Static task
static1
Behavioral task
behavioral1
Sample
75e9a5f5c769834ba00f2a557d37a9ea3dba25e4a1ae1c5eabf5c6124cf6aca5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
75e9a5f5c769834ba00f2a557d37a9ea3dba25e4a1ae1c5eabf5c6124cf6aca5.exe
Resource
win10v2004-20220812-en
General
-
Target
75e9a5f5c769834ba00f2a557d37a9ea3dba25e4a1ae1c5eabf5c6124cf6aca5
-
Size
726KB
-
MD5
66aeda68265516ca90ba9b2a73de85bd
-
SHA1
a01fec783a50239f64a0136f49f33338f6261b25
-
SHA256
75e9a5f5c769834ba00f2a557d37a9ea3dba25e4a1ae1c5eabf5c6124cf6aca5
-
SHA512
d9afbd1c15320a00aeda37ffa1a2f1ca5fbece88deebbacdd25169f69cacdeaabe3aa277361357080d633a2d2775668525d70c0be0ede26c4b90998d68c3c05d
-
SSDEEP
12288:G/7INGMfi++VS2RZI7XHgZQKhJgeCmmNrGYlgGYkfsS6zCdmWW/:GDIzH+VS2RmLHgZpJEdEIuzRWu
Malware Config
Signatures
Files
-
75e9a5f5c769834ba00f2a557d37a9ea3dba25e4a1ae1c5eabf5c6124cf6aca5.exe windows x86
9e0d538eb26e67330d92ae1be1e54d96
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
RegDeleteValueA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyW
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
CopySid
GetTokenInformation
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
CheckTokenMembership
IsValidSid
OpenThreadToken
RegSetValueExA
kernel32
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
QueryPerformanceCounter
VirtualProtect
GetUserDefaultUILanguage
GetCalendarInfoW
EnumSystemLocalesW
EnumUILanguagesW
IsProcessorFeaturePresent
ReleaseSemaphore
GlobalMemoryStatus
GetCurrentThread
InitializeCriticalSection
CreateFileA
CreateDirectoryW
GetTempPathW
CompareStringW
IsValidCodePage
GetStringTypeExW
IsDBCSLeadByte
GetUserDefaultLCID
GetSystemInfo
GetDiskFreeSpaceExW
GetTimeZoneInformation
GetVersionExW
GetSystemDirectoryW
IsValidLocale
LocalAlloc
LocalFree
LoadLibraryExW
GetShortPathNameA
SetUnhandledExceptionFilter
OpenMutexA
GetProcessTimes
ExpandEnvironmentStringsW
GetLocaleInfoW
CreateFileW
GetFileType
MulDiv
GetACP
FlushFileBuffers
SetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
DeleteCriticalSection
TlsFree
TlsGetValue
VirtualFree
GetSystemDefaultLCID
TlsAlloc
InitializeCriticalSectionAndSpinCount
GlobalFree
CreateEventA
CreateMutexA
CreateFileMappingA
MapViewOfFile
ReleaseMutex
GlobalAlloc
UnmapViewOfFile
GetModuleFileNameA
CreateProcessA
FreeLibrary
GetCurrentThreadId
GetTickCount
TlsSetValue
RaiseException
VirtualAlloc
HeapReAlloc
HeapAlloc
HeapValidate
HeapSize
HeapFree
GetProcessHeap
IsDebuggerPresent
SetEvent
CreateThread
GetCurrentProcess
DuplicateHandle
MultiByteToWideChar
GetVersionExA
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetVersion
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetModuleHandleA
LoadLibraryA
ResetEvent
WaitForMultipleObjects
OpenProcess
TerminateProcess
WaitForSingleObject
DeleteFileW
OpenThread
QueueUserAPC
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcessId
GetLocalTime
GetTempPathA
WideCharToMultiByte
GetLastError
Sleep
SetFilePointer
WriteFile
CloseHandle
GetFileAttributesW
GetSystemTime
SystemTimeToFileTime
CreateSemaphoreA
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
secur32
GetUserNameExW
lbghost
FIsOnlyLBInstance
FCopyOfficeHang
FRemoveOfficeHang
GetLBOSVersion
FStillHaveHangs
FSetLbOverrideWatsonUI
ResetLBInstance
HwndLBUISet
LoadLBIntl
FGetLbOverrideWatsonUI
msvcr80
__CxxFrameHandler3
_CxxThrowException
_wcsicmp
_wtoi
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_CIsqrt
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_crt_debugger_hook
_invoke_watson
_controlfp_s
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memmove
memcpy
memset
_vsnprintf
_ismbblead
user32
RegisterClassExW
IsDialogMessageW
DestroyWindow
GetWindowLongW
LoadStringW
SendMessageW
PostMessageW
IsHungAppWindow
IsWindowVisible
CreateWindowExW
GetWindowInfo
ShowWindow
FlashWindowEx
GetFocus
DefWindowProcW
SetTimer
PostQuitMessage
KillTimer
DispatchMessageW
TranslateMessage
GetWindowThreadProcessId
CreateDialogParamW
GetMessageW
SystemParametersInfoW
GetSystemMetrics
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
SetForegroundWindow
SetWindowPos
SetWindowLongW
DrawIconEx
FillRect
GetSysColorBrush
ReleaseDC
GetDC
SetWindowTextW
GetDlgItem
SendMessageA
DestroyIcon
InvalidateRect
GetSysColor
SendDlgItemMessageW
DialogBoxParamW
LoadIconW
EndDialog
GetClassNameA
IsWindowUnicode
GetWindowLongA
GetParent
MapWindowPoints
MoveWindow
GetWindow
GetDlgCtrlID
GetClientRect
IsWindow
CreateWindowExA
CreateDialogIndirectParamA
DrawTextA
DrawTextW
MapDialogRect
SetFocus
EnumDisplayMonitors
GetMonitorInfoA
LoadBitmapA
GetKeyboardLayout
GetMenuCheckMarkDimensions
EnumWindows
SetRectEmpty
Sections
.text Size: 296KB - Virtual size: 295KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 197KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 192KB - Virtual size: 1.3MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE