Static task
static1
Behavioral task
behavioral1
Sample
3921c9c4f296cd6e5f1a5b6e51d5ddc83b48db19fc8f9e107482bf7b71d44049.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3921c9c4f296cd6e5f1a5b6e51d5ddc83b48db19fc8f9e107482bf7b71d44049.exe
Resource
win10v2004-20220901-en
General
-
Target
3921c9c4f296cd6e5f1a5b6e51d5ddc83b48db19fc8f9e107482bf7b71d44049
-
Size
298KB
-
MD5
61a4065c1ec7bfb082243cbf3bc5aa46
-
SHA1
04d134c76d1604d6910f4a4f6757141aa580bc2b
-
SHA256
3921c9c4f296cd6e5f1a5b6e51d5ddc83b48db19fc8f9e107482bf7b71d44049
-
SHA512
e06540f9069f1867e49a1febfee8b55d8e87f14950e33cca6fb4ac535fd37f84276ff9803aa52c312b9397d8deddd7c8f830ec5ba30cf8d68f26d00f35c9ce03
-
SSDEEP
6144:tqXdwd9SRN1Iqmj1IjbBZJMv5jA7Ze7xgj3N70uIhsJlQ:tqtwrgY1IjbBZJMv5gcaj3xO
Malware Config
Signatures
Files
-
3921c9c4f296cd6e5f1a5b6e51d5ddc83b48db19fc8f9e107482bf7b71d44049.exe windows x86
0b512116dcf3ca8e0be431447f0a4c3d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetWindowsDirectoryA
WideCharToMultiByte
SetEvent
WriteFile
GetACP
HeapAlloc
GetVolumeNameForVolumeMountPointW
SetConsoleCtrlHandler
lstrlenW
GetCPInfoExW
LeaveCriticalSection
CloseHandle
InterlockedExchange
GetTempPathA
DeviceIoControl
ReleaseMutex
GetDateFormatW
Sleep
GetTempPathW
CreateDirectoryW
HeapCreate
TlsAlloc
GetModuleFileNameA
DeleteCriticalSection
CreateThread
GetSystemDefaultUILanguage
GetComputerNameExA
InterlockedIncrement
CreateMutexW
ExpandEnvironmentStringsA
ReadFile
SetLocalTime
OpenEventW
CreateProcessA
VirtualQuery
GetVersionExW
LocalAlloc
CreateProcessW
LCMapStringA
LoadLibraryA
CreateFileA
lstrcpyA
TlsSetValue
MoveFileExW
ResetEvent
GetCommandLineA
UnhandledExceptionFilter
GetModuleFileNameW
Process32NextW
FindNextFileA
GetExitCodeProcess
CreateToolhelp32Snapshot
FileTimeToSystemTime
lstrcpynW
VirtualQueryEx
IsDebuggerPresent
GetModuleHandleA
GetCommandLineW
OpenProcess
GetSystemDefaultLCID
GetUserDefaultUILanguage
GetWindowsDirectoryW
MultiByteToWideChar
OpenThread
InitializeCriticalSection
EnumSystemLocalesW
FindNextFileW
GetLocaleInfoA
lstrlenA
GetEnvironmentStrings
TerminateThread
SetThreadPriority
VirtualAlloc
SetFileAttributesA
SetHandleCount
RemoveDirectoryA
GetVersionExA
InterlockedDecrement
GetFileInformationByHandle
lstrcmpiW
DeleteFileW
EnumCalendarInfoW
FindFirstFileW
GetThreadLocale
CompareStringA
GetStringTypeA
IsDBCSLeadByteEx
FindClose
SleepEx
GetLocaleInfoW
GetLastError
RemoveDirectoryW
GetFileSize
GetFileType
RtlUnwind
GetCurrentDirectoryA
GetFileAttributesW
FindResourceA
WaitForMultipleObjects
FindNextChangeNotification
GetProcAddress
GetStdHandle
GetStartupInfoA
GetModuleHandleW
FormatMessageW
CreateDirectoryA
GetCurrentProcess
GetLocalTime
SetThreadLocale
GetSystemDefaultLangID
CreateFileW
TryEnterCriticalSection
GetFileSizeEx
GetDiskFreeSpaceW
GetVersion
GetProcessHeap
FreeLibrary
GetCurrentThreadId
VirtualProtectEx
MoveFileExA
GetStartupInfoW
OutputDebugStringW
TlsGetValue
LoadLibraryExW
IsValidLocale
OpenMutexA
GetFileAttributesA
GetSystemDirectoryA
SetFileAttributesW
GetExitCodeThread
LockResource
GetThreadPriority
GetTempFileNameA
VirtualFree
RaiseException
GlobalFree
FindResourceW
GetTickCount
GetTimeZoneInformation
SetEndOfFile
WaitForSingleObject
LocalFree
GetSystemDirectoryW
GetFullPathNameW
FindFirstFileA
SwitchToThread
GetSystemInfo
HeapFree
LoadResource
GlobalAlloc
TlsFree
HeapSize
GetCurrentThread
GetOEMCP
FindFirstChangeNotificationW
HeapDestroy
GetVolumeInformationA
GetCPInfo
SetVolumeMountPointW
ExitProcess
QueryPerformanceCounter
SizeofResource
CompareStringW
TerminateProcess
LoadLibraryW
ResumeThread
DeleteVolumeMountPointW
SuspendThread
CreateEventW
EnterCriticalSection
LCMapStringW
DeleteFileA
GetUserDefaultLCID
SetFilePointer
GetSystemTimeAsFileTime
CopyFileW
CreateEventA
lstrcpyW
GetStringTypeW
Process32FirstW
user32
PeekMessageW
GetWindowLongA
RegisterWindowMessageA
PostThreadMessageA
SetWindowLongA
EnumThreadWindows
ExitWindowsEx
LoadStringW
wsprintfA
ShowWindow
SetTimer
GetMessageA
CallWindowProcA
FindWindowA
MessageBoxW
MessageBoxA
GetWindowThreadProcessId
CharUpperW
CharNextW
MsgWaitForMultipleObjects
DispatchMessageA
CreateWindowExW
CharLowerBuffW
wsprintfW
TranslateMessage
SystemParametersInfoA
KillTimer
CharUpperBuffW
advapi32
GetTokenInformation
LsaEnumerateAccountsWithUserRight
RegSetValueExA
CryptEncrypt
CryptAcquireContextA
DuplicateTokenEx
LsaClose
RegSetValueExW
LsaRemoveAccountRights
LookupPrivilegeValueA
RegEnumValueW
LsaFreeMemory
StartServiceCtrlDispatcherW
OpenProcessToken
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
LogonUserA
RegQueryValueExA
RegEnumKeyW
CryptDecrypt
RegDeleteKeyW
OpenThreadToken
RegDeleteValueA
LsaOpenPolicy
InitiateSystemShutdownA
RegCreateKeyExW
AllocateAndInitializeSid
ImpersonateLoggedOnUser
AdjustTokenPrivileges
SetServiceStatus
RevertToSelf
RegOpenKeyExA
StartServiceA
CryptReleaseContext
ConvertSidToStringSidW
RegQueryValueExW
RegOpenCurrentUser
SetThreadToken
CreateProcessAsUserW
RegisterServiceCtrlHandlerExW
SetTokenInformation
RegEnumValueA
CryptDeriveKey
RegOpenKeyExW
CreateProcessAsUserA
RegCreateKeyExA
EqualSid
CryptHashData
LookupAccountNameA
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateToken
IsTextUnicode
RegCloseKey
FreeSid
ole32
CoImpersonateClient
CoRevertToSelf
IsEqualGUID
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize
CoCreateGuid
CoInitializeSecurity
StringFromCLSID
CoInitialize
oleaut32
SafeArrayGetLBound
SysAllocString
SysStringByteLen
VariantChangeType
GetErrorInfo
VariantCopy
SysStringLen
SafeArrayGetUBound
SysAllocStringLen
SysReAllocStringLen
VariantInit
SafeArrayPtrOfIndex
VariantClear
SafeArrayCreate
SysFreeString
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
iphlpapi
GetAdaptersInfo
wsock32
htons
socket
send
getpeername
WSAStartup
getsockname
ntohs
htonl
setsockopt
WSACleanup
connect
ioctlsocket
sendto
WSAGetLastError
recv
closesocket
inet_addr
bind
shutdown
recvfrom
ntohl
netapi32
NetUserGetInfo
NetApiBufferFree
NetWkstaGetInfo
NetUserAdd
NetUserDel
NetLocalGroupAddMembers
wtsapi32
WTSFreeMemory
msvcrt
putchar
_i64tow
realloc
atexit
_assert
_onexit
exit
fclose
strlen
_iob
_vsnprintf
atoi
fgets
_pctype
memmove
fopen
_CIsin
__getmainargs
fflush
__p__environ
_cexit
_isctype
__mb_cur_max
puts
sscanf
_setmode
strchr
strtoul
free
fputc
getenv
fread
ungetc
strtol
__p__fmode
strcmp
fprintf
remove
sprintf
__set_app_type
strcspn
abort
memset
malloc
fputs
strncpy
fgetc
fwrite
signal
strcpy
Sections
.text Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ