Static task
static1
Behavioral task
behavioral1
Sample
e1b7e7da1c744901d9d7f67cfde942750d3c6ed8e5d3951ec477f86f027ad5e8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e1b7e7da1c744901d9d7f67cfde942750d3c6ed8e5d3951ec477f86f027ad5e8.exe
Resource
win10v2004-20220812-en
General
-
Target
e1b7e7da1c744901d9d7f67cfde942750d3c6ed8e5d3951ec477f86f027ad5e8
-
Size
220KB
-
MD5
963ba311a5caba8adf679ae617af5b99
-
SHA1
33b93fdb0b5062e8337618843bdfb02508d3379e
-
SHA256
e1b7e7da1c744901d9d7f67cfde942750d3c6ed8e5d3951ec477f86f027ad5e8
-
SHA512
451a3c8e52b0c391e4a534f0de3d7083e842abc76d43dce8fe740bf20daa34204b2224e66104f83990d7c409cd4f131b0409265ba55dbdc990e4d7a113060cae
-
SSDEEP
3072:zRwpI4pBnIj6wf/6DSR19n3G7OCY3Loakyh8R805v778Bfcn46:zRSjpBIjj6S93G7Of0f75vEg46
Malware Config
Signatures
Files
-
e1b7e7da1c744901d9d7f67cfde942750d3c6ed8e5d3951ec477f86f027ad5e8.exe windows x86
68dd5096df07f5a8b004cf8ad2d4ac0d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
KeWaitForSingleObject
KeReleaseSemaphore
MmBuildMdlForNonPagedPool
IoSetIoPriorityHint
ExFreePoolWithTag
IoFreeMdl
IoAllocateIrp
IoAllocateMdl
ExAllocatePoolWithTag
IoFreeIrp
RtlCompareMemory
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
RtlQueryRegistryValues
memset
ZwCreateKey
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableFullAvl
RtlLookupElementGenericTableFullAvl
RtlStringFromGUID
memcpy
ObfDereferenceObject
ExQueueWorkItem
IofCompleteRequest
IofCallDriver
_allshr
KeSetEvent
ZwQueryVolumeInformationFile
ZwFsControlFile
_allmul
_alldiv
ZwQueryInformationFile
ZwSetInformationFile
IoDeleteSymbolicLink
IoGetIoPriorityHint
MmMapLockedPagesSpecifyCache
IoFileObjectType
RtlGetAce
RtlEqualSid
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
ZwQuerySecurityObject
KeQueryTimeIncrement
ZwOpenFile
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoReleaseCancelSpinLock
KeResetEvent
IoAcquireCancelSpinLock
RtlAppendUnicodeStringToString
RtlCreateSystemVolumeInformationFolder
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlCreateSecurityDescriptor
ZwReadFile
KeReleaseMutex
RtlEnumerateGenericTableAvl
RtlFindNextForwardRunClear
RtlInitializeBitMap
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAccessCheck
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
MmLockPagableDataSection
MmUnlockPages
ZwUnmapViewOfSection
RtlEqualUnicodeString
RtlClearBits
IoBuildPartialMdl
ObfReferenceObject
KeTickCount
IoGetDeviceObjectPointer
ZwSetValueKey
KeGetCurrentThread
KeQuerySystemTime
EtwWrite
EtwEventEnabled
PsGetThreadId
KeCancelTimer
KeSetTimer
ExReInitializeRundownProtectionCacheAware
ExWaitForRundownProtectionReleaseCacheAware
ExReleaseRundownProtectionCacheAware
PoCallDriver
PoStartNextPowerIrp
ExAcquireRundownProtectionCacheAware
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
memmove
IoVolumeDeviceToDosName
ZwWaitForSingleObject
ZwOpenEvent
IoStopTimer
ExAllocatePoolWithTagPriority
KeReadStateEvent
MmProbeAndLockPages
ZwMapViewOfSection
ZwCreateSection
IoGetAttachedDeviceReference
ZwCreateFile
IoBuildSynchronousFsdRequest
IoInvalidateDeviceRelations
FsRtlIsTotalDeviceFailure
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
PsTerminateSystemThread
KeSetPriorityThread
ZwSetInformationThread
PsCreateSystemThread
IoDetachDevice
IoInitializeTimer
ExUuidCreate
KeInitializeDpc
KeInitializeTimer
ExInitializeRundownProtectionCacheAware
KeInitializeSemaphore
IoAttachDeviceToDeviceStack
IoDeleteDevice
IoGetDriverObjectExtension
IoCreateDevice
ExSizeOfRundownProtectionCacheAware
IoStartTimer
RtlSetBits
_allrem
KeLeaveCriticalRegion
KeEnterCriticalRegion
ObReleaseObjectSecurity
ObSetSecurityObjectByPointer
ObGetObjectSecurity
RtlInitializeGenericTableAvl
IoCreateSymbolicLink
RtlGUIDFromString
ZwQueryDirectoryFile
IoForwardIrpSynchronously
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
IoGetDeviceProperty
IoUnregisterPlugPlayNotification
IoRegisterPlugPlayNotification
PsSetThreadHardErrorsAreDisabled
PsGetThreadHardErrorsAreDisabled
ZwDuplicateObject
PoRegisterPowerSettingCallback
EtwRegister
KeInitializeMutex
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
IoRegisterBootDriverReinitialization
IoRegisterDriverReinitialization
IoAllocateDriverObjectExtension
RtlClearBit
RtlSetBit
RtlNumberOfSetBits
RtlAreBitsClear
RtlAreBitsSet
KeBugCheckEx
RtlUnwind
InterlockedPushEntrySList
PsGetThreadProcessId
InterlockedPopEntrySList
_aulldvrm
RtlAnsiCharToUnicodeChar
DbgPrint
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGELK Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ