372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85

Sharing

Copy URL Twitter E-mail

General

Target
372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85
Size 3.5MB
Sample221029-rdms8aaad6
SHA256 372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85
MD5 24629ece9cd7382f51684c7eedef355d
SHA1 48431b63b6abf79d05bc729bfb61852e119c1714
SHA512 7794f7ca424e856fcc12e7a08bd93e444d591a09200010caf85d2bf1be097258e0a2aa47d1f3d2e831c2e23c989c6ee10ff9f4bce4f191648a7fe76037bed3ba
SSDEEP 49152:1bSO/Zb2GmSUMrVYrrNheDzuKGTsztBsapHQLTSjNQeb35pnoQcSlsKUF+ikZ:EuZK8f+vNOmT0psSpppUKUg9Z
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85

.exe 3.5MB

372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85

IMPHASH 05246353d6cf4248f77eb02661a658d0
SHA256 372b18086703b41341808ccbf0be39c92096c8b6da75d1d471b1ebe995f7ab85
MD5 24629ece9cd7382f51684c7eedef355d
SHA1 48431b63b6abf79d05bc729bfb61852e119c1714
SHA512 7794f7ca424e856fcc12e7a08bd93e444d591a09200010caf85d2bf1be097258e0a2aa47d1f3d2e831c2e23c989c6ee10ff9f4bce4f191648a7fe76037bed3ba
SSDEEP 49152:1bSO/Zb2GmSUMrVYrrNheDzuKGTsztBsapHQLTSjNQeb35pnoQcSlsKUF+ikZ:EuZK8f+vNOmT0psSpppUKUg9Z
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

39069

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

AnimatePalette

mpr

WNetAddConnection3A WNetGetConnectionA WNetGetUniversalNameW WNetCancelConnection2A WNetGetLastErrorA WNetCancelConnection2W WNetDisconnectDialog WNetAddConnectionA WNetAddConnection3W WNetCancelConnectionW

msvcrt

_except_handler3

advapi32

LookupPrivilegeNameA IsValidSid LsaDeleteTrustedDomain GetSecurityDescriptorControl LsaSetTrustedDomainInformation CopySid SetFileSecurityW SetTokenInformation RegConnectRegistryA AreAllAccessesGranted QueryServiceObjectSecurity ObjectCloseAuditAlarmW GetTokenInformation QueryServiceLockStatusA ReadEventLogW RegisterServiceCtrlHandlerA CreateServiceA GetSecurityDescriptorLength EncryptFileW LogonUserA StartServiceA CloseEventLog OpenEventLogA GetFileSecurityW AbortSystemShutdownW DuplicateToken EncryptFileA OpenSCManagerA LookupAccountNameW LsaQueryInformationPolicy FindFirstFreeAce EqualPrefixSid BuildImpersonateExplicitAccessWithNameA LookupPrivilegeDisplayNameW GetEffectiveRightsFromAclA ChangeServiceConfigW QueryServiceConfig2A StartServiceCtrlDispatcherA EnumServicesStatusA ObjectPrivilegeAuditAlarmA GetTrusteeNameW AdjustTokenGroups ObjectCloseAuditAlarmA RegEnumValueA RegOpenKeyW SetServiceStatus RegQueryInfoKeyW DecryptFileA LookupPrivilegeValueA RegEnumKeyW LogonUserW GetSidLengthRequired GetKernelObjectSecurity ReportEventA SetSecurityDescriptorOwner AddAce StartServiceW IsValidAcl OpenServiceW GetAclInformation RegQueryValueA GetSecurityDescriptorGroup AccessCheck BuildImpersonateTrusteeA RegLoadKeyW SetNamedSecurityInfoA BuildImpersonateExplicitAccessWithNameW LsaSetTrustedDomainInfoByName CloseServiceHandle GetUserNameW AllocateLocallyUniqueId RegUnLoadKeyW IsTokenRestricted SetSecurityDescriptorSacl LsaEnumerateTrustedDomainsEx ReadEventLogA GetFileSecurityA LsaQueryTrustedDomainInfoByName LsaEnumerateTrustedDomains InitiateSystemShutdownA PrivilegedServiceAuditAlarmA AddAccessAllowedAce RegLoadKeyA RegNotifyChangeKeyValue RegUnLoadKeyA BuildExplicitAccessWithNameA RegDeleteKeyW AddAccessDeniedAce LookupAccountNameA BackupEventLogA LsaRetrievePrivateData BuildTrusteeWithNameA ChangeServiceConfig2A GetServiceDisplayNameA GetTrusteeTypeA SetFileSecurityA NotifyChangeEventLog SetAclInformation InitializeAcl OpenBackupEventLogA LsaEnumerateAccountsWithUserRight ObjectOpenAuditAlarmW OpenProcessToken QueryServiceConfigA LsaClose RevertToSelf GetNumberOfEventLogRecords CreateRestrictedToken GetServiceKeyNameW MapGenericMask GetEffectiveRightsFromAclW InitializeSecurityDescriptor BuildImpersonateTrusteeW RegEnumKeyExW LookupAccountSidW RegGetKeySecurity CreateProcessAsUserA SetKernelObjectSecurity GetMultipleTrusteeA LookupPrivilegeDisplayNameA RegQueryInfoKeyA GetAce RegEnumValueW DuplicateTokenEx LsaSetInformationPolicy SetServiceObjectSecurity DecryptFileW EnumDependentServicesW SetThreadToken GetPrivateObjectSecurity UnlockServiceDatabase GetSidSubAuthorityCount GetNamedSecurityInfoW GetSecurityDescriptorSacl GetAuditedPermissionsFromAclW PrivilegeCheck DeregisterEventSource ChangeServiceConfigA SetEntriesInAclA RegOpenKeyA ImpersonateLoggedOnUser GetSecurityDescriptorDacl GetSidSubAuthority GetServiceKeyNameA MakeSelfRelativeSD RegSaveKeyA CreateProcessAsUserW RegDeleteValueW GetMultipleTrusteeW GetSidIdentifierAuthority LsaLookupSids LsaFreeMemory EnumServicesStatusW RegDeleteValueA SetSecurityInfo AllocateAndInitializeSid OpenEventLogW RegCreateKeyExA GetNamedSecurityInfoA GetAuditedPermissionsFromAclA RegQueryValueExW GetServiceDisplayNameW RegDeleteKeyA RegisterServiceCtrlHandlerW SetEntriesInAclW LookupSecurityDescriptorPartsA EnumDependentServicesA LsaNtStatusToWinError ControlService GetExplicitEntriesFromAclA CreatePrivateObjectSecurity LsaLookupNames GetOldestEventLogRecord QueryServiceConfigW LsaEnumerateAccountRights RegCreateKeyW BackupEventLogW LsaRemoveAccountRights OpenServiceA RegEnumKeyA AreAnyAccessesGranted PrivilegedServiceAuditAlarmW BuildTrusteeWithNameW MakeAbsoluteSD GetTrusteeFormA RegSetKeySecurity RegCreateKeyA GetLengthSid QueryServiceLockStatusW RegCloseKey BuildTrusteeWithSidA EqualSid LookupAccountSidA RegReplaceKeyW RegisterEventSourceW LsaOpenPolicy GetSecurityInfo FreeSid BuildTrusteeWithSidW AddAuditAccessAce IsTextUnicode GetSecurityDescriptorOwner OpenSCManagerW StartServiceCtrlDispatcherW ObjectDeleteAuditAlarmW

user32

GetProcessWindowStation

wininet

CreateUrlCacheGroup

kernel32

GetWindowsDirectoryA GetConsoleCursorInfo AddAtomA GetThreadLocale

imm32

ImmGetProperty ImmSetConversionStatus

pdh

PdhValidatePathA