Static task
static1
Behavioral task
behavioral1
Sample
1c0d1ef8a66b3cfdd5e46336972b82a1b6d3d770084c03c236cc2f763d6a500f.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1c0d1ef8a66b3cfdd5e46336972b82a1b6d3d770084c03c236cc2f763d6a500f.dll
Resource
win10v2004-20220901-en
General
-
Target
1c0d1ef8a66b3cfdd5e46336972b82a1b6d3d770084c03c236cc2f763d6a500f
-
Size
378KB
-
MD5
0f67057f80ff72391911a487dfab069c
-
SHA1
71e4b9492d9632c48c0a1d1d391cab553ee9e02e
-
SHA256
1c0d1ef8a66b3cfdd5e46336972b82a1b6d3d770084c03c236cc2f763d6a500f
-
SHA512
3043bc43b8f340a00783a3118793b3bca751bcbe659689ad3925ae1507c9347f7ca43428ba922b7f73327e89c64b7afb933706fad443a44b29773dfaebcdb6a2
-
SSDEEP
6144:xq6mims++k9kNIzk16ffkurOpbDIgFhXYWXMHJyUooBMpacpVnYrZVxWn60u3vzR:o6LFQ2KJPcniWgdQsyDS
Malware Config
Signatures
Files
-
1c0d1ef8a66b3cfdd5e46336972b82a1b6d3d770084c03c236cc2f763d6a500f.dll windows x86
cd6306727e35cb62982beddaccbd224b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
ZwClose
IoQueryFileInformation
ExInitializeResourceLite
ExDeleteResourceLite
KeInitializeEvent
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
NtOpenFile
NtQueryVolumeInformationFile
NtClose
swprintf
RtlInitUnicodeString
ObReferenceObjectByHandle
IoGetRelatedDeviceObject
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExAcquireResourceSharedLite
ZwCreateFile
IoGetStackLimits
MmFlushImageSection
CcInitializeCacheMap
CcPurgeCacheSection
CcSetFileSizes
MmMapLockedPagesSpecifyCache
KeSetEvent
CcFlushCache
CcUninitializeCacheMap
IofCallDriver
IofCompleteRequest
IoSetInformation
CcCopyWrite
FsRtlCopyRead
IoCreateDevice
ZwAllocateVirtualMemory
NtQuerySystemInformation
_stricmp
NtOpenThread
NtQueryInformationThread
RtlEqualUnicodeString
PsLookupProcessThreadByCid
KeInitializeApc
ObfReferenceObject
KeInsertQueueApc
KeDelayExecutionThread
NtConnectPort
PsCreateSystemThread
LpcRequestPort
LpcRequestWaitReplyPort
KeQuerySystemTime
RtlTimeToSecondsSince1980
qsort
NtCreateSection
ExAllocatePoolWithTag
ZwUnmapViewOfSection
ZwFlushVirtualMemory
NtDeviceIoControlFile
ZwCreateSymbolicLinkObject
IoFreeWorkItem
ExUuidCreate
NtCreateFile
NtSetInformationFile
NtQueryDirectoryFile
RtlTimeToTimeFields
RtlUnicodeStringToInteger
RtlTimeToSecondsSince1970
NtWriteFile
RtlSecondsSince1970ToTime
ZwQueryInformationFile
ZwReadFile
RtlIpv4AddressToStringA
RtlRandomEx
KeQueryInterruptTime
KeInsertQueue
KeRemoveQueue
KeRundownQueue
IoFreeIrp
KeInitializeQueue
IoBuildDeviceIoControlRequest
KeInitializeTimer
KeInitializeDpc
ExQueueWorkItem
IoAllocateWorkItem
IoQueueWorkItem
KeSetTimerEx
ZwOpenSection
ZwMapViewOfSection
MmAllocatePagesForMdl
MmUnmapLockedPages
MmFreePagesFromMdl
ZwOpenFile
RtlHashUnicodeString
RtlPrefixUnicodeString
IoAllocateIrp
KeWaitForSingleObject
ZwOpenKey
ZwEnumerateKey
ZwDeleteKey
PoStartNextPowerIrp
PoCallDriver
ZwQueryKey
ZwSetSystemInformation
IoCreateDriver
ObMakeTemporaryObject
ZwDeleteFile
ObReferenceObjectByName
IoDriverObjectType
IoEnumerateDeviceObjectList
wcsrchr
IoDeleteDevice
IoDetachDevice
NtMapViewOfSection
ObfDereferenceObject
_allmul
memset
memcpy
_aulldiv
hal
KfLowerIrql
KeGetCurrentIrql
KfRaiseIrql
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ