ServiceMain
karl
mad
Behavioral task
behavioral1
Sample
6ceeb1ed827c69d3f0370a9eeca7428be6e1fedbc27fe29f772eb6028d152319.dll
Resource
win7-20220812-en
Target
6ceeb1ed827c69d3f0370a9eeca7428be6e1fedbc27fe29f772eb6028d152319
Size
94KB
MD5
8272ad4deed4311565a04ca13e26d8c6
SHA1
154263be6e150d8565b3db7e7d24fc30a93f9e60
SHA256
6ceeb1ed827c69d3f0370a9eeca7428be6e1fedbc27fe29f772eb6028d152319
SHA512
4350de006bfc2d8c6ed77a096f6a0545a159c59b67e2864c59f0826322d5327a485b6054b4fed5cc7589b83a70385510d94c518ddaf106c67bc9a0cab1b293ae
SSDEEP
1536:FPU/q1TDnXo7vRAI9k1Lcd/nRLie+ccSpJfDJAp2ycnSr6hK:FPU/qxXo7iI9uLcxUe+nSpJDJA7cnS2h
resource | yara_rule |
---|---|
sample | family_gh0strat |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
UnmapViewOfFile
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
TerminateProcess
WaitForMultipleObjects
GetStartupInfoA
CreatePipe
VirtualAllocEx
GetLocalTime
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
GetTickCount
MoveFileExA
PeekNamedPipe
OpenProcess
GetSystemDirectoryA
SetLastError
GetModuleFileNameA
MoveFileA
ReadFile
GetFileSize
RemoveDirectoryA
LocalAlloc
LocalReAlloc
FindNextFileA
LocalFree
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
SetFilePointer
WriteFile
CreateFileA
FindFirstFileA
FindClose
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
lstrcpyA
ResetEvent
Sleep
CancelIo
InterlockedExchange
DeleteCriticalSection
InitializeCriticalSection
VirtualAlloc
VirtualFree
EnterCriticalSection
LeaveCriticalSection
CreateThread
ResumeThread
TerminateThread
CloseHandle
WaitForSingleObject
CreateEventA
SetEvent
DisconnectNamedPipe
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SendMessageA
SystemParametersInfoA
SetRect
MapVirtualKeyA
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
ExitWindowsEx
GetWindowThreadProcessId
IsWindow
BlockInput
GetDC
keybd_event
GetSystemMetrics
DispatchMessageA
GetKeyNameTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
LoadCursorA
GetClipboardData
DestroyCursor
TranslateMessage
GetMessageA
wsprintfA
CharNextA
GetWindowTextA
GetActiveWindow
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
EnumWindows
IsWindowVisible
DeleteDC
CreateCompatibleDC
GetDIBits
CreateDIBSection
BitBlt
DeleteObject
SelectObject
CreateCompatibleBitmap
LookupAccountNameA
IsValidSid
GetTokenInformation
LookupAccountSidA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegEnumKeyExA
RegEnumValueA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
LsaFreeMemory
RegCloseKey
RegQueryValueA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
SHGetSpecialFolderPathA
SHGetFileInfoA
SHDeleteKeyA
_strnicmp
_strcmpi
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcstombs
atoi
realloc
strncat
strncpy
strrchr
_except_handler3
free
malloc
strchr
_CxxThrowException
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
waveOutWrite
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveOutGetNumDevs
waveInOpen
waveInGetNumDevs
waveOutPrepareHeader
waveOutClose
waveOutOpen
gethostname
select
recv
setsockopt
send
WSAStartup
WSACleanup
WSAIoctl
connect
htons
gethostbyname
socket
getsockname
ntohs
closesocket
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
capGetDriverDescriptionA
capCreateCaptureWindowA
ICSeqCompressFrame
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
GetModuleFileNameExA
EnumProcessModules
WTSFreeMemory
WTSQuerySessionInformationA
ServiceMain
karl
mad
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ