Static task
static1
Behavioral task
behavioral1
Sample
685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971.exe
Resource
win10v2004-20221111-en
General
-
Target
685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971
-
Size
589KB
-
MD5
3b0cc8b216505e407de1c7d1d13a05b0
-
SHA1
2662bceb79c5fbb22e0d0d6103bc5770867993dd
-
SHA256
685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971
-
SHA512
d2a6fe64e9c94a5d95537585167813432deba0b595283034167a51393c04d8be26dca5544e380019d428d8d9b7079763de48bb1970f037cc9184730013c25e55
-
SSDEEP
12288:TIAT+0PpJlc8jecAyHNkCBVPIHOljydP2s5byxDLVp6VAd+KU:y0pc8tVIOl2dP3UJLVp6V6U
Malware Config
Signatures
Files
-
685d20c4545c8a28147b54b38869efd5ef0992f8a37dca5aa3d94d84aaaba971.exe windows x86
3b4d575f36f0f3608e33f41c1a242406
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qbutilities
?GetReDirectFileInstance@ReDirectFile@Util@@SAPAV12@XZ
?GetMemoryManager@Util@@YAAAVIMemoryManager@1@XZ
??0OpsContext@Util@@QAE@XZ
??1OpsContext@Util@@UAE@XZ
??RMessageFunctor@Ops@Util@@QBAXPBDZZ
??0MessageFunctor@Ops@Util@@QAE@AAV12@W4Level@12@W4EventType@12@PBDJ33@Z
?GetOps@Util@@YAAAVOps@1@XZ
?GetFailed@Status@Util@@SAABV12@XZ
??4Status@Util@@QAEAAV01@ABV01@@Z
?GetSystemAccessDenied@Status@Util@@SAABV12@XZ
?IsProcessRunningWithAdminPrivileges@Util@@YA_NXZ
?IsWindowsUserAnAdmin@Util@@YA_NXZ
?GetSucceeded@Status@Util@@SAABV12@XZ
?GetInvalidArg@Status@Util@@SAABV12@XZ
?Failed@Status@Util@@QBE_NXZ
?GetStatusMessage@Status@Util@@QBEABV?$TString@DV?$TStringAllocator@D@Util@@@2@XZ
?GetLongAttribute@Status@Util@@QBEJPBD@Z
?FormatStringV@Util@@YAPADPBDPAD@Z
?EndOperations@Ops@Util@@QAEXXZ
?BeginOperations@Ops@Util@@QAEXPBVOpsContext@2@@Z
?CreateDOMDocument@MSXML_XML@Util@@YAJPAPAUIXMLDOMDocument2@MSXML2@@@Z
?AddSubscriptionStr@OpsSubscriptionManager@Util@@QAEXPBD0@Z
??1MessageFunctor@Ops@Util@@QAE@XZ
?SetOpsFileLogDirectory@OpsContext@Util@@UAEXABV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z
?SetOpsFileConfigDirectory@OpsContext@Util@@UAEXABV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z
?GetOpsLogDirectory@OpsContext@Util@@UBEXAAV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z
?GetOpsDirectory@OpsContext@Util@@UBEXAAV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z
?CompareStrings@Util@@YA?AW4StringCompareResult@1@PBD0W4CaseSensitivity@1@@Z
?SetReleaseMode@ReDirectFile@Util@@QAEXW4ReleaseModeTypeID@12@@Z
?GetStringAttribute@Status@Util@@QBEXPBDAAV?$TString@DV?$TStringAllocator@D@Util@@@2@@Z
?GetDirectoryFromId@ReDirectFile@Util@@QAE?BV?$TString@DV?$TStringAllocator@D@Util@@@2@W4BaseDirectory@12@@Z
?CopyString@Util@@YAPADPADIPBD@Z
?StringLength@Util@@YAIPBD@Z
??1Status@Util@@QAE@XZ
??0Status@Util@@QAE@ABV01@@Z
?Succeeded@Status@Util@@QBE_NXZ
?GetStatusCode@Status@Util@@QBEJXZ
?AttributeExists@Status@Util@@QBE_NPBD@Z
databasemanager
?StartServer@DBManager@DBMgr@@SA?AVStatus@Util@@XZ
?RestartServer@DBManager@DBMgr@@SA?AVStatus@Util@@XZ
?ResetServerConfig@DBManager@DBMgr@@SA?AVStatus@Util@@XZ
?StartMonitorService@DBManager@DBMgr@@SA?AVStatus@Util@@XZ
?SetServerMode@DBManager@DBMgr@@SA?AVStatus@Util@@W4ServerMode@2@_N@Z
?StartPersonalSecondaryServer@DBManager@DBMgr@@SA?AVStatus@Util@@W4ServerType@2@W4ServerExeVersion@2@PBD@Z
?SetCacheSize@DBManager@DBMgr@@SA?AVStatus@Util@@J_N@Z
?SetInitialCacheSize@DBManager@DBMgr@@SA?AVStatus@Util@@J_N@Z
?StopServer@DBManager@DBMgr@@SA?AVStatus@Util@@_N0@Z
ole32
CoUninitialize
CoInitialize
stlport_r50
?_Assert@?$__stl_debug_engine@_N@stlp_std@@SAXPBD0H@Z
?deallocate@?$__debug_alloc@V?$__node_alloc@$00$0A@@stlp_std@@@stlp_std@@SAXPAXI@Z
?allocate@?$__debug_alloc@V?$__node_alloc@$00$0A@@stlp_std@@@stlp_std@@SAPAXI@Z
msvcr90
strspn
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
exit
puts
strcspn
__CxxFrameHandler3
??3@YAXPAX@Z
strlen
strcat_s
isdigit
atoi
strcmp
kernel32
GetCurrentThreadId
GetTickCount
IsDebuggerPresent
QueryPerformanceCounter
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcessId
GetSystemTimeAsFileTime
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 508KB - Virtual size: 1.6MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE