U���$�ܙ8��%�o�}q�%��_�u7�{���Z����I���m�V��p<�ڠ�U8)���F�9v�綾[� ��xe�Um)4����@��$�W�7���T�C���*sic~^GX�=���u��6��Oo*s�K�$�R�4+k;n-R��5~�K�D�(�x�^#�81_�>�i(m���M�Gu�1'pR+K� q����f�;�-���vޟf�iOi]����� ��k=o�/�K@}�N�8;+g}'�������DĘ����go�=,J� �̨�B�\��7��Q��o��1�Do�08)/��\� 섊��&� 1������T�5�ʻ'���ӣϐ�VFG�b�p��*�}MF|(.�o��pp���z�I=�(�#[�-"�����I��>�8]]� �ci��7� ��C4�5���nP�hL�[����^�!��r�L *Y�,����H�0�S��_|�%U@U��O_�hWy#��SfV8�-�z��_�����i�t:����m��t�I���-n�_@�S��[�̙-��ڤ���W����ƃ���O��S�Fⴎw&�1���I���#0g�*�$�Ы�U�䐨�`[+r���w�`����������9�Qg�z�q?���������5�Rԝ��A3��sʞMiroRL}��?5C h�RkNʅ����P��#Qf+������P ��\7�m2�O?Z ��� �`=����jN�]ZY�� ���@r��w@R��o"m�h�����MJ��bͼm��}�p^��7�U�TG�$�p1�R�a���싿 E��4q�!��~bBB`q� O�Ou��%}6�9|���4����!9˄�ܺ�!�b� ���m�.N*�6��9w2^��Ǩ��E��!8������+J\��c��e��Yݺ�NQѱ�%�M�n��Z�������u+�Q�5WN������n�{�ǽ#n��\\@��%?���3�I,��=A�F��ܺ@#vyM E�)�-��Ίi�g_0�W��������Ʒq̌�f�]!Y�dҟ���b�M�o�а�H�y��Q�������/�SF�o��t��J��T�����ʕ�E1�ӱ�x��GGp���K�sz�z.=pl ʹ5J�<��������<x���R�g2�n�D��_��ix�K.��'[����wLE�������W����'�\��r�)�M�G#����x,2������+�:���j|��>%��f���T�fS�����s�j�Yt�u.�p�R���s!�E%j����15��<��wj����1H4�Ҧ�B�����D���-;��Y��1�u��1�e\�� j'���J�W��h��"~�B��A��?�s?Ha+�4oW�Oͧ�F�Na�������h'ǹ�9�w��B����?a[?���Z,?�Yw��⫴$�� �K��ԦH�t o���х�xqW��t�����4�*j{��yȰސҭ�p������yjY����]�!i������]y�uV}�s�2yac�����+�\�+z wqg�����,%���2�Z���Y�0x���Y:n^"ƈ�G��Fsj#�� R&9ʁ.�������J����6��K��,h0�u6v�$s�ƒ��'��ճy/x5���ݮ ���&pԣ�ºƴ�H������MkV}�u���hI���#�2f \���˶��vsEו��H�z;c���|� "�-�'���Ձ�I����N$u{<����0�5`�(�!&��"\��e%;0�|dSM@��v�PC\L�5� �[z��Ker��g]F��=o;���M�Ts���dߎ*��&?���a�b����- �2�J|c����w��g�rӟp�������| Я�'=��̯U�&,K��;K���1�n^K8 <��{]�%����ъ8�jV�o��%�������>�� ه�a�VY��:����8e�-�H�j� |�N�fg;�Ѕ[��qkN#t�oDL���*�~�(1�.������:X;�*�c|��"�Pg�X6=ar�lZ����w�p��H��Ciþd3~c������'c�߫v�:C����]��ϯ�ގf�8;�.^�1�*�_��U�.0�Z�����w �0~����M����+�=Gl�v����9��V�`�3"pb���]z���kզ��xO��u~Y��L��s��� �%������1���eD���[fvȌ��)K���D�0�d�e�D�Bp�[���X�i���*t�3UP�#n �����M�S)'�>�%Ҫ����aC�Z�:�S��� �M��Q�[����3.�M. �uTq~�M�$,<r��;�o��,���y/o�� �9*@Q�B`�ui�'�-N��9�%DN����8�7���G��ZF0��4��pb��J�S��\����U �͊�:B�c_��e��=x�Z�oy�;0h���'R$��uO ��fv���p���(d�t�)�5�M�Q� 9�n�o�Ũ�"J���Q�'��XsF��!f#<8z��b� �C%⑄ϋQ�F-����Q,9v7: /r~gbw���c�1|�����h̨!̈́��p)��-Z5#e��O��)�Q~���,��_��Z��}zg��� �옜��O�����^�O�h)J)r����j�&%�T��5�GލT\�b�p*"����c��z�1���Z�;��s�K�tRC��I��Ey��惹_�e�[�7��;K]���,�4ESn���PY+� ���4U�h��Wz R^�J ���:�`c+B7e�mH��b�e$�d�϶�W���˹�7�͚�U�2]���k���������GӖ�Z�R�u0V>��.���,C�(p_�e�@�/<n�< �X�S^�җ2����}���|���]��"5�_�w��Z�'���SH��s�G��ڿd-�㢲Dz�y���D��k_Q�q�}]m <?�o��&�4����ȵ�?{�-�"�t^)��5;!wCj��-Z��;<l_}n����.�ӳ�v���eTuv.l�[��r�w��x�x��5�\�+�ʵ��Rҍ���b��L�X*���� \��I
Static task
static1
Behavioral task
behavioral1
Sample
cc17444174a6f00be220b4eb6fbf5b140df947b41579edb77ced8d683f0e5152.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cc17444174a6f00be220b4eb6fbf5b140df947b41579edb77ced8d683f0e5152.exe
Resource
win10v2004-20220812-en
General
-
Target
cc17444174a6f00be220b4eb6fbf5b140df947b41579edb77ced8d683f0e5152
-
Size
121KB
-
MD5
1a6a4cc648c504ec23ff4759101236c1
-
SHA1
223a1a9e49bd9ac492bbfff98342444f40609de0
-
SHA256
cc17444174a6f00be220b4eb6fbf5b140df947b41579edb77ced8d683f0e5152
-
SHA512
96e84769521ab0b05dbe742b29643a90f8910a925d7d79479c93b219c4d5f71739112e7b47a0705ce51f343be37e910234f2684b0661784a743a25ff1dcb8c8a
-
SSDEEP
3072:iiqPgUEPHnpXukAoVRHcSgp+1wy8jhJZxqssW+nYPbnnv:BqPgUEPHpXukLLc3y4Unqnv
Malware Config
Signatures
Files
-
cc17444174a6f00be220b4eb6fbf5b140df947b41579edb77ced8d683f0e5152.exe windows x86
69151f2ee6ff82aee09b496871622efd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
WinExec
GetTempPathA
SetFileAttributesA
CloseHandle
ReleaseMutex
CopyFileA
OpenMutexA
WaitForSingleObject
GlobalMemoryStatusEx
GetComputerNameA
GetSystemDefaultUILanguage
GetModuleHandleA
GetStartupInfoA
GetModuleFileNameA
CreateThread
CreateProcessA
TerminateProcess
ExitThread
Sleep
GetSystemDirectoryA
lstrcatA
lstrcpyA
GetLastError
GetTickCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
GetDesktopWindow
advapi32
RegQueryValueExA
OpenServiceA
DeleteService
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
OpenSCManagerA
shell32
ShellExecuteA
ws2_32
select
__WSAFDIsSet
WSAIoctl
htonl
recv
WSASocketA
WSAStartup
send
setsockopt
sendto
inet_addr
socket
htons
connect
closesocket
gethostbyname
msvcrt
strcpy
strstr
strcspn
strncpy
_controlfp
atoi
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
time
rand
strlen
memset
memcpy
sprintf
malloc
exit
_except_handler3
strcat
??2@YAPAXI@Z
localtime
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ttt0 Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ttt1 Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ