Static task
static1
Behavioral task
behavioral1
Sample
513169c57f54299e1fc05b677e12cccdc752638bd3684ae0c2992c441174b8c2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
513169c57f54299e1fc05b677e12cccdc752638bd3684ae0c2992c441174b8c2.exe
Resource
win10v2004-20220812-en
General
-
Target
513169c57f54299e1fc05b677e12cccdc752638bd3684ae0c2992c441174b8c2
-
Size
1.9MB
-
MD5
6671d139c65f08a309f41703287409a4
-
SHA1
e94def6f8384999a6c994c4e26c52c13f458271c
-
SHA256
513169c57f54299e1fc05b677e12cccdc752638bd3684ae0c2992c441174b8c2
-
SHA512
201430e242d97dfd0855f1e5c26f84f859f0b06c4404d3168ed4acc4cf507e5af25e555019c151911b53f259e35434b674e2cfccea61390c20a6aea89d6542d0
-
SSDEEP
49152:dnvxzYd1xC0AtzdNVlitpUXpn2tPl+zO1HwmfJ:dnvxEd1xtm/ni7UXp2n+zh
Malware Config
Signatures
Files
-
513169c57f54299e1fc05b677e12cccdc752638bd3684ae0c2992c441174b8c2.exe windows x86
ece22a34ac1bc86cc9542739443abf9d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
MoveFileW
ExpandEnvironmentStringsW
SetLastError
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetProcAddress
MultiByteToWideChar
DeleteFiber
ConvertFiberToThread
FreeLibrary
LoadLibraryA
LoadLibraryW
WideCharToMultiByte
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
SetEndOfFile
HeapSize
WriteConsoleW
SetEnvironmentVariableW
GlobalFree
GlobalAlloc
LocalAlloc
GetCurrentProcess
GetLogicalDrives
CopyFileW
GetConsoleWindow
SetCurrentDirectoryW
CloseHandle
DeleteFileW
GetLastError
Sleep
SetFileAttributesW
ReleaseMutex
GetFileAttributesW
CreateMutexA
FindClose
FindNextFileW
FindFirstFileW
GetModuleHandleW
CreateDirectoryW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
GetProcessHeap
SetStdHandle
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
CreateEventW
GetTickCount
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForSingleObject
RtlUnwind
RaiseException
ExitProcess
SetConsoleCtrlHandler
CreateFileW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapFree
ExitThread
HeapReAlloc
GetCommandLineA
GetCommandLineW
GetACP
FlushFileBuffers
GetConsoleCP
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
user32
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
ShowWindow
advapi32
RegisterEventSourceW
DeregisterEventSource
CheckTokenMembership
SetSecurityDescriptorDacl
SetEntriesInAclA
AdjustTokenPrivileges
SetFileSecurityW
AllocateAndInitializeSid
LookupPrivilegeValueA
RegCreateKeyExW
SetNamedSecurityInfoW
RegSetValueExW
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
ReportEventW
shell32
ShellExecuteW
SHGetFolderPathA
SHChangeNotify
SHGetFolderPathW
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
bcrypt
BCryptGenRandom
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 501KB - Virtual size: 501KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ