Static task
static1
Behavioral task
behavioral1
Sample
53ec76527c8ea2dfd061350fa01126e37603216d85ba971022614e5d63cdbafd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
53ec76527c8ea2dfd061350fa01126e37603216d85ba971022614e5d63cdbafd.exe
Resource
win10v2004-20220812-en
General
-
Target
53ec76527c8ea2dfd061350fa01126e37603216d85ba971022614e5d63cdbafd
-
Size
256KB
-
MD5
525660a2ee0bfc2c3c80496a8ccc962d
-
SHA1
26ea5675257f5516618a1d6eefa6006c0bf616c5
-
SHA256
53ec76527c8ea2dfd061350fa01126e37603216d85ba971022614e5d63cdbafd
-
SHA512
dd84fc0195404951414d9882835935ad311514e16a4a9276200f753721b673b8d91b8629e7d26b7f6cc0041f7d0d49a9b6b9be3e1b6512ac7a23b56cb23cb2e5
-
SSDEEP
6144:JhTn3K/tAHdMTBktg5oAu6nS/N9pVMw7x9:TTn3KFAHOTag6kGVh7x
Malware Config
Signatures
Files
-
53ec76527c8ea2dfd061350fa01126e37603216d85ba971022614e5d63cdbafd.exe windows x86
04123fee1383432c69ec7ab4faeafe62
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
HeapFree
QueryPerformanceCounter
CreateEventW
InterlockedDecrement
GetVersionExW
PulseEvent
GetProcessHeap
GetTickCount
InterlockedIncrement
WaitForMultipleObjects
HeapAlloc
LocalAlloc
CreateFileW
GetModuleFileNameW
GetLastError
GetCurrentThreadId
GetCommandLineW
GetCurrentProcessId
Sleep
SetCurrentDirectoryW
GetExitCodeProcess
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
SetFilePointer
SetStdHandle
GetConsoleMode
LoadLibraryA
WaitForSingleObject
GetProcAddress
GetVersion
OpenProcess
lstrlenW
FreeLibrary
GetCurrentProcess
InterlockedExchangeAdd
SetThreadPriority
ReleaseSemaphore
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateSemaphoreW
TerminateProcess
ExitProcess
SetUnhandledExceptionFilter
EnterCriticalSection
GetCurrentThread
DisconnectNamedPipe
FlushFileBuffers
CreateFileA
ConnectNamedPipe
CreateNamedPipeA
WriteFile
ReadFile
WaitNamedPipeA
SetNamedPipeHandleState
FormatMessageW
GetSystemTimeAsFileTime
MultiByteToWideChar
WideCharToMultiByte
OpenEventA
SetEvent
IsBadReadPtr
LoadLibraryW
SetLastError
DuplicateHandle
CreateEventA
SetConsoleCtrlHandler
MoveFileW
DeleteFileW
RemoveDirectoryW
GetFileAttributesW
GetFullPathNameW
CopyFileW
VirtualQuery
ReadProcessMemory
GetSystemInfo
GetModuleFileNameA
GlobalMemoryStatus
Beep
GetModuleHandleA
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
InterlockedExchange
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetVersionExA
ExitThread
ResumeThread
CreateThread
SetEndOfFile
GetCPInfo
LCMapStringA
LCMapStringW
RtlUnwind
RaiseException
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
CloseHandle
user32
PeekMessageW
CloseWindowStation
GetUserObjectInformationW
CloseDesktop
OpenWindowStationW
GetUserObjectSecurity
SetProcessWindowStation
wsprintfW
EnumDesktopWindows
GetWindowThreadProcessId
OpenDesktopW
GetClassNameW
GetProcessWindowStation
EnumDesktopsW
OpenInputDesktop
EnumWindowStationsW
shell32
ShellExecuteExW
advapi32
RegOpenKeyExW
SetSecurityDescriptorDacl
EqualSid
GetSecurityDescriptorDacl
RegCreateKeyExW
RegCloseKey
SetSecurityInfo
GetAclInformation
GetLengthSid
AddAccessAllowedAce
RegNotifyChangeKeyValue
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
GetAce
DeleteAce
AddAce
CreateProcessAsUserW
OpenProcessToken
LookupAccountSidW
shlwapi
StrCatW
StrCpyW
StrCmpW
ws2_32
WSASocketW
closesocket
socket
Sections
.text Size: 200KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ