Static task
static1
Behavioral task
behavioral1
Sample
f3c9781d2a5421ae0453b3173e0ce2bb295c3fac22d56bc6ff3e6856463da51b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f3c9781d2a5421ae0453b3173e0ce2bb295c3fac22d56bc6ff3e6856463da51b.exe
Resource
win10v2004-20220812-en
General
-
Target
f3c9781d2a5421ae0453b3173e0ce2bb295c3fac22d56bc6ff3e6856463da51b
-
Size
281KB
-
MD5
96d4485c23ab3ab4c0e0ada6ca4a6c77
-
SHA1
8a2fd8fbe9232671093d72a4eefb12dc4e486655
-
SHA256
f3c9781d2a5421ae0453b3173e0ce2bb295c3fac22d56bc6ff3e6856463da51b
-
SHA512
7a3b6207f27932bda2a94b3bed1ca573fdca807f80f39c31ab43631d983621005a034b6ca0a32d52fce642c11ecc06c3f2116684a4fa7127be7f068b4d633610
-
SSDEEP
6144:dgE7h5S+qd/We7cVbJp+KCbbselPutzXj:Z7TS+qse7cVbJpgskWt
Malware Config
Signatures
Files
-
f3c9781d2a5421ae0453b3173e0ce2bb295c3fac22d56bc6ff3e6856463da51b.exe windows x86
848c8ece7e558fdc33ff9442b8c1fa1f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCreateKeyExW
RegCreateKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyW
RegEnumValueW
RegFlushKey
kernel32
HeapSize
RaiseException
ExpandEnvironmentStringsW
ReadProcessMemory
HeapSetInformation
SetProcessShutdownParameters
GetCommandLineW
LocalFree
HeapCreate
GetVersionExW
GetSystemInfo
HeapAlloc
GetCurrentProcessId
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
GetCommandLineA
GetVersionExA
GetStartupInfoA
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
OutputDebugStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
CreateMutexW
EnterCriticalSection
FreeLibrary
InterlockedExchange
LoadLibraryExA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
Sleep
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualProtect
VirtualQuery
CreateFileA
FlushFileBuffers
LocalAlloc
InterlockedCompareExchange
CreateEventW
SetEvent
ResetEvent
WaitForSingleObject
WaitForMultipleObjects
CreateSemaphoreW
ReleaseSemaphore
CreateThread
GetModuleHandleExW
SwitchToThread
OpenThread
LoadLibraryW
FreeLibraryAndExitThread
lstrcmpiW
GetProcessId
GetExitCodeProcess
OpenProcess
OpenEventW
lstrcmpW
CancelIo
GetOverlappedResult
WaitForSingleObjectEx
QueueUserAPC
ReadFileEx
GlobalAddAtomW
GlobalDeleteAtom
GetLastError
CompareStringW
CloseHandle
LeaveCriticalSection
atl
ord16
ord21
ntdll
RtlMultiByteToUnicodeN
RtlCopyLuid
NtQueryInformationProcess
NtClose
RtlUnwind
NtOpenProcessToken
NtQueryInformationToken
NtQuerySystemInformation
shell32
ShellExecuteExW
CommandLineToArgvW
SHGetKnownFolderPath
ole32
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoUninitialize
wtsapi32
WTSFreeMemory
WTSVirtualChannelClose
WTSVirtualChannelQuery
WTSVirtualChannelOpen
WTSLogoffSession
WTSQuerySessionInformationW
gdi32
DeleteObject
DeleteDC
ExtEscape
CreateDCW
GetObjectW
CreateCompatibleDC
SelectObject
GetDIBits
GetRegionData
CreateRectRgn
user32
CreateWindowExW
MessageBoxW
LoadStringW
LockWorkStation
SystemParametersInfoW
SetWindowLongW
GetWindowLongW
LoadCursorW
SwapMouseButton
UnhookWinEvent
CloseDesktop
GetUserObjectInformationW
OpenInputDesktop
SetWinEventHook
SetThreadDesktop
OpenDesktopW
GetWindow
GetClassNameW
GetDesktopWindow
GetParent
IsWindowVisible
IsWindow
RedrawWindow
PostMessageW
GetWindowThreadProcessId
UnregisterClassW
GetClassLongW
SendMessageTimeoutW
GetWindowInfo
GetAncestor
GetWindowRgn
GetWindowRgnBox
EnumThreadWindows
GetGUIThreadInfo
GetCursorPos
GetSystemMetrics
MoveWindow
EnumDisplayDevicesW
PostThreadMessageW
RegisterHotKey
UnregisterHotKey
SendInput
MapVirtualKeyW
GetAsyncKeyState
GetClassInfoExW
GetIconInfo
CopyImage
DestroyIcon
RegisterClassExW
DefWindowProcW
EnumWindows
MsgWaitForMultipleObjectsEx
DispatchMessageW
PeekMessageW
DestroyWindow
GetWindowRect
SetForegroundWindow
winsta
WinStationFreePropertyValue
WinStationGetConnectionProperty
WinStationQueryInformationW
WinStationVerify
WinStationVirtualOpenEx
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExW
NdrClientCall2
I_RpcExceptionFilter
shlwapi
PathUnquoteSpacesW
Sections
.text Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yuckkam Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE