Behavioral task
behavioral1
Sample
b88fe97196d3ea799b1e708ab452e9a61f9380a8b27a82f03575f5f046b036d0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b88fe97196d3ea799b1e708ab452e9a61f9380a8b27a82f03575f5f046b036d0.exe
Resource
win10v2004-20220901-en
General
-
Target
b88fe97196d3ea799b1e708ab452e9a61f9380a8b27a82f03575f5f046b036d0.zip
-
Size
482KB
-
MD5
c43b82e2d1c2a6d96640349b0dc17d40
-
SHA1
885645e937f663551e86ee32c4d690097ca6b352
-
SHA256
7f5500562fc0e7350550841de9333f51b21c79e3a395558d397d356e1bb29f5e
-
SHA512
7974ff94bb1913526b9f8e09e963a602c17468baef2f57568781f6fdc91462c911a06038caec4c467749dd41829b79123cb54518cc11679c2a4fc7d4e726d3c2
-
SSDEEP
12288:/Q5RmMN62TCq3E3K4dPjIatZ68idn3m1gV:i6+CZzIazifV
Malware Config
Signatures
-
Detects Surtr Payload 1 IoCs
resource yara_rule static1/unpack001/b88fe97196d3ea799b1e708ab452e9a61f9380a8b27a82f03575f5f046b036d0.exe family_surtr -
Surtr family
Files
-
b88fe97196d3ea799b1e708ab452e9a61f9380a8b27a82f03575f5f046b036d0.zip.zip
Password: infected
-
b88fe97196d3ea799b1e708ab452e9a61f9380a8b27a82f03575f5f046b036d0.exe.exe windows x86
fdca3b784089a0c89db7b9646500f7f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetLocaleInfoA
OpenProcess
SetFileAttributesW
CreateToolhelp32Snapshot
Sleep
CopyFileA
GetLastError
Process32NextW
GetDiskFreeSpaceExW
GetCurrentThread
LoadLibraryA
lstrcatW
DeleteFileW
Process32FirstW
CloseHandle
GetSystemInfo
HeapAlloc
GetProcAddress
SetFilePointerEx
LocalFree
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
GlobalMemoryStatusEx
GetModuleHandleW
ReleaseMutex
GetConsoleWindow
lstrcpyW
CreateDirectoryA
GetSystemTime
OpenMutexW
GetTickCount
lstrcmpW
GetDriveTypeW
IsDebuggerPresent
GetComputerNameA
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
GetVersionExW
GetFileAttributesW
CreateFileW
LocalAlloc
WaitForSingleObject
CreateMutexW
SetProcessShutdownParameters
GetModuleFileNameW
TerminateProcess
DeviceIoControl
WriteFile
lstrlenW
GetCurrentProcess
FindNextFileW
SetPriorityClass
HeapFree
VirtualProtect
VirtualFree
VirtualAlloc
GetThreadTimes
GetFileSizeEx
FindFirstFileW
ReadFile
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
CopyFileW
SetProcessPriorityBoost
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
DecodePointer
SetEndOfFile
HeapReAlloc
HeapSize
WriteConsoleW
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TryEnterCriticalSection
DuplicateHandle
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WideCharToMultiByte
EncodePointer
FreeLibrary
LoadLibraryExW
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
ExitProcess
GetModuleHandleExW
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
MoveFileExW
GetModuleFileNameA
MultiByteToWideChar
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
CreateThread
ExitThread
FreeLibraryAndExitThread
CompareStringW
LCMapStringW
ReadConsoleW
GetFileType
GetExitCodeProcess
CreateProcessA
CreateProcessW
GetFileAttributesExW
GetConsoleCP
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
user32
ShowWindow
ExitWindowsEx
GetKeyboardLayoutList
CharUpperW
MessageBoxW
SystemParametersInfoW
advapi32
OpenSCManagerW
CryptGenKey
QueryServiceStatusEx
OpenServiceW
CryptDestroyKey
CryptAcquireContextW
CloseServiceHandle
CryptEncrypt
CryptGenRandom
CryptReleaseContext
GetUserNameA
ControlService
CryptExportKey
EnumDependentServicesW
CryptImportKey
shell32
ShellExecuteW
SHEmptyRecycleBinA
ShellExecuteA
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
rstrtmgr
RmGetList
RmRegisterResources
RmEndSession
RmStartSession
iphlpapi
GetIpNetTable
ws2_32
closesocket
gethostbyname
WSAStartup
send
WSAGetLastError
htons
recv
inet_ntoa
connect
socket
WSACleanup
netapi32
NetApiBufferFree
NetShareEnum
Sections
.text Size: 1013KB - Virtual size: 1013KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ