Static task
static1
Behavioral task
behavioral1
Sample
1cbd51de2b7e6faf5a4956e4d91d11631629b014a251caf588938272be9b2544.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1cbd51de2b7e6faf5a4956e4d91d11631629b014a251caf588938272be9b2544.exe
Resource
win10v2004-20220812-en
General
-
Target
1cbd51de2b7e6faf5a4956e4d91d11631629b014a251caf588938272be9b2544
-
Size
698KB
-
MD5
80507a0e65141f07803df3809b5bc560
-
SHA1
bab7529c54ab5c9daf2270780fab6e426abdfc6a
-
SHA256
1cbd51de2b7e6faf5a4956e4d91d11631629b014a251caf588938272be9b2544
-
SHA512
9e2740c4693de267d69ef5b1813dcc57ded6aa09e59936948188c91c627b47346cdf5a4338ee4fe2f5720b7a148b34fd7725ae23db93eb78bb30425777bf802e
-
SSDEEP
12288:gczrokFXICTfnnUO6XJo5SI9Rvd3iCCPQqIXE5tmzIMWMcSzj37:gcHoMxnK+ScCCCQXE5ESMcSzb
Malware Config
Signatures
Files
-
1cbd51de2b7e6faf5a4956e4d91d11631629b014a251caf588938272be9b2544.exe windows x86
d424b51b322beca9c4207d7e270756b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
Imports
advapi32
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
SetThreadToken
RegSetValueExW
RegEnumValueW
RegQueryValueExW
RegNotifyChangeKeyValue
SetServiceStatus
StartServiceCtrlDispatcherW
DuplicateToken
GetUserNameA
RegDeleteValueW
RegisterServiceCtrlHandlerW
CryptGetHashParam
CryptDestroyHash
CryptCreateHash
CryptHashData
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
OpenThreadToken
RegDeleteKeyW
SetFileSecurityW
CryptAcquireContextW
CryptReleaseContext
kernel32
CloseHandle
SetEvent
GetLastError
GetModuleFileNameW
lstrlenW
GetDriveTypeW
GetLogicalDrives
lstrcmpW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitProcess
Sleep
InitializeCriticalSection
GetCommandLineW
GetTickCount
ReleaseMutex
ResetEvent
WaitForMultipleObjectsEx
SetErrorMode
CreateEventW
CreateMutexW
CreateProcessW
MoveFileExW
GetSystemInfo
CreateFileA
ReadFile
SetFilePointer
DosDateTimeToFileTime
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
WideCharToMultiByte
CreateFileW
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
WaitForMultipleObjects
CreateThread
VirtualFree
VirtualAlloc
SetFilePointerEx
GlobalFree
GlobalAlloc
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
CompareStringW
SystemTimeToFileTime
GetSystemTime
SetFileTime
SetEndOfFile
WriteFile
LocalFree
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FindClose
FindFirstFileW
GetFileSizeEx
GetFileAttributesW
GetTempPathW
CreateDirectoryW
GetCurrentThread
GetFileTime
FindNextFileW
GetStdHandle
GetFileAttributesExW
CopyFileW
CreateHardLinkW
SetFileAttributesW
DeleteFileW
GetTempPathA
RemoveDirectoryW
FormatMessageA
lstrlenA
GetComputerNameW
GetCommandLineA
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleW
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapReAlloc
RtlUnwind
GetLocaleInfoA
HeapSize
LCMapStringA
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetProcessHeap
rpcrt4
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
NdrServerCall2
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winhttp
WinHttpSetOption
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCreateUrl
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSendRequest
wintrust
WinVerifyTrust
userenv
LoadUserProfileA
UnloadUserProfile
Sections
.text Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 564KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE