Static task
static1
Behavioral task
behavioral1
Sample
6eea1d26ec4b15acfea96b21a983a3bcef8e9bc128402a26456fe26c236ec124.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6eea1d26ec4b15acfea96b21a983a3bcef8e9bc128402a26456fe26c236ec124.exe
Resource
win10v2004-20220812-en
General
-
Target
6eea1d26ec4b15acfea96b21a983a3bcef8e9bc128402a26456fe26c236ec124
-
Size
196KB
-
MD5
2c193b15771c34eac84ecb381b1f3b2a
-
SHA1
a4446558a2dac8c1d4b881e0d7c05e9d84fee60f
-
SHA256
6eea1d26ec4b15acfea96b21a983a3bcef8e9bc128402a26456fe26c236ec124
-
SHA512
83a1f8e48b78f7579f576dd2eff62ce730c5387b8bb710cefeb7b6a4b0e3c9d4af7cf6e9d72092410cd397ee9a9bfd0d6f179033b232d9ee7e732a522e8769c9
-
SSDEEP
3072:J8EpAHcHQXhbWCWyfYE2cx0TOt9JSl0TIX6JGTfmhwonWD8SGH33EvaO1JVqL:6OAHcS241gleG6mfGwonS8TXUiO1JA
Malware Config
Signatures
Files
-
6eea1d26ec4b15acfea96b21a983a3bcef8e9bc128402a26456fe26c236ec124.exe windows x86
baff2dccd76193070c66bb7ddea06fdd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeInitializeSpinLock
KeBugCheckEx
KeWaitForSingleObject
KeClearEvent
KeSetEvent
RtlCreateRegistryKey
RtlCopyUnicodeString
memmove
_vsnprintf
KeInsertQueueDpc
KeSetTimer
KeCancelTimer
MmAllocateNonCachedMemory
IofCallDriver
IoGetDmaAdapter
wcslen
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwCreateKey
swprintf
IoDisconnectInterrupt
IoGetConfigurationInformation
IoDeleteDevice
ExDeleteNPagedLookasideList
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoDetachDevice
IoFreeIrp
IoDeleteSymbolicLink
IoConnectInterrupt
IoReleaseRemoveLockAndWaitEx
strstr
strncat
sprintf
IoBuildDeviceIoControlRequest
PoSetPowerState
PoRegisterDeviceForIdleDetection
RtlCompareMemory
IoInitializeRemoveLockEx
ObfReferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoInvalidateDeviceRelations
KeRemoveQueueDpc
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
KeInitializeEvent
IoGetAttachedDeviceReference
IoAllocateIrp
IoInvalidateDeviceState
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
_local_unwind2
MmMapLockedPagesSpecifyCache
_allmul
MmMapIoSpace
IoReportResourceForDetection
IoCreateDevice
RtlUnicodeStringToInteger
wcsstr
RtlCheckRegistryKey
ExInitializeNPagedLookasideList
KeInitializeDpc
KeInitializeTimer
IoAttachDeviceToDeviceStack
IoCreateSymbolicLink
IoGetDeviceProperty
ZwCreateDirectoryObject
_alldiv
PoCallDriver
PoStartNextPowerIrp
IoFreeWorkItem
PoRequestPowerIrp
IoQueueWorkItem
IoAllocateWorkItem
strncmp
strncpy
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
KeBugCheck
PsTerminateSystemThread
KeWaitForMultipleObjects
ObReferenceObjectByHandle
PsCreateSystemThread
ExSystemTimeToLocalTime
KeQuerySystemTime
_purecall
_except_handler3
IofCompleteRequest
DbgPrint
ZwOpenKey
ZwClose
ZwQueryValueKey
RtlWriteRegistryValue
RtlInitUnicodeString
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeNumberProcessors
MmGetPhysicalAddress
ExAllocatePoolWithTag
ExFreePoolWithTag
ObfDereferenceObject
WRITE_REGISTER_ULONG
hal
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfLowerIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_ULONG
WRITE_PORT_ULONG
WRITE_PORT_BUFFER_ULONG
READ_PORT_BUFFER_ULONG
WRITE_PORT_BUFFER_USHORT
WRITE_PORT_UCHAR
READ_PORT_UCHAR
KeStallExecutionProcessor
READ_PORT_BUFFER_USHORT
READ_PORT_USHORT
HalGetInterruptVector
Sections
.text Size: 177KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ