuggerEnabled
IoSetIoPriorityHint
DbgPrint
_alloca_probe
RtlUnwind
RtlInitUnicodeString
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
ZwClose
MmGetSystemRoutineAddress
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwCreateKey
RtlFreeUnicodeString
isprint
_aulldiv
wcsstr
RtlCreateAcl
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
IoBuildDeviceIoControlRequest
ZwWriteFile
IoSynchronousPageWrite
ZwQueryInformationFile
MmCreateMdl
ZwFsControlFile
ZwCreateFile
NtWriteFile
NtReadFile
MmFreeMappingAddress
MmAllocateMappingAddress
MmMapLockedPagesWithReservedMapping
MmUnmapReservedMapping
KeInsertQueueApc
MmGetPhysicalAddress
RtlQueryRegistryValues
IoUnregisterPlugPlayNotification
IoCreateFile
IoRegisterPlugPlayNotification
KeInitializeApc
ZwSetSystemInformation
ZwDeleteValueKey
ZwEnumerateValueKey
ZwDuplicateObject
_chkstk
EtwWrite
MmMapLockedPagesSpecifyCache
KeQueryInterruptTime
KeTickCount
KeQueryTimeIncrement
ExReleaseSpinLockExclusive
ExAcquireSpinLockExclusive
EtwWriteEx
KeGetCurrentThread
IoDetachDevice
IoGetStackLimits
hal
KeQueryPerformanceCounter
KfAcquireSpinLock
KeGetCurrentIrql
KfReleaseSpinLock
ksecdd.sys
BCryptGenRandom
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptGetProperty
BCryptEncrypt
BCryptDecrypt
BCryptOpenAlgorithmProvider
Sections
.text Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ