Behavioral task
behavioral1
Sample
32f9e35d861d166a7ae22eb24f50ab0fb1adedc9f1ae5f1ce2c76e3268b2b4c1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
32f9e35d861d166a7ae22eb24f50ab0fb1adedc9f1ae5f1ce2c76e3268b2b4c1.exe
Resource
win10v2004-20220812-en
General
-
Target
32f9e35d861d166a7ae22eb24f50ab0fb1adedc9f1ae5f1ce2c76e3268b2b4c1.exe
-
Size
1.1MB
-
MD5
674e7ee905d24a89af47b53b53ffc23c
-
SHA1
c6b73b882aa1f4d46ec655a5591a28638700856c
-
SHA256
32f9e35d861d166a7ae22eb24f50ab0fb1adedc9f1ae5f1ce2c76e3268b2b4c1
-
SHA512
6a0623742423f2137a0a9285e6a590659f8436eeb1fd7c9bcb5e16ecbffa949ae82cf59ee9a49e614345b559a581cfe23c87afce028d1927335dc4938a9b0408
-
SSDEEP
24576:ibBzKGHF0bxTCFvXwKl/aISpu4Qc6F3v1HT2BzN2tgGS3YzYhoPGxFG4zmYw7A:wV4xTC4u4Qc6/F8bw4Nw
Malware Config
Signatures
-
Detects Surtr Payload 1 IoCs
resource yara_rule sample family_surtr -
Surtr family
Files
-
32f9e35d861d166a7ae22eb24f50ab0fb1adedc9f1ae5f1ce2c76e3268b2b4c1.exe.exe windows x86
fdca3b784089a0c89db7b9646500f7f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetLocaleInfoA
OpenProcess
SetFileAttributesW
CreateToolhelp32Snapshot
Sleep
CopyFileA
GetLastError
Process32NextW
GetDiskFreeSpaceExW
GetCurrentThread
LoadLibraryA
lstrcatW
DeleteFileW
Process32FirstW
CloseHandle
GetSystemInfo
HeapAlloc
GetProcAddress
SetFilePointerEx
LocalFree
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
GlobalMemoryStatusEx
GetModuleHandleW
ReleaseMutex
GetConsoleWindow
lstrcpyW
CreateDirectoryA
GetSystemTime
OpenMutexW
GetTickCount
lstrcmpW
GetDriveTypeW
IsDebuggerPresent
GetComputerNameA
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
GetVersionExW
GetFileAttributesW
CreateFileW
LocalAlloc
WaitForSingleObject
CreateMutexW
SetProcessShutdownParameters
GetModuleFileNameW
TerminateProcess
DeviceIoControl
WriteFile
lstrlenW
GetCurrentProcess
FindNextFileW
SetPriorityClass
HeapFree
VirtualProtect
VirtualFree
VirtualAlloc
GetThreadTimes
GetFileSizeEx
FindFirstFileW
ReadFile
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
CopyFileW
SetProcessPriorityBoost
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
DecodePointer
SetEndOfFile
HeapReAlloc
HeapSize
WriteConsoleW
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TryEnterCriticalSection
DuplicateHandle
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WideCharToMultiByte
EncodePointer
FreeLibrary
LoadLibraryExW
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
ExitProcess
GetModuleHandleExW
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
MoveFileExW
GetModuleFileNameA
MultiByteToWideChar
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
CreateThread
ExitThread
FreeLibraryAndExitThread
CompareStringW
LCMapStringW
ReadConsoleW
GetFileType
GetExitCodeProcess
CreateProcessA
CreateProcessW
GetFileAttributesExW
GetConsoleCP
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
user32
ShowWindow
ExitWindowsEx
GetKeyboardLayoutList
CharUpperW
MessageBoxW
SystemParametersInfoW
advapi32
OpenSCManagerW
CryptGenKey
QueryServiceStatusEx
OpenServiceW
CryptDestroyKey
CryptAcquireContextW
CloseServiceHandle
CryptEncrypt
CryptGenRandom
CryptReleaseContext
GetUserNameA
ControlService
CryptExportKey
EnumDependentServicesW
CryptImportKey
shell32
ShellExecuteW
SHEmptyRecycleBinA
ShellExecuteA
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
rstrtmgr
RmGetList
RmRegisterResources
RmEndSession
RmStartSession
iphlpapi
GetIpNetTable
ws2_32
closesocket
gethostbyname
WSAStartup
send
WSAGetLastError
htons
recv
inet_ntoa
connect
socket
WSACleanup
netapi32
NetApiBufferFree
NetShareEnum
Sections
.text Size: 1014KB - Virtual size: 1014KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ