Static task
static1
Behavioral task
behavioral1
Sample
b29be98b63b422e146d5fd5d0a47be9f46fb5394508a4ab9fab6010b3ab89233.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b29be98b63b422e146d5fd5d0a47be9f46fb5394508a4ab9fab6010b3ab89233.exe
Resource
win10v2004-20220812-en
General
-
Target
b29be98b63b422e146d5fd5d0a47be9f46fb5394508a4ab9fab6010b3ab89233
-
Size
122KB
-
MD5
81e1384b491a5235ee244a1fa7c7e993
-
SHA1
fe985a8103fb2bf5ff92bebbec1dafcf8efe7406
-
SHA256
b29be98b63b422e146d5fd5d0a47be9f46fb5394508a4ab9fab6010b3ab89233
-
SHA512
35f6cb5310227978a50ebf139186413daed5937604bc4cb8f27a6635250545fa95a37bc51754e8e8c758aff08cd2b88462df7f2c05714f15bd608aa728b5da00
-
SSDEEP
3072:1hdvNbNxPAPY23YB/y0sNfVkwT1nvVyA:9RDmY2oB/y0sNphnvV
Malware Config
Signatures
Files
-
b29be98b63b422e146d5fd5d0a47be9f46fb5394508a4ab9fab6010b3ab89233.exe windows x86
3bd9ebbaa28f067d72f14003863c2b19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
HalExamineMBR
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
ObfDereferenceObject
KeQuerySystemTime
ExUuidCreate
_allshr
_allmul
memmove
RtlWriteRegistryValue
RtlQueryRegistryValues
RtlCompareMemory
DbgPrint
ObReferenceObjectByHandle
_purecall
RtlCompareUnicodeString
IoGetDeviceObjectPointer
RtlInitUnicodeString
swprintf
IoCreateSymbolicLink
IoDeleteSymbolicLink
IoRegisterDeviceInterface
IoWMIRegistrationControl
IofCompleteRequest
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAccessCheck
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
RtlDeleteRegistryValue
RtlCreateRegistryKey
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
KeReleaseSemaphore
IoReleaseCancelSpinLock
KeSetEvent
PoCallDriver
PoStartNextPowerIrp
PsTerminateSystemThread
ExQueueWorkItem
IoRegisterShutdownNotification
KeInitializeSemaphore
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
KeInitializeSpinLock
IoCreateDevice
PoRequestPowerIrp
PoSetPowerState
IoAcquireCancelSpinLock
IoReportTargetDeviceChangeAsynchronous
KeInitializeEvent
KeClearEvent
RtlStringFromGUID
IoSetSystemPartition
ZwClose
ZwFsControlFile
ZwOpenFile
IoInvalidateDeviceRelations
PsCreateSystemThread
RtlEqualUnicodeString
ObfReferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
RtlVolumeDeviceToDosName
KeBugCheckEx
IoGetBootDiskInformation
MmLockPagableDataSection
IoInvalidateDeviceState
IoSetDeviceInterfaceState
IoGetDeviceProperty
IoUnregisterShutdownNotification
_alldiv
IoRegisterDriverReinitialization
IoRegisterBootDriverReinitialization
RtlCopyUnicodeString
IoReportDetectedDevice
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoAllocateIrp
FsRtlIsTotalDeviceFailure
IoFreeIrp
IoReuseIrp
IoBuildPartialMdl
MmUnmapLockedPages
_allrem
_alldvrm
_allshl
MmMapLockedPages
IoRaiseInformationalHardError
KeGetCurrentThread
wcslen
ZwQueryValueKey
ZwOpenKey
ZwSetSecurityObject
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
_except_handler3
IoBuildSynchronousFsdRequest
IofCallDriver
KeWaitForSingleObject
strncmp
IoReadPartitionTableEx
ExFreePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGELK Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ