Behavioral task
behavioral1
Sample
b512e52085d21ebf88fb0ad20cdde743d94a3fb46c563138a7f230aebb0d16f4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b512e52085d21ebf88fb0ad20cdde743d94a3fb46c563138a7f230aebb0d16f4.exe
Resource
win10v2004-20220901-en
General
-
Target
b512e52085d21ebf88fb0ad20cdde743d94a3fb46c563138a7f230aebb0d16f4
-
Size
456KB
-
MD5
1f2c10e3458e6ba60e03432cb8188af0
-
SHA1
32f96e849c6205ebd570bf0d5c9a5b22770b103d
-
SHA256
b512e52085d21ebf88fb0ad20cdde743d94a3fb46c563138a7f230aebb0d16f4
-
SHA512
763825682a1727d1741ebe3a1c1ce5168c6b51f5c43cc20ef715de8717abcc3c61926a9444acb01ef8f5fd2b1e86e877fbaed28b33a9cb62f5775a33f7650fb5
-
SSDEEP
6144:3kXsaKNcO9jcOGCku2vSWOj4UauccBOsvO4SIA1AT+UBiPVCi55bdbP9GwCUKMCk:bdneOn52vAabgvJAmTs9C+hGaCk
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
b512e52085d21ebf88fb0ad20cdde743d94a3fb46c563138a7f230aebb0d16f4.exe windows x86
62d50e4b5f9b00d8e9160c1c4684fa18
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
ntohl
ntohs
htonl
htons
taobase
TAOBaseGetTAOMgr
GetProcessMonitor
ReleaseProcessMonitor
TAOBaseReleaseTAOMgr
atl80
ord18
ord64
ord20
ord17
ord23
ord61
ord32
ord30
ord58
ord31
ord22
kernel32
FreeLibrary
InterlockedExchange
InterlockedCompareExchange
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
ResumeThread
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
CreateFileW
GetTempPathW
GetSystemInfo
GetSystemDefaultLangID
VirtualQuery
EnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
SetFilePointer
WriteFile
GetCommandLineW
OpenProcess
lstrcmpiW
SwitchToThread
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
CreateFileMappingW
GetVersionExA
GetACP
GetLocaleInfoA
GetThreadLocale
GetLocalTime
SetLastError
OpenEventW
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetCurrentProcess
CloseHandle
GetLastError
lstrlenW
GetModuleFileNameA
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
RaiseException
GetModuleFileNameW
SetEvent
InterlockedDecrement
InterlockedIncrement
CreateEventW
CreateThread
GetModuleHandleW
Sleep
GetCurrentThreadId
OutputDebugStringW
LeaveCriticalSection
OpenFileMappingW
GetVersionExW
user32
IsWindow
UnregisterClassA
DispatchMessageW
CharUpperW
CharNextW
FindWindowA
SendMessageTimeoutW
TranslateMessage
LoadStringW
PostThreadMessageW
GetMessageW
advapi32
RegQueryInfoKeyW
RegSetKeySecurity
RegGetKeySecurity
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyExW
RegFlushKey
RegDeleteKeyW
StartServiceW
ControlService
DeleteService
CreateServiceW
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenSCManagerW
OpenServiceW
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
ChangeServiceConfigW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
ole32
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoLoadLibrary
CoInitialize
CoUninitialize
oleaut32
SafeArrayCopy
SafeArrayGetVartype
VariantInit
VariantClear
SafeArrayDestroy
SafeArrayUnaccessData
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysAllocString
SafeArrayCreate
SafeArrayAccessData
SysFreeString
shlwapi
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
msvcr80
memcpy
__CxxFrameHandler3
wcsncpy_s
swprintf_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_purecall
memmove
realloc
??_U@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
memmove_s
malloc
_recalloc
calloc
_resetstkoflw
memcmp
_beginthreadex
wcslen
_wcsnicmp
_wmakepath_s
_wsplitpath_s
rand
srand
wcscat_s
swscanf_s
wcscpy_s
wcsrchr
_wtoi64
_vsnprintf_s
atoi
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_vsnwprintf_s_l
_snwprintf_s
_vsnwprintf_s
_putws
strcat_s
fopen_s
_except_handler3
fclose
memset
_CxxThrowException
strrchr
??_V@YAXPAX@Z
free
??3@YAXPAX@Z
strchr
fflush
strncpy_s
_snprintf_s
fwrite
_memicmp
wcsncat_s
_CIsqrt
fscanf_s
msvcp80
?close@?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??$getline@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??_D?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@PB_WHH@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
dbghelp
MiniDumpWriteDump
psapi
GetModuleFileNameExW
GetModuleBaseNameW
EnumProcessModules
EnumProcesses
GetProcessMemoryInfo
Sections
.text Size: 112KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE