Static task
static1
Behavioral task
behavioral1
Sample
5f9ab0f111e536857410f1a1d7f8324b1a90bed14abdc7ac4db07d469edfa5b2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5f9ab0f111e536857410f1a1d7f8324b1a90bed14abdc7ac4db07d469edfa5b2.exe
Resource
win10v2004-20220901-en
General
-
Target
5f9ab0f111e536857410f1a1d7f8324b1a90bed14abdc7ac4db07d469edfa5b2
-
Size
914KB
-
MD5
c1941c69b14b1563524f009785c9b678
-
SHA1
c067000e876ed7af2c7efa6ce9da8d0b83de5311
-
SHA256
5f9ab0f111e536857410f1a1d7f8324b1a90bed14abdc7ac4db07d469edfa5b2
-
SHA512
6668a5b00bf0ca0e3278fbc629c200d65085a0b2e9d8ab169b30c48bfc2c868e9d77b68208dbf0a133f8847c27da75847ff3b450cac14307002ccdb80dc10740
-
SSDEEP
12288:IHw5jSoveo/+YqiMXIRfm5PgAoB4TqEmvyhhUvogdpMi74zxLqit:ow5tvMv0fmJuKOsUvoapkd+E
Malware Config
Signatures
Files
-
5f9ab0f111e536857410f1a1d7f8324b1a90bed14abdc7ac4db07d469edfa5b2.exe windows x86
4b187c8ee42322f66087556f1696c13f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadFile
MapUserPhysicalPagesScatter
GetNumberFormatA
GetTapeStatus
GetCurrentThread
MultiByteToWideChar
SetLocaleInfoW
QueryInformationJobObject
OpenJobObjectA
GetPrivateProfileSectionNamesA
CreateFileMappingW
GetProfileSectionW
GetNamedPipeHandleStateA
GetAtomNameW
SetCalendarInfoW
GetNamedPipeHandleStateW
GetLocaleInfoA
SetWaitableTimer
SetVolumeMountPointA
GetWindowsDirectoryW
GetDateFormatA
GetSystemWindowsDirectoryA
ProcessIdToSessionId
CopyFileA
CreateJobObjectW
FindFirstFileExA
GetCurrencyFormatA
SetProcessAffinityMask
DefineDosDeviceW
SetTapeParameters
GetPrivateProfileStructW
GetEnvironmentStrings
VerifyVersionInfoW
CreateFileMappingA
AreFileApisANSI
SetConsoleTextAttribute
GetProcessAffinityMask
GetCompressedFileSizeA
DosDateTimeToFileTime
GetMailslotInfo
ReadDirectoryChangesW
PostQueuedCompletionStatus
GetPrivateProfileSectionNamesW
CreateWaitableTimerW
SetMailslotInfo
GetLogicalDriveStringsA
GetThreadContext
AddAtomW
GetConsoleAliasA
Module32NextW
GetConsoleAliasExesW
GetUserDefaultLangID
GetCPInfo
CreateNamedPipeA
FlushConsoleInputBuffer
ReplaceFileW
DeleteVolumeMountPointA
GetProfileStringA
OpenSemaphoreW
GetLogicalDriveStringsW
CreateSemaphoreW
GetProcessWorkingSetSize
EnumCalendarInfoW
OpenSemaphoreA
GetConsoleAliasExesA
ResetWriteWatch
OpenEventA
GetLocaleInfoW
GetCalendarInfoA
PrepareTape
GetDiskFreeSpaceExW
CopyFileExW
DeleteTimerQueue
CreateFileW
GetDiskFreeSpaceExA
GetProcessIoCounters
Module32FirstW
GetStringTypeA
MoveFileWithProgressW
FindFirstVolumeW
GetModuleFileNameA
FlushInstructionCache
GetTempPathA
GetSystemDirectoryW
GetTempPathW
GetFileAttributesW
SetInformationJobObject
ResetEvent
GetConsoleAliasExesLengthW
GetModuleFileNameW
GetTimeFormatA
GetStdHandle
SetComputerNameExW
SetFileAttributesA
SetConsoleDisplayMode
OpenJobObjectW
GetConsoleAliasW
GetVersion
GetPrivateProfileSectionW
GetModuleHandleW
FormatMessageW
GetBinaryTypeW
GetSystemDefaultLangID
CopyFileExA
OpenMutexA
GetSystemWindowsDirectoryW
GetConsoleWindow
OpenMutexW
ContinueDebugEvent
GetProcessPriorityBoost
EnumCalendarInfoA
FreeConsole
CreateToolhelp32Snapshot
SetFileTime
OpenEventW
CreateMutexA
CreateDirectoryA
AssignProcessToJobObject
GetSystemDefaultLCID
CreateEventA
CreateSemaphoreA
GetNumberFormatW
FindResourceExA
SetProcessPriorityBoost
CreateHardLinkW
LoadResource
SetEvent
GetCompressedFileSizeW
GetEnvironmentVariableA
GetProfileStringW
SetNamedPipeHandleState
GetAtomNameA
FlushFileBuffers
GetConsoleAliasesW
DefineDosDeviceA
MapViewOfFile
GetDevicePowerState
GetProfileSectionA
GetUserDefaultLCID
GetFileAttributesExW
GetDriveTypeW
GetFileTime
GetVolumeInformationW
GetEnvironmentVariableW
GetPrivateProfileStructA
GetProcessTimes
GetOEMCP
SetThreadContext
GetPriorityClass
SetFileAttributesW
SetConsoleCP
FreeUserPhysicalPages
GetConsoleCP
GetUserDefaultUILanguage
SetThreadAffinityMask
GetCalendarInfoW
LCMapStringA
SetPriorityClass
FlushViewOfFile
GetProcessVersion
GetDriveTypeA
CreateHardLinkA
OpenProcess
GetShortPathNameW
GetProfileIntA
CreateIoCompletionPort
CreateMailslotW
AddAtomA
GetTimeFormatW
GetVolumeNameForVolumeMountPointA
DeleteTimerQueueTimer
FoldStringA
SetThreadIdealProcessor
CreateTapePartition
GetFileAttributesA
GetNamedPipeInfo
GetBinaryTypeA
GetACP
SwitchToThread
FindFirstVolumeA
GetConsoleAliasesA
GetLogicalDrives
CreateJobObjectA
FindResourceW
GetStringTypeExW
FormatMessageA
ChangeTimerQueueTimer
ReleaseMutex
SetTapePosition
IsDBCSLeadByteEx
GetCPInfoExW
PeekNamedPipe
SetThreadLocale
SetSystemTimeAdjustment
GetFileSize
SetProcessWorkingSetSize
GetFullPathNameW
GetLongPathNameW
GetPrivateProfileIntA
GetFileAttributesExA
GetDiskFreeSpaceW
MoveFileWithProgressA
GetShortPathNameA
Toolhelp32ReadProcessMemory
SetLocaleInfoA
GetFullPathNameA
Module32Next
GetCPInfoExA
GetCurrentConsoleFont
GetThreadTimes
DnsHostnameToComputerNameW
SetConsoleCtrlHandler
SetCalendarInfoA
FindFirstFileA
SetConsoleActiveScreenBuffer
DeleteTimerQueueEx
GetThreadPriority
FindResourceA
FindNextChangeNotification
SetUnhandledExceptionFilter
CompareStringW
GetStringTypeW
SetConsoleOutputCP
GetPrivateProfileStringW
GetCurrentDirectoryA
EraseTape
GetConsoleOutputCP
SetComputerNameExA
GetWindowsDirectoryA
WideCharToMultiByte
GetConsoleCursorInfo
GetProfileIntW
EnumCalendarInfoExW
ConvertThreadToFiber
OpenFileMappingA
IsSystemResumeAutomatic
SetConsoleMode
GetModuleHandleA
ConvertDefaultLocale
GetConsoleScreenBufferInfo
GetDiskFreeSpaceA
SetThreadPriorityBoost
CreateDirectoryW
GetPrivateProfileIntW
GetConsoleAliasExesLengthA
LCMapStringW
VirtualAlloc
GetLongPathNameA
SetThreadExecutionState
GetNumberOfConsoleInputEvents
GetFileType
GetCurrencyFormatW
DuplicateHandle
CreateMutexW
ExpandEnvironmentStringsA
CancelWaitableTimer
CreateEventW
HeapReAlloc
HeapAlloc
Module32First
BindIoCompletionCallback
GetProcAddress
DeleteAtom
OpenThread
DnsHostnameToComputerNameA
SetStdHandle
CreateTimerQueue
GetPrivateProfileStringA
ReplaceFileA
FindVolumeMountPointClose
CompareStringA
SetEndOfFile
CreateDirectoryExA
OpenFileMappingW
SetEnvironmentVariableA
GetSystemDefaultUILanguage
VerSetConditionMask
GetPrivateProfileSectionA
DeviceIoControl
GetStringTypeExA
GetThreadLocale
FindResourceExW
CreateMailslotA
OpenWaitableTimerW
GetCurrentProcess
CancelIo
OpenWaitableTimerA
FindVolumeClose
FreeEnvironmentStringsA
GetFileInformationByHandle
FindAtomW
IsValidCodePage
SetCurrentDirectoryA
GetHandleInformation
MapUserPhysicalPages
GetVolumePathNameA
SearchPathA
GetVolumePathNameW
GetDateFormatW
DisconnectNamedPipe
ReadProcessMemory
FoldStringW
MapViewOfFileEx
GetFileSizeEx
CreateDirectoryExW
GetVolumeInformationA
SetSystemPowerState
CopyFileW
SetHandleInformation
FreeEnvironmentStringsW
FindAtomA
CreateWaitableTimerA
ReleaseSemaphore
ExpandEnvironmentStringsW
GetSystemDirectoryA
SetErrorMode
GetConsoleMode
SetCurrentDirectoryW
SetThreadPriority
CreateNamedPipeW
EnumCalendarInfoExA
GetCommandLineA
HeapSetInformation
ExitProcess
DecodePointer
WriteFile
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
HeapFree
Sleep
RtlUnwind
HeapSize
IsProcessorFeaturePresent
user32
IsCharAlphaA
advapi32
RegQueryValueExW
AllocateAndInitializeSid
RegQueryValueExA
CloseServiceHandle
GetAclInformation
CryptAcquireContextA
GetLengthSid
AdjustTokenPrivileges
CryptGenRandom
CopySid
CheckTokenMembership
RegCreateKeyW
ChangeServiceConfigW
RegOpenKeyW
FreeSid
RegEnumKeyExA
RegEnumValueW
RegFlushKey
RegisterEventSourceW
OpenProcessToken
RegSetValueExA
GetSecurityDescriptorLength
LsaClose
IsValidSid
RegEnumValueA
GetUserNameW
AddAce
GetSecurityDescriptorSacl
RegCreateKeyExA
CryptGetHashParam
RegQueryInfoKeyA
OpenSCManagerA
SetEntriesInAclW
EqualSid
LsaOpenPolicy
RegCreateKeyExW
ImpersonateLoggedOnUser
GetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegDeleteKeyW
OpenThreadToken
RegDeleteValueA
CryptHashData
CryptAcquireContextW
AddAccessAllowedAce
RegOpenKeyExW
LsaQueryInformationPolicy
RegSetValueExW
SetSecurityDescriptorOwner
RegOpenKeyExA
RegOpenKeyA
SetThreadToken
GetSidSubAuthorityCount
StartServiceA
RegQueryValueW
GetTokenInformation
CryptCreateHash
DeregisterEventSource
GetSecurityDescriptorControl
LsaFreeMemory
RegCreateKeyA
Sections
.text Size: 315KB - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 567KB - Virtual size: 567KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 309KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ