Static task
static1
Behavioral task
behavioral1
Sample
f631bdd4f08723d9dbc25c3a1c3aff1a0229b2fbbf48c58d4475e5ac81023903.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f631bdd4f08723d9dbc25c3a1c3aff1a0229b2fbbf48c58d4475e5ac81023903.exe
Resource
win10v2004-20220812-en
General
-
Target
f631bdd4f08723d9dbc25c3a1c3aff1a0229b2fbbf48c58d4475e5ac81023903
-
Size
204KB
-
MD5
03607abe18900a00bfbf781db4abd4fe
-
SHA1
a3a943cf130c23ed4b861d8436e66a284f3de4a1
-
SHA256
f631bdd4f08723d9dbc25c3a1c3aff1a0229b2fbbf48c58d4475e5ac81023903
-
SHA512
d31bddd3bfb5bc145334010c926c47e63d3fe23c1b51d27e58e0ace9ed735e0287d38b0ccbdbb5e5e67eadc4e6b92c7201474cac3c2f4495809ddfddca3e3eb9
-
SSDEEP
6144:YcdArvlTBdFVrGBQgzIokqbkauSYQAjQ:7d8DF0nzXRYrj
Malware Config
Signatures
Files
-
f631bdd4f08723d9dbc25c3a1c3aff1a0229b2fbbf48c58d4475e5ac81023903.exe windows x86
5e560bf85073edf3b3e0f4e0ac9f9245
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
usbd.sys
USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
ntoskrnl.exe
IoAttachDeviceToDeviceStack
ObfDereferenceObject
IoGetDeviceObjectPointer
RtlInitUnicodeString
IoStartNextPacket
PoUnregisterSystemState
PoRegisterSystemState
IoReleaseRemoveLockEx
IofCompleteRequest
PoStartNextPowerIrp
IoAcquireRemoveLockEx
IofCallDriver
IoReleaseRemoveLockAndWaitEx
PoSetPowerState
PoCallDriver
IoCancelIrp
IoReleaseCancelSpinLock
IoReportResourceForDetection
IoFreeIrp
IoDeleteDevice
IoDetachDevice
IoDeleteSymbolicLink
IoRegisterShutdownNotification
RtlQueryRegistryValues
RtlCreateRegistryKey
RtlCheckRegistryKey
ZwClose
IoOpenDeviceRegistryKey
ZwQueryValueKey
KeInitializeEvent
KeInitializeMutex
KeInitializeSpinLock
KeReleaseMutex
KeClearEvent
KeWaitForSingleObject
KeSetEvent
IoBuildSynchronousFsdRequest
IoInitializeIrp
IoFreeWorkItem
IoAllocateIrp
IoQueueWorkItem
IoAllocateWorkItem
IoCreateSynchronizationEvent
IoIsWdmVersionAvailable
IoCreateDevice
ExEventObjectType
IoUnregisterPlugPlayNotification
wcsstr
IoRegisterPlugPlayNotification
towlower
ZwEnumerateValueKey
ZwOpenKey
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
memmove
MmMapIoSpace
KeSynchronizeExecution
KeInitializeDpc
KeInsertQueueDpc
ExFreePoolWithTag
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
_except_handler3
MmUnmapLockedPages
PoRequestPowerIrp
IoBuildDeviceIoControlRequest
swprintf
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
IoCreateNotificationEvent
ExQueueWorkItem
KeSetTimer
KeCancelTimer
KeInitializeTimer
KeSetTimerEx
KeDelayExecutionThread
RtlCopyUnicodeString
RtlIntegerToUnicodeString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlAppendUnicodeStringToString
ExAllocatePoolWithTag
ZwCreateFile
ZwWriteFile
strlen
memcpy
RtlWriteRegistryValue
IoCreateSymbolicLink
IoInitializeRemoveLockEx
sprintf
KeQueryTimeIncrement
KeQuerySystemTime
_purecall
_allmul
_alldiv
ObReferenceObjectByHandle
hal
KeStallExecutionProcessor
KfReleaseSpinLock
WRITE_PORT_UCHAR
READ_PORT_UCHAR
KfRaiseIrql
KfLowerIrql
KeGetCurrentIrql
KfAcquireSpinLock
KeQueryPerformanceCounter
Sections
.text Size: 186KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 928B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ