Static task
static1
Behavioral task
behavioral1
Sample
372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85.exe
Resource
win7-20220812-en
General
-
Target
372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85
-
Size
3.5MB
-
MD5
24629ece9cd7382f51684c7eedef355d
-
SHA1
48431b63b6abf79d05bc729bfb61852e119c1714
-
SHA256
372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85
-
SHA512
7794f7ca424e856fcc12e7a08bd93e444d591a09200010caf85d2bf1be097258e0a2aa47d1f3d2e831c2e23c989c6ee10ff9f4bce4f191648a7fe76037bed3ba
-
SSDEEP
49152:1bSO/Zb2GmSUMrVYrrNheDzuKGTsztBsapHQLTSjNQeb35pnoQcSlsKUF+ikZ:EuZK8f+vNOmT0psSpppUKUg9Z
Malware Config
Signatures
Files
-
372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85.exe windows x86
05246353d6cf4248f77eb02661a658d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
AnimatePalette
mpr
WNetAddConnection3A
WNetGetConnectionA
WNetGetUniversalNameW
WNetCancelConnection2A
WNetGetLastErrorA
WNetCancelConnection2W
WNetDisconnectDialog
WNetAddConnectionA
WNetAddConnection3W
WNetCancelConnectionW
msvcrt
_except_handler3
advapi32
LookupPrivilegeNameA
IsValidSid
LsaDeleteTrustedDomain
GetSecurityDescriptorControl
LsaSetTrustedDomainInformation
CopySid
SetFileSecurityW
SetTokenInformation
RegConnectRegistryA
AreAllAccessesGranted
QueryServiceObjectSecurity
ObjectCloseAuditAlarmW
GetTokenInformation
QueryServiceLockStatusA
ReadEventLogW
RegisterServiceCtrlHandlerA
CreateServiceA
GetSecurityDescriptorLength
EncryptFileW
LogonUserA
StartServiceA
CloseEventLog
OpenEventLogA
GetFileSecurityW
AbortSystemShutdownW
DuplicateToken
EncryptFileA
OpenSCManagerA
LookupAccountNameW
LsaQueryInformationPolicy
FindFirstFreeAce
EqualPrefixSid
BuildImpersonateExplicitAccessWithNameA
LookupPrivilegeDisplayNameW
GetEffectiveRightsFromAclA
ChangeServiceConfigW
QueryServiceConfig2A
StartServiceCtrlDispatcherA
EnumServicesStatusA
ObjectPrivilegeAuditAlarmA
GetTrusteeNameW
AdjustTokenGroups
ObjectCloseAuditAlarmA
RegEnumValueA
RegOpenKeyW
SetServiceStatus
RegQueryInfoKeyW
DecryptFileA
LookupPrivilegeValueA
RegEnumKeyW
LogonUserW
GetSidLengthRequired
GetKernelObjectSecurity
ReportEventA
SetSecurityDescriptorOwner
AddAce
StartServiceW
IsValidAcl
OpenServiceW
GetAclInformation
RegQueryValueA
GetSecurityDescriptorGroup
AccessCheck
BuildImpersonateTrusteeA
RegLoadKeyW
SetNamedSecurityInfoA
BuildImpersonateExplicitAccessWithNameW
LsaSetTrustedDomainInfoByName
CloseServiceHandle
GetUserNameW
AllocateLocallyUniqueId
RegUnLoadKeyW
IsTokenRestricted
SetSecurityDescriptorSacl
LsaEnumerateTrustedDomainsEx
ReadEventLogA
GetFileSecurityA
LsaQueryTrustedDomainInfoByName
LsaEnumerateTrustedDomains
InitiateSystemShutdownA
PrivilegedServiceAuditAlarmA
AddAccessAllowedAce
RegLoadKeyA
RegNotifyChangeKeyValue
RegUnLoadKeyA
BuildExplicitAccessWithNameA
RegDeleteKeyW
AddAccessDeniedAce
LookupAccountNameA
BackupEventLogA
LsaRetrievePrivateData
BuildTrusteeWithNameA
ChangeServiceConfig2A
GetServiceDisplayNameA
GetTrusteeTypeA
SetFileSecurityA
NotifyChangeEventLog
SetAclInformation
InitializeAcl
OpenBackupEventLogA
LsaEnumerateAccountsWithUserRight
ObjectOpenAuditAlarmW
OpenProcessToken
QueryServiceConfigA
LsaClose
RevertToSelf
GetNumberOfEventLogRecords
CreateRestrictedToken
GetServiceKeyNameW
MapGenericMask
GetEffectiveRightsFromAclW
InitializeSecurityDescriptor
BuildImpersonateTrusteeW
RegEnumKeyExW
LookupAccountSidW
RegGetKeySecurity
CreateProcessAsUserA
SetKernelObjectSecurity
GetMultipleTrusteeA
LookupPrivilegeDisplayNameA
RegQueryInfoKeyA
GetAce
RegEnumValueW
DuplicateTokenEx
LsaSetInformationPolicy
SetServiceObjectSecurity
DecryptFileW
EnumDependentServicesW
SetThreadToken
GetPrivateObjectSecurity
UnlockServiceDatabase
GetSidSubAuthorityCount
GetNamedSecurityInfoW
GetSecurityDescriptorSacl
GetAuditedPermissionsFromAclW
PrivilegeCheck
DeregisterEventSource
ChangeServiceConfigA
SetEntriesInAclA
RegOpenKeyA
ImpersonateLoggedOnUser
GetSecurityDescriptorDacl
GetSidSubAuthority
GetServiceKeyNameA
MakeSelfRelativeSD
RegSaveKeyA
CreateProcessAsUserW
RegDeleteValueW
GetMultipleTrusteeW
GetSidIdentifierAuthority
LsaLookupSids
LsaFreeMemory
EnumServicesStatusW
RegDeleteValueA
SetSecurityInfo
AllocateAndInitializeSid
OpenEventLogW
RegCreateKeyExA
GetNamedSecurityInfoA
GetAuditedPermissionsFromAclA
RegQueryValueExW
GetServiceDisplayNameW
RegDeleteKeyA
RegisterServiceCtrlHandlerW
SetEntriesInAclW
LookupSecurityDescriptorPartsA
EnumDependentServicesA
LsaNtStatusToWinError
ControlService
GetExplicitEntriesFromAclA
CreatePrivateObjectSecurity
LsaLookupNames
GetOldestEventLogRecord
QueryServiceConfigW
LsaEnumerateAccountRights
RegCreateKeyW
BackupEventLogW
LsaRemoveAccountRights
OpenServiceA
RegEnumKeyA
AreAnyAccessesGranted
PrivilegedServiceAuditAlarmW
BuildTrusteeWithNameW
MakeAbsoluteSD
GetTrusteeFormA
RegSetKeySecurity
RegCreateKeyA
GetLengthSid
QueryServiceLockStatusW
RegCloseKey
BuildTrusteeWithSidA
EqualSid
LookupAccountSidA
RegReplaceKeyW
RegisterEventSourceW
LsaOpenPolicy
GetSecurityInfo
FreeSid
BuildTrusteeWithSidW
AddAuditAccessAce
IsTextUnicode
GetSecurityDescriptorOwner
OpenSCManagerW
StartServiceCtrlDispatcherW
ObjectDeleteAuditAlarmW
user32
GetProcessWindowStation
wininet
CreateUrlCacheGroup
kernel32
GetWindowsDirectoryA
GetConsoleCursorInfo
AddAtomA
GetThreadLocale
imm32
ImmGetProperty
ImmSetConversionStatus
pdh
PdhValidatePathA
Sections
.text Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ