Static task
static1
Behavioral task
behavioral1
Sample
09adac2b946dde22a219f34c712201db607d62028c9d6018840bae4082ceaf35.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
09adac2b946dde22a219f34c712201db607d62028c9d6018840bae4082ceaf35.exe
Resource
win10v2004-20220812-en
General
-
Target
09adac2b946dde22a219f34c712201db607d62028c9d6018840bae4082ceaf35
-
Size
990KB
-
MD5
90ad3924648f3c5137a42d21fe1da740
-
SHA1
00ec550bf76bba774100d20d0c1d57b98ffcc5cc
-
SHA256
09adac2b946dde22a219f34c712201db607d62028c9d6018840bae4082ceaf35
-
SHA512
a9a5762eacea81572a7ff46c2c165f9a249e449015728593ae0737afff75571048b711b3c967237a4d5413c997d99f862667c3268f9efc0972c66c5e02911d32
-
SSDEEP
24576:4+lUbvS174jagLvTS1nDPu+0yX2g6gN8rRKZjerLFH:4+lUbvgMin6+DJuJrR
Malware Config
Signatures
Files
-
09adac2b946dde22a219f34c712201db607d62028c9d6018840bae4082ceaf35.exe windows x86
81c1e283361a75c0096409ed4e0de535
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
Imports
advapi32
RegCloseKey
RegCreateKeyExW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CredWriteW
RegDeleteTreeW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
CreateProcessAsUserW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
RegGetValueW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
RegSetValueExW
LookupAccountNameW
RegQueryValueExW
RegOpenKeyExW
RevertToSelf
EventWrite
EventUnregister
EventRegister
kernel32
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
CloseHandle
GetLocalTime
GetComputerNameW
WriteFile
GetCurrentProcessId
GetTickCount64
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
SetLastError
CreateDirectoryW
FindClose
FindFirstFileExW
GetFileAttributesExW
SetFileAttributesW
SetFilePointerEx
GetTickCount
FormatMessageW
WideCharToMultiByte
SetEvent
CreateEventW
IsProcessorFeaturePresent
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
WaitForSingleObject
CreateEventExW
TerminateProcess
GetCurrentThread
GetThreadIOPendingFlag
TryEnterCriticalSection
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
QueryDepthSList
SetWaitableTimerEx
CancelWaitableTimer
CreateWaitableTimerW
ReleaseMutex
WaitForMultipleObjectsEx
CreateMutexA
CreateEventA
OpenProcess
MapViewOfFile
UnmapViewOfFile
CreateSemaphoreA
CreateFileMappingA
QueryFullProcessImageNameW
WerRegisterMemoryBlock
TlsSetValue
CreateThread
GetProcessAffinityMask
ResetEvent
MulDiv
WaitForSingleObjectEx
CreateMemoryResourceNotification
FreeLibrary
LoadLibraryExW
IsSystemResumeAutomatic
GetSystemPowerStatus
ReleaseSemaphore
WaitForMultipleObjects
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
Sleep
RaiseException
TlsGetValue
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
HeapReAlloc
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
InterlockedIncrement
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
HeapSize
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InterlockedExchange
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
GetVersionExW
GetUserGeoID
GetSystemDefaultLCID
ExpandEnvironmentStringsW
GetDriveTypeW
GetLogicalDriveStringsW
QueryDosDeviceW
CreateMutexW
LocaleNameToLCID
K32GetProcessImageFileNameW
LocalFree
FreeConsole
AttachConsole
AllocConsole
GetShortPathNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetLocaleInfoEx
GetFileAttributesW
OutputDebugStringA
OpenThread
GetExitCodeThread
GetVersion
GetModuleHandleA
LoadLibraryA
MoveFileExW
LocalAlloc
GetTempPathW
GetStringTypeExW
GetOverlappedResult
DecodePointer
TlsFree
lstrcmpW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
TlsAlloc
GetTempPathA
DeleteFileA
LCIDToLocaleName
GetLongPathNameW
GetShortPathNameA
GetModuleFileNameA
RtlUnwind
SetEndOfFile
GetProcessHeap
SetUnhandledExceptionFilter
MultiByteToWideChar
RaiseFailFastException
GetModuleFileNameW
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
WerUnregisterMemoryBlock
VerSetConditionMask
GetDiskFreeSpaceExW
GetNativeSystemInfo
VerifyVersionInfoW
ProcessIdToSessionId
GetTempFileNameW
ReadFile
CopyFileW
GetFullPathNameW
GetExitCodeProcess
CreateProcessW
GetPriorityClass
K32EnumProcesses
K32GetModuleFileNameExW
GetCurrentDirectoryW
GlobalFree
ole32
StringFromIID
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoRevokeInitializeSpy
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoRegisterInitializeSpy
ws2_32
GetAddrInfoW
WSAStartup
FreeAddrInfoW
gdi32
CreateFontW
CreateSolidBrush
DeleteObject
GetDeviceCaps
GetStockObject
Rectangle
SelectObject
SetDCPenColor
GetTextMetricsW
GetTextExtentPoint32W
SetBkColor
SetDCBrushColor
SetTextColor
CreatePen
gdiplus
GdipDeleteBrush
GdipDrawImageRectI
GdipFillRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipAlloc
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStream
GdipCreateSolidFill
GdipCloneBrush
GdiplusStartup
GdipFree
rpcrt4
RpcBindingFromStringBindingW
RpcMgmtIsServerListening
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoW
RpcBindingFree
iphlpapi
FreeMibTable
CreateSortedAddressPairs
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
wintrust
WinVerifyTrust
cabinet
ord13
ord10
ord14
setupapi
SetupIterateCabinetW
Sections
.text Size: 745KB - Virtual size: 744KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 30KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 102KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE