Behavioral task
behavioral1
Sample
740-56-0x0000000000FB0000-0x0000000001E5F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
740-56-0x0000000000FB0000-0x0000000001E5F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
740-56-0x0000000000FB0000-0x0000000001E5F000-memory.dmp
-
Size
14.7MB
-
MD5
d00098077b3ca26dfb51b7e285e7a8be
-
SHA1
a1958411dac1eccae95159b2d106a9bbd28982c8
-
SHA256
9051dc4fefba1f271ee2055881c8f350e358f124efe8306ee4c6d93e31dd08f1
-
SHA512
645044609a8a659170186824cbaf076bebacc66e6dee239d0f14535c336a0ffdcc4bf1c6a4704f0d24f7e0db5bfa04ead202d79f7909e00fa86d8442874b685c
-
SSDEEP
393216:RRPEtTSd2Ml36XmwrX7m5d4kz0VgR+eh9Nw:/P2mw+d4k4Vgn
Malware Config
Signatures
-
Privateloader family
-
resource yara_rule sample themida
Files
-
740-56-0x0000000000FB0000-0x0000000001E5F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 619KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 56KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.3MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 17KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ