Static task
static1
Behavioral task
behavioral1
Sample
26e2d2a3ebe434f5572962b785d510a9a4a79bc457765cf2b338a0ce73086832.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
26e2d2a3ebe434f5572962b785d510a9a4a79bc457765cf2b338a0ce73086832.exe
Resource
win10v2004-20220901-en
General
-
Target
26e2d2a3ebe434f5572962b785d510a9a4a79bc457765cf2b338a0ce73086832
-
Size
194KB
-
MD5
89672a88b663c35a3f6fc82ea1346729
-
SHA1
4405a89cde039436ae0ee51be607f500faa116d1
-
SHA256
26e2d2a3ebe434f5572962b785d510a9a4a79bc457765cf2b338a0ce73086832
-
SHA512
9550d85210c781b68bec6498194991972cefa7bc572b716340338a5b7c55be0cab2f58592e85a9b010e9ea6e830314ac1eb4b24340b7e05787b5db27b7784c80
-
SSDEEP
3072:IYPlMTYqTMT9JKvnHOZlx1OiaCw0f3GfqU/3zNyAylSqydLmlT:VIMJEcdaCnfWfqkMAy
Malware Config
Signatures
Files
-
26e2d2a3ebe434f5572962b785d510a9a4a79bc457765cf2b338a0ce73086832.exe windows x86
a53a02b997935fd8eedcb5f7abab9b9f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleInformation
advapi32
CloseServiceHandle
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
NotifyChangeEventLog
OpenEventLogA
GetNumberOfEventLogRecords
GetOldestEventLogRecord
ReadEventLogA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CreateServiceA
OpenSCManagerA
DeleteService
QueryServiceStatus
OpenServiceA
StartServiceA
ControlService
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegQueryValueExA
secur32
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
ws2_32
ntohl
ntohs
htonl
kernel32
ReadFile
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
DeleteFileA
GetModuleHandleA
OpenProcess
Sleep
SetConsoleCtrlHandler
GetCurrentDirectoryA
GetTempPathA
GetVersionExA
ProcessIdToSessionId
GetCurrentProcessId
GetModuleFileNameA
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
WaitForSingleObject
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
GetProcAddress
LoadLibraryA
GetCurrentProcess
TerminateProcess
MultiByteToWideChar
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
FreeResource
ResetEvent
GetLastError
CreateEventA
FreeLibrary
GetSystemWindowsDirectoryA
SetEvent
CreateThread
WriteFile
WaitNamedPipeA
DisconnectNamedPipe
FlushFileBuffers
ConnectNamedPipe
CreateNamedPipeA
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
IsBadReadPtr
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
EncodePointer
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
GetCommandLineA
HeapSetInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
RtlUnwind
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetModuleFileNameW
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
SetStdHandle
LCMapStringW
GetStringTypeW
Sections
.text Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ