Static task
static1
Behavioral task
behavioral1
Sample
61ed0bed6bb53181860d16a9e2aa85f824476e7f3abe8392f7e110b536f3311a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
61ed0bed6bb53181860d16a9e2aa85f824476e7f3abe8392f7e110b536f3311a.exe
Resource
win10v2004-20220812-en
General
-
Target
61ed0bed6bb53181860d16a9e2aa85f824476e7f3abe8392f7e110b536f3311a
-
Size
50KB
-
MD5
0e21ebc6d9a6cc23115851f82772abf0
-
SHA1
f85120a29b3f500b6e55234aaabcbeeba8c4b44e
-
SHA256
61ed0bed6bb53181860d16a9e2aa85f824476e7f3abe8392f7e110b536f3311a
-
SHA512
a9927e936abcca448f78d641d9ecdc157680ca175a0ec95636e890c484ae5eb6959243280019eb77cbf3c7def3fde3b68b78cbc1d336b92983c455eb9a9cd9ef
-
SSDEEP
768:C3Q6RkIXG906uKRS99MWSzuqfgS8agHZVVjjefk6PUzK:e+IXF6nSW8vXwf
Malware Config
Signatures
Files
-
61ed0bed6bb53181860d16a9e2aa85f824476e7f3abe8392f7e110b536f3311a.exe windows x86
a9346d48337f3ab8d85747011b190296
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winsta
WinStationEnumerateW
WinStationEnumerateProcesses
WinStationGetAllProcesses
WinStationFreeMemory
WinStationFreeGAPMemory
WinStationOpenServerW
WinStationQueryInformationW
utildll
GetUnknownString
user32
OemToCharBuffW
CharToOemW
LoadStringW
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcess
GetModuleHandleW
SetThreadUILanguage
WideCharToMultiByte
GetConsoleOutputCP
GetLastError
SetFileApisToOEM
HeapSetInformation
CloseHandle
GetCurrentProcessId
VerSetConditionMask
VerifyVersionInfoW
FreeLibrary
LoadLibraryW
FormatMessageW
WriteConsoleW
MultiByteToWideChar
GetStdHandle
SetLastError
GetFileType
GetACP
LocalAlloc
GetOEMCP
LocalFree
GetCommandLineW
FindFirstFileW
GetFileAttributesW
FindClose
FindNextFileW
GetTickCount
GetSystemTimeAsFileTime
Sleep
ntdll
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlInitializeCriticalSection
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
CopySid
EqualSid
GetLengthSid
LookupAccountSidW
OpenProcessToken
msvcrt
_wsetlocale
wcscpy_s
_wcsicmp
free
malloc
wcstol
iswdigit
wcschr
vfwprintf
fwprintf
vswprintf_s
_ultoa
wcscat_s
_wcsnicmp
wprintf
printf
memmove
wcstoul
_wcsdup
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
?terminate@@YAXXZ
_controlfp
_except_handler4_common
setlocale
_iob
fprintf
_wcslwr
swprintf_s
memcpy
memset
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wrcouju Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE