Static task
static1
Behavioral task
behavioral1
Sample
3f13640a4b8ffc71a7fac674192e249f2c1467a2324d0c727932ea5a3aa00973.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3f13640a4b8ffc71a7fac674192e249f2c1467a2324d0c727932ea5a3aa00973.exe
Resource
win10v2004-20220901-en
General
-
Target
3f13640a4b8ffc71a7fac674192e249f2c1467a2324d0c727932ea5a3aa00973
-
Size
135KB
-
MD5
1486d530c709476ac526a8ea8f718c3b
-
SHA1
25867b8e333e95a882e64e2d5f8c39cb77c1151b
-
SHA256
3f13640a4b8ffc71a7fac674192e249f2c1467a2324d0c727932ea5a3aa00973
-
SHA512
bd0184d07b3f0963af900c6b1c1975f7fc2623560354af62cb1a19fd36d5aaaa34e71a5210149c99ba304b9d8a3402cc86032b026b53424da93d9fda0b5a50cc
-
SSDEEP
3072:UAOmfb97CUKUJRpWA7uKY6x06v/AHT/T6JciDmtUSfJI6:U/CWA7u76xRAHzjiDJKJ
Malware Config
Signatures
Files
-
3f13640a4b8ffc71a7fac674192e249f2c1467a2324d0c727932ea5a3aa00973.exe windows x86
cc74ec008db621affedf8b410b079bde
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
hal
KeAcquireQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KeReleaseQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ntoskrnl.exe
IoFileObjectType
IoGetRelatedDeviceObject
IoBuildPartialMdl
KeQueryInterruptTime
MmMapLockedPages
IoAllocateMdl
InterlockedPopEntrySList
MmUnlockPages
MmProbeAndLockPages
ExRaiseAccessViolation
MmUserProbeAddress
ExRaiseDatatypeMisalignment
_except_handler3
MmIsThisAnNtAsSystem
MmQuerySystemSize
KeGetRecommendedSharedDataAlignment
KeInitializeSpinLock
DbgPrint
RtlCompareMemory
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceSharedLite
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ZwClose
ObOpenObjectByPointer
IoCreateFile
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithQuotaTag
IoFreeIrp
PsReturnPoolQuota
ExAllocatePoolWithTagPriority
PsChargeProcessPoolQuota
RtlCopyUnicodeString
RtlCompareUnicodeString
MmResetDriverPaging
IoGetCurrentProcess
MmSizeOfMdl
MmBuildMdlForNonPagedPool
IoInitializeIrp
ExRaiseStatus
IoSetIoCompletion
PsGetProcessExitTime
SeUnlockSubjectContext
SeFreePrivileges
SeAppendPrivileges
SeAccessCheck
SeLockSubjectContext
RtlMapGenericMask
IoGetFileObjectGenericMapping
RtlEqualString
RtlInitString
PsGetCurrentThread
IoAllocateIrp
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
KeInitializeEvent
KeSetEvent
ExEventObjectType
ProbeForWrite
KeResetEvent
IofCallDriver
ExInitializeResourceLite
ExDeleteResourceLite
ZwOpenKey
RtlInitUnicodeString
ZwCreateKey
ZwQueryValueKey
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
ObReleaseObjectSecurity
SeSetSecurityDescriptorInfo
ExAllocatePoolWithTag
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ObGetObjectSecurity
IoDeleteDevice
ExDeleteNPagedLookasideList
IoQueueWorkItem
ZwNotifyChangeKey
MmPageEntireDriver
IoFreeWorkItem
ExInitializeNPagedLookasideList
IoAllocateWorkItem
IoCreateDevice
DbgBreakPoint
KeReadStateEvent
KePulseEvent
MmAdvanceMdl
KeBugCheckEx
ExInterlockedFlushSList
KeSetTimerEx
KeInitializeDpc
KeInitializeTimer
MmLockPagableDataSection
KeSetTimer
MmUnlockPagableImageSection
KeRemoveQueueDpc
KeCancelTimer
_alldiv
RtlEqualUnicodeString
ExAllocatePoolWithQuota
MmUnmapLockedPages
IoCancelIrp
ExQueueWorkItem
FsRtlMdlReadComplete
KeDetachProcess
FsRtlMdlRead
KeAttachProcess
IoGetRequestorProcess
FsRtlCopyRead
IoQueryFileInformation
_aullrem
PsGetCurrentProcessId
ObFindHandleForObject
ObCloseHandle
ObOpenObjectByName
IoThreadToProcess
KeTickCount
KeInitializeApc
KeInsertQueueApc
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
ObfReferenceObject
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
memmove
ExFreePoolWithTag
IofCompleteRequest
IoFreeMdl
ObfDereferenceObject
ObReferenceObjectByHandle
ExGetPreviousMode
InterlockedPushEntrySList
tdi.sys
TdiReturnChainedReceives
TdiMatchPdoWithChainedReceiveContext
TdiDeregisterPnPHandlers
TdiRegisterPnPHandlers
TdiCopyMdlToBuffer
TdiCopyBufferToMdl
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEAFD Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESAN Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ