Static task
static1
Behavioral task
behavioral1
Sample
b935d731d178e4fd9b966e6f58e12d05afca3f938a619fe475514fbe0915d6cf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b935d731d178e4fd9b966e6f58e12d05afca3f938a619fe475514fbe0915d6cf.exe
Resource
win10v2004-20220812-en
General
-
Target
b935d731d178e4fd9b966e6f58e12d05afca3f938a619fe475514fbe0915d6cf
-
Size
205KB
-
MD5
4b0d0a09cae6640b7e5d37e2e1b9999f
-
SHA1
b0e666654acc99cff5906c6e36162af072df7147
-
SHA256
b935d731d178e4fd9b966e6f58e12d05afca3f938a619fe475514fbe0915d6cf
-
SHA512
649d5943390bd7f298a40e9e154ce94de1f328d0f9b1139091c1446c36035d4991701b52b279692d3c41ca9bd5ed4feaf2f0ae8720bbd4304f913c4c598834c3
-
SSDEEP
3072:3f7K+1triC6uzGx77abgW9Frz08q2VbXAtD8xZeJMlmAv4/qoymEP26Zn3tXdV5J:3zPtrigz1TlXAdimXqoPZ6Zn3J5iLtO
Malware Config
Signatures
Files
-
b935d731d178e4fd9b966e6f58e12d05afca3f938a619fe475514fbe0915d6cf.exe windows x64
57cd6a9f000d94366527da7dc3e969a1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
PostMessageA
RegisterDeviceNotificationA
UnregisterDeviceNotification
SystemParametersInfoA
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
PostThreadMessageA
advapi32
StartServiceCtrlDispatcherA
RegQueryValueExA
RegisterEventSourceA
ReportEventA
ImpersonateLoggedOnUser
RevertToSelf
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
CreateProcessAsUserA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
DeleteService
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegSetValueExW
RegDeleteValueA
RegGetValueA
RegOpenKeyExA
RegDeleteKeyA
RegOpenCurrentUser
wtsapi32
WTSQueryUserToken
WTSEnumerateProcessesA
WTSQuerySessionInformationA
WTSFreeMemory
psapi
GetModuleBaseNameA
EnumProcessModules
userenv
UnloadUserProfile
LoadUserProfileA
powrprof
PowerGetActiveScheme
PowerSetActiveScheme
PowerWriteACValueIndex
PowerWriteDCValueIndex
PowerEnumerate
PowerSettingAccessCheck
PowerReadACValueIndex
PowerReadDCValueIndex
kernel32
SetEndOfFile
GetProcessHeap
CreateFileW
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
WriteFile
HeapReAlloc
GetTimeZoneInformation
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
VirtualAlloc
VirtualProtect
RaiseException
LoadLibraryW
LoadLibraryA
FreeLibrary
SetConsoleCtrlHandler
WriteConsoleW
SetStdHandle
InitializeCriticalSectionAndSpinCount
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeFormatA
lstrcmpiA
WaitForSingleObject
MapViewOfFile
CreateFileMappingA
OpenProcess
GetLastError
GetModuleFileNameA
WTSGetActiveConsoleSessionId
OutputDebugStringA
GetLocalTime
CloseHandle
Sleep
GetVersionExA
GetSystemDirectoryA
CreateProcessA
CreateMutexA
OpenMutexA
ReleaseMutex
CreateEventA
OpenEventA
WaitForMultipleObjects
SetEvent
ResetEvent
CreateThread
SetThreadPriority
CreateNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
ReadFile
FlushFileBuffers
CreateFileA
LocalFree
GetCommandLineA
GetVersionExW
HeapAlloc
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetCPInfo
GetACP
GetOEMCP
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetCurrentThreadId
GetCurrentThread
FlsAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
FatalAppExitA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetProcAddress
GetModuleHandleW
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetDateFormatA
Sections
.text Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�7 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ