Static task
static1
Behavioral task
behavioral1
Sample
be8440a4db3d799c7eb11309da90c38a5a9f00b9d1746ac8287abc1359a6cf73.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
be8440a4db3d799c7eb11309da90c38a5a9f00b9d1746ac8287abc1359a6cf73.exe
Resource
win10v2004-20220901-en
General
-
Target
be8440a4db3d799c7eb11309da90c38a5a9f00b9d1746ac8287abc1359a6cf73
-
Size
28KB
-
MD5
2162bf2177d2137fb97851a1b751eeb8
-
SHA1
49e0dca718224998d0e9f57ddbe055142daec8ae
-
SHA256
be8440a4db3d799c7eb11309da90c38a5a9f00b9d1746ac8287abc1359a6cf73
-
SHA512
4f99f0c83caa54df8e3edb978d231110551d55766d3465b69bce877d45d5d06ea76cd6d7df6ed56a6da6b5c49bdd8567ec7eafea93a026f2df83fefae794ff24
-
SSDEEP
384:dY/9jIWBzMnu3EdUfKNi/AmOJS4rTamEzGW:doZ4CmrW
Malware Config
Signatures
Files
-
be8440a4db3d799c7eb11309da90c38a5a9f00b9d1746ac8287abc1359a6cf73.exe windows x86
3640456360463fa0b0a7bd4e3d346245
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_aullrem
_aulldiv
_aulldvrm
ZwFsControlFile
ZwQuerySystemInformation
RtlEqualUnicodeString
ZwQueryObject
ZwCreateFile
ZwReadFile
ZwClose
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
RtlInitUnicodeString
swprintf
IofCallDriver
IofCompleteRequest
KeDetachProcess
RtlAppendUnicodeToString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
KeAttachProcess
ObfDereferenceObject
PsLookupProcessByProcessId
IoFreeIrp
KeSetEvent
IoFreeMdl
MmUnlockPages
KeWaitForSingleObject
KeInitializeEvent
IoBuildAsynchronousFsdRequest
RtlLookupElementGenericTable
DbgPrint
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
PsTerminateSystemThread
MmMapLockedPagesSpecifyCache
ExfInterlockedRemoveHeadList
KeSetPriorityThread
KeGetCurrentThread
RtlInitializeGenericTable
_except_handler3
_alldiv
strncmp
RtlGetVersion
IoGetCurrentProcess
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSpinLock
IoBuildSynchronousFsdRequest
PsSetLoadImageNotifyRoutine
IoGetDeviceObjectPointer
IoDeleteDevice
IoRegisterBootDriverReinitialization
PsGetCurrentProcessId
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
RtlEnumerateGenericTableWithoutSplaying
ZwWriteFile
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ExfInterlockedInsertTailList
PsGetCurrentThreadId
PoCallDriver
PoStartNextPowerIrp
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoDetachDevice
IoWMIRegistrationControl
KeQuerySystemTime
wcsncpy
IoBuildDeviceIoControlRequest
IoAttachDeviceToDeviceStack
KeNumberProcessors
ZwSetValueKey
ZwCreateKey
ZwOpenKey
RtlCopyUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
_allmul
NtBuildNumber
hal
KeQueryPerformanceCounter
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 992B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ