?GlobalThreadOld@@IJPANJ@X
Static task
static1
Behavioral task
behavioral1
Sample
6d5b655d0d03969b4336ab450ed29ff3cf2d197d318c29837732de355fbae911.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6d5b655d0d03969b4336ab450ed29ff3cf2d197d318c29837732de355fbae911.dll
Resource
win10v2004-20220901-en
General
-
Target
6d5b655d0d03969b4336ab450ed29ff3cf2d197d318c29837732de355fbae911
-
Size
159KB
-
MD5
850b3bc2c7dac654c3b291baf3b287c0
-
SHA1
254de6382eaffb2a50bc627838847d1b2a458f49
-
SHA256
6d5b655d0d03969b4336ab450ed29ff3cf2d197d318c29837732de355fbae911
-
SHA512
844aca9da38b9937365f0c3ed3b298a63ee6ebd42afbc73dc7791e7ebcbf20bc3398a5f55bc0c72220fa8d6665de7f24ae50e841bf9ffa2af2533737478a71be
-
SSDEEP
3072:8VMGm779J3bDGVr9g3VIICfen0C2cJaJFs0r9gkJKqDm+TAnBRjvt:8i791bKVr9g3VIICfs0C2ckJ4f+iBRjv
Malware Config
Signatures
Files
-
6d5b655d0d03969b4336ab450ed29ff3cf2d197d318c29837732de355fbae911.dll windows x86
5882f8fd4359c8a8740b473ab8d94593
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlSetBits
MmUnlockPagableImageSection
SeLockSubjectContext
ObOpenObjectByPointer
IoQueryDeviceDescription
ZwCreateFile
RtlUpcaseUnicodeString
ExCreateCallback
FsRtlFreeFileLock
MmFreeMappingAddress
RtlSecondsSince1980ToTime
RtlFillMemoryUlong
MmIsAddressValid
IoCsqRemoveIrp
DbgBreakPoint
RtlCreateAcl
IoAllocateErrorLogEntry
IoReleaseRemoveLockAndWaitEx
IoDeleteDevice
RtlxOemStringToUnicodeSize
CcCanIWrite
ZwOpenSection
RtlFreeAnsiString
RtlNumberOfClearBits
RtlFindSetBits
CcCopyWrite
RtlTimeToSecondsSince1970
RtlIntegerToUnicodeString
PsImpersonateClient
MmAllocateNonCachedMemory
PsRevertToSelf
KeSetTimer
RtlInitUnicodeString
IoCreateNotificationEvent
IoIsSystemThread
ObQueryNameString
RtlAppendStringToString
ZwUnloadDriver
ZwOpenSymbolicLinkObject
CcCopyRead
ExAcquireResourceSharedLite
RtlLengthSecurityDescriptor
ExAcquireFastMutexUnsafe
RtlCopyLuid
CcFastMdlReadWait
MmMapIoSpace
RtlInsertUnicodePrefix
IoFreeIrp
PoRegisterSystemState
IoCreateStreamFileObjectLite
ZwClose
KeGetCurrentThread
PoStartNextPowerIrp
CcInitializeCacheMap
ExRaiseDatatypeMisalignment
IoAllocateAdapterChannel
KeResetEvent
SeDeleteObjectAuditAlarm
CcMdlWriteAbort
KeRemoveQueue
MmUnmapIoSpace
KeSetImportanceDpc
RtlFindUnicodePrefix
MmHighestUserAddress
RtlClearAllBits
RtlUnicodeStringToInteger
RtlEqualString
PsReturnPoolQuota
ObGetObjectSecurity
FsRtlDeregisterUncProvider
ZwOpenProcess
MmUnmapReservedMapping
SeValidSecurityDescriptor
KeRundownQueue
ZwDeleteValueKey
SeSetSecurityDescriptorInfo
ObfReferenceObject
SeCaptureSubjectContext
ZwMapViewOfSection
RtlCopyString
RtlAddAccessAllowedAce
CcSetReadAheadGranularity
RtlWriteRegistryValue
KeEnterCriticalRegion
ZwCreateDirectoryObject
IoGetDeviceProperty
PsCreateSystemThread
ExSetResourceOwnerPointer
IoReadPartitionTableEx
PsSetLoadImageNotifyRoutine
RtlCharToInteger
KeTickCount
ObMakeTemporaryObject
RtlTimeToSecondsSince1980
KeSaveFloatingPointState
KeReadStateMutex
KeReadStateTimer
MmProbeAndLockPages
KeInsertQueueDpc
ZwQuerySymbolicLinkObject
SeFreePrivileges
ZwReadFile
RtlCreateSecurityDescriptor
ZwOpenFile
RtlUpcaseUnicodeToOemN
ZwQueryKey
PsGetProcessId
IoCheckQuotaBufferValidity
MmIsDriverVerifying
ZwSetValueKey
MmUnlockPages
ExReleaseResourceLite
SeSinglePrivilegeCheck
KefAcquireSpinLockAtDpcLevel
PoCallDriver
CcUnpinRepinnedBcb
CcFastCopyRead
IoSetSystemPartition
MmIsVerifierEnabled
CcPreparePinWrite
CcSetDirtyPinnedData
IoReleaseRemoveLockEx
IoStartTimer
RtlGetVersion
IoSetHardErrorOrVerifyDevice
IoGetRequestorProcessId
CcPurgeCacheSection
ObInsertObject
ZwSetSecurityObject
RtlUpperString
FsRtlIsHpfsDbcsLegal
IoCreateSynchronizationEvent
IoConnectInterrupt
IoOpenDeviceRegistryKey
RtlInitializeGenericTable
IoGetDeviceToVerify
KeSetEvent
ExReleaseFastMutexUnsafe
IoCreateSymbolicLink
IoSetTopLevelIrp
DbgPrompt
IoCancelIrp
IoCheckShareAccess
PsTerminateSystemThread
KeLeaveCriticalRegion
RtlSubAuthoritySid
IoGetAttachedDevice
SeAssignSecurity
RtlNtStatusToDosError
SeAppendPrivileges
ZwFsControlFile
IoRegisterDeviceInterface
PoSetPowerState
RtlVolumeDeviceToDosName
IoIsWdmVersionAvailable
RtlTimeFieldsToTime
IoDeviceObjectType
KeInitializeTimerEx
RtlUnicodeToMultiByteN
IoRegisterFileSystem
RtlInitializeUnicodePrefix
KdDisableDebugger
IoVolumeDeviceToDosName
KeRemoveByKeyDeviceQueue
RtlInitAnsiString
KeInitializeDeviceQueue
PoUnregisterSystemState
KeSetSystemAffinityThread
IoRemoveShareAccess
MmAllocateContiguousMemory
RtlAppendUnicodeToString
ZwCreateSection
RtlCompareString
FsRtlIsNameInExpression
IoAllocateMdl
KeQueryActiveProcessors
IoStopTimer
KeQueryInterruptTime
IoUpdateShareAccess
IoEnumerateDeviceObjectList
RtlOemStringToUnicodeString
RtlIsNameLegalDOS8Dot3
RtlEqualSid
KeFlushQueuedDpcs
IoWMIRegistrationControl
RtlInitString
FsRtlIsDbcsInExpression
ZwFlushKey
ProbeForRead
IoStartPacket
IoGetRequestorProcess
RtlFindClearBits
PsGetVersion
HalExamineMBR
RtlFindLeastSignificantBit
RtlCreateRegistryKey
RtlSecondsSince1970ToTime
KeRemoveQueueDpc
IoGetAttachedDeviceReference
PsReferencePrimaryToken
MmUnsecureVirtualMemory
IoCreateStreamFileObject
IoSetDeviceInterfaceState
KeSetTargetProcessorDpc
IoFreeMdl
IoThreadToProcess
IoGetDiskDeviceObject
ExAllocatePoolWithQuota
IoAllocateWorkItem
ExAllocatePoolWithTag
RtlVerifyVersionInfo
KeInitializeApc
KeBugCheckEx
SeOpenObjectAuditAlarm
PoRequestPowerIrp
RtlGetCallersAddress
RtlFreeUnicodeString
RtlEnumerateGenericTable
ExLocalTimeToSystemTime
IoGetDeviceInterfaces
RtlUnicodeToOemN
IoReuseIrp
RtlDeleteRegistryValue
ZwAllocateVirtualMemory
MmBuildMdlForNonPagedPool
IoStartNextPacket
MmAllocatePagesForMdl
ZwEnumerateKey
IoAcquireCancelSpinLock
RtlCopySid
IoGetLowerDeviceObject
RtlEqualUnicodeString
KeReadStateEvent
ObReferenceObjectByPointer
SeImpersonateClientEx
RtlDeleteNoSplay
ZwQueryValueKey
ObCreateObject
IoSetPartitionInformation
IoGetBootDiskInformation
FsRtlGetNextFileLock
MmQuerySystemSize
FsRtlCheckOplock
RtlInitializeSid
ZwNotifyChangeKey
SeQueryAuthenticationIdToken
ZwEnumerateValueKey
RtlRemoveUnicodePrefix
PsGetThreadProcessId
ExDeleteNPagedLookasideList
RtlOemToUnicodeN
IoGetStackLimits
RtlSetDaclSecurityDescriptor
KeInitializeTimer
Exports
Exports
Sections
.text Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ