Static task
static1
Behavioral task
behavioral1
Sample
69ef8b1f81fd34532b4d9b96798e4569e0c0df800bd017f4d75ef9d7d791df15.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
69ef8b1f81fd34532b4d9b96798e4569e0c0df800bd017f4d75ef9d7d791df15.exe
Resource
win10v2004-20220901-en
General
-
Target
69ef8b1f81fd34532b4d9b96798e4569e0c0df800bd017f4d75ef9d7d791df15
-
Size
1.2MB
-
MD5
caa04e55222e874485920fa565d63123
-
SHA1
31dd2f047263f5886b687378f970705c1ca2001d
-
SHA256
69ef8b1f81fd34532b4d9b96798e4569e0c0df800bd017f4d75ef9d7d791df15
-
SHA512
9f8d196299e5888b689de32f66d0ecabef7b63d0195ee3d0963d12bebf05e76769172d0d28c803c5af4037e0ef9c189fe2e4af471b844ee75b8c3fc9a3e0283c
-
SSDEEP
24576:0st8dyEmU66bD21HWdw55KKJPvX9ts+Lh0p0QT6jTrnY1:0bdyEmUdD2Edi5KUPvtts+LOmQT67Y1
Malware Config
Signatures
Files
-
69ef8b1f81fd34532b4d9b96798e4569e0c0df800bd017f4d75ef9d7d791df15.exe windows x86
a4be5f89a104ef308de9d076f2e71269
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileExW
CreateJobObjectW
GetLogicalDriveStringsA
GetLocaleInfoW
GetUserDefaultLangID
DefineDosDeviceW
CreateSemaphoreA
GetTempPathW
GetStringTypeW
GetPrivateProfileSectionA
GetConsoleScreenBufferInfo
GetCurrentDirectoryA
GetFileAttributesExA
PrepareTape
GetNumberFormatA
GetConsoleAliasExesW
MapViewOfFileEx
FreeEnvironmentStringsA
SetPriorityClass
OpenMutexA
GetProcessPriorityBoost
SetCurrentDirectoryW
GetStringTypeA
FreeConsole
GetEnvironmentStrings
GetTimeFormatW
CreateMutexA
SetConsoleTextAttribute
GetThreadContext
CompareStringA
FormatMessageW
GetPrivateProfileSectionNamesW
FlushInstructionCache
SetConsoleMode
GetConsoleAliasExesLengthW
SetFileAttributesW
CreateIoCompletionPort
GetConsoleCursorInfo
SetCalendarInfoA
GetLongPathNameW
CreateEventW
AddAtomW
GetVolumePathNameA
DeleteTimerQueueEx
PostQueuedCompletionStatus
GetPrivateProfileSectionW
ConvertThreadToFiber
GetProcessAffinityMask
FindFirstFileA
GetSystemDirectoryW
GetNumberOfConsoleInputEvents
FlushConsoleInputBuffer
GetBinaryTypeA
GetAtomNameW
CopyFileExA
SetProcessPriorityBoost
ExpandEnvironmentStringsA
GetProcessWorkingSetSize
GetConsoleAliasesW
GetFileType
Module32First
GetProfileIntW
GetDiskFreeSpaceA
GetUserDefaultLCID
GetPrivateProfileIntW
GetCompressedFileSizeA
GetNamedPipeHandleStateW
GetConsoleOutputCP
GetModuleHandleW
CompareStringW
QueryInformationJobObject
SetUnhandledExceptionFilter
FlushViewOfFile
GetAtomNameA
DeviceIoControl
GetACP
DeleteTimerQueue
SetSystemPowerState
OpenJobObjectW
GetThreadPriority
CreateFileMappingA
SetStdHandle
FileTimeToDosDateTime
CreateToolhelp32Snapshot
SetThreadAffinityMask
GetDiskFreeSpaceExW
SetComputerNameExA
GetShortPathNameA
Module32FirstW
SetProcessWorkingSetSize
GetEnvironmentStringsW
MapViewOfFile
ContinueDebugEvent
GetPrivateProfileSectionNamesA
IsSystemResumeAutomatic
GetVolumeInformationW
UnregisterWaitEx
CreateMutexW
GetQueuedCompletionStatus
GetPrivateProfileStringA
MoveFileA
GetConsoleAliasExesA
OpenEventW
GetCurrencyFormatA
FindFirstFileExA
EnumCalendarInfoExW
CreateNamedPipeW
ExpandEnvironmentStringsW
GetLogicalDrives
CreateJobObjectA
GetModuleFileNameA
GetDiskFreeSpaceW
WritePrivateProfileStringA
GetLocaleInfoA
GetDevicePowerState
OpenSemaphoreA
CreateHardLinkW
GetConsoleAliasExesLengthA
GetOEMCP
SetMailslotInfo
GetSystemWindowsDirectoryW
FreeResource
AddAtomA
DeleteAtom
OpenFileMappingA
GetNamedPipeInfo
GetFileSize
OpenWaitableTimerW
GetSystemTime
CreateWaitableTimerW
GetStdHandle
OpenJobObjectA
CreateDirectoryW
GetFileTime
DuplicateHandle
Module32Next
FindResourceExA
FormatMessageA
LCMapStringA
GetPrivateProfileStringW
OpenWaitableTimerA
GetThreadTimes
GetThreadLocale
BindIoCompletionCallback
SetEndOfFile
OpenFileMappingW
CopyFileA
FindVolumeClose
ResetEvent
GetDriveTypeW
VerSetConditionMask
GetLongPathNameA
FlushFileBuffers
GetCompressedFileSizeW
DosDateTimeToFileTime
MultiByteToWideChar
SetNamedPipeHandleState
SetThreadContext
GetProcessVersion
DnsHostnameToComputerNameA
FindAtomA
GetTapeStatus
SetErrorMode
GetFileInformationByHandle
SetLocaleInfoW
GetTempPathA
SetThreadExecutionState
DefineDosDeviceA
VerifyVersionInfoW
SetFileTime
SetFileAttributesA
HeapSize
GetPrivateProfileStructW
SetHandleInformation
GetCPInfo
EraseTape
FindFirstFileW
EnumCalendarInfoExA
GetVolumeInformationA
ReadProcessMemory
WideCharToMultiByte
GetSystemDirectoryA
AreFileApisANSI
GetCurrentThread
SetEvent
GetProfileSectionW
SetTapeParameters
GetCurrentConsoleFont
GetProcessTimes
CreateTimerQueue
GetProfileIntA
GetPrivateProfileStructA
GetSystemWindowsDirectoryA
GetStringTypeExA
GetLogicalDriveStringsW
GetVersion
SetThreadPriorityBoost
ResetWriteWatch
GetProcessIoCounters
Module32NextW
GetSystemDefaultUILanguage
MapUserPhysicalPagesScatter
GetProfileStringW
ChangeTimerQueueTimer
CreateWaitableTimerA
SearchPathA
SetWaitableTimer
GetConsoleCP
SetConsoleCtrlHandler
CopyFileW
CreateFileW
GetLocalTime
CancelIo
GetFileAttributesA
GetCurrentProcess
OpenMutexW
GetNamedPipeHandleStateA
FindResourceW
EnumCalendarInfoW
CreateDirectoryExA
GetConsoleAliasA
FoldStringA
ProcessIdToSessionId
GetUserDefaultUILanguage
SetConsoleDisplayMode
GetConsoleAliasesA
GetVolumePathNameW
FindFirstVolumeA
CreateTapePartition
AssignProcessToJobObject
PeekNamedPipe
SwitchToThread
Toolhelp32ReadProcessMemory
ReadDirectoryChangesW
GetDateFormatW
OutputDebugStringW
GetWindowsDirectoryW
CreateNamedPipeA
GetFileAttributesExW
SetComputerNameExW
GetFileSizeEx
OpenSemaphoreW
GetFileAttributesW
SetTapePosition
FindFirstVolumeMountPointA
SetLocaleInfoA
MoveFileWithProgressW
LCMapStringW
CancelWaitableTimer
SetCalendarInfoW
FoldStringW
MapUserPhysicalPages
SetConsoleCP
IsValidCodePage
GetModuleFileNameW
GetDateFormatA
ReadFile
GetConsoleMode
ReplaceFileA
GetModuleHandleA
OpenThread
OpenProcess
SetConsoleOutputCP
ReplaceFileW
CreateDirectoryExW
SetProcessAffinityMask
lstrcmpW
IsDBCSLeadByteEx
FreeUserPhysicalPages
HeapReAlloc
HeapAlloc
RtlUnwind
Sleep
HeapFree
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
GetLastError
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
DeleteCriticalSection
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
SetHandleCount
WriteFile
DecodePointer
ExitProcess
HeapSetInformation
GetCommandLineA
SetConsoleActiveScreenBuffer
GetMailslotInfo
SetThreadPriority
CreateEventA
GetNumberFormatW
GetProcAddress
GetPrivateProfileIntA
GetShortPathNameW
SetThreadLocale
OpenEventA
GetConsoleAliasW
CreateDirectoryA
SetSystemTimeAdjustment
SetThreadIdealProcessor
VirtualAlloc
GetEnvironmentVariableA
GetWindowsDirectoryA
GetCPInfoExA
DeleteTimerQueueTimer
FindAtomW
GetCalendarInfoA
LoadResource
GetCPInfoExW
GetSystemDefaultLCID
SetCurrentDirectoryA
DisconnectNamedPipe
DnsHostnameToComputerNameW
CreateFileMappingW
GetProfileStringA
SetInformationJobObject
FindFirstVolumeW
GetPriorityClass
GetEnvironmentVariableW
GetCurrencyFormatW
CreateSemaphoreW
FindNextChangeNotification
DeleteVolumeMountPointA
ConvertDefaultLocale
GetBinaryTypeW
GetFullPathNameA
FindResourceExW
GetProfileSectionA
GetFullPathNameW
GetCalendarInfoW
EnumCalendarInfoA
CreateMailslotW
GetVolumeNameForVolumeMountPointA
CreateHardLinkA
ReleaseMutex
GetHandleInformation
GetTimeFormatA
GetSystemDefaultLangID
FreeEnvironmentStringsW
CreateMailslotA
SetEnvironmentVariableA
GetStringTypeExW
GetDiskFreeSpaceExA
SetVolumeMountPointA
MoveFileWithProgressA
ReleaseSemaphore
IsProcessorFeaturePresent
rpcrt4
NdrClientCall
RpcMgmtEpEltInqNextW
RpcMgmtSetServerStackSize
RpcServerInqBindings
UuidCreateSequential
RpcNetworkIsProtseqValidW
NdrOleAllocate
RpcServerUnregisterIfEx
RpcFreeAuthorizationContext
RpcStringBindingComposeA
RpcMgmtStopServerListening
NdrGetDcomProtocolVersion
NdrMesTypeDecode2
RpcBindingToStringBindingA
NdrGetUserMarshalInfo
RpcSmDestroyClientContext
IUnknown_AddRef_Proxy
RpcSsFree
RpcRevertToSelf
NdrClientInitializeNew
RpcErrorClearInformation
RpcAsyncCancelCall
RpcErrorGetNumberOfRecords
RpcMgmtEpEltInqBegin
RpcIfInqId
user32
OpenWindowStationW
InsertMenuItemW
GetCursor
wsprintfW
GetActiveWindow
IsClipboardFormatAvailable
GetWindow
IsWindow
CopyImage
GetMessageA
GetWindowLongW
EnumThreadWindows
SendNotifyMessageW
SetForegroundWindow
InvalidateRgn
CharUpperA
EnumDisplayDevicesW
DestroyMenu
GetMonitorInfoW
BeginPaint
MsgWaitForMultipleObjectsEx
PostMessageA
RegisterClipboardFormatW
CharLowerW
GetScrollInfo
SendInput
SendMessageW
ShowCursor
CharToOemBuffA
WindowFromDC
UnregisterClassA
CreateWindowExA
IsChild
GetUserObjectInformationW
GetClassInfoW
RegisterDeviceNotificationW
CheckDlgButton
SetThreadDesktop
CheckMenuItem
GetNextDlgTabItem
GetSubMenu
UpdateWindow
GetMenuItemCount
GetShellWindow
GetMenuItemID
IntersectRect
CreateDialogParamW
SendMessageA
MsgWaitForMultipleObjects
GetDlgItemTextA
GetMessagePos
CallNextHookEx
SetPropW
EndPaint
GetUpdateRect
SendDlgItemMessageA
SystemParametersInfoW
UnionRect
SendMessageTimeoutW
FindWindowExA
CreateMenu
ClientToScreen
MonitorFromWindow
SetPropA
OffsetRect
SetRectEmpty
GetSysColorBrush
SendDlgItemMessageW
GetTopWindow
MapDialogRect
GetSysColor
advapi32
OpenServiceW
GetSidSubAuthorityCount
OpenSCManagerA
CheckTokenMembership
InitializeSecurityDescriptor
AdjustTokenPrivileges
StartServiceA
CryptDestroyKey
GetSecurityDescriptorControl
RegFlushKey
LookupAccountNameW
RegSetValueExW
GetSidSubAuthority
SetEntriesInAclW
QueryServiceStatus
AddAccessAllowedAce
RegOpenKeyW
RegDeleteKeyW
CryptGetHashParam
CryptAcquireContextA
AddAce
RegisterEventSourceW
StartServiceW
RegOpenKeyExW
RegNotifyChangeKeyValue
CryptReleaseContext
SetSecurityDescriptorOwner
CryptCreateHash
LsaOpenPolicy
RegEnumKeyW
RegEnumKeyExA
RegEnumKeyExW
CryptAcquireContextW
AllocateAndInitializeSid
GetSecurityDescriptorSacl
IsValidSid
RegSetValueExA
RegQueryInfoKeyW
GetLengthSid
RegDeleteKeyA
OpenServiceA
ReportEventW
CloseServiceHandle
CryptDestroyHash
ControlService
EqualSid
RegCreateKeyW
LsaQueryInformationPolicy
LookupAccountSidW
GetSecurityDescriptorDacl
RegCloseKey
GetAclInformation
RegDeleteValueA
RegQueryInfoKeyA
GetSecurityDescriptorOwner
CreateProcessAsUserW
SetNamedSecurityInfoW
SetSecurityDescriptorGroup
RegDeleteValueW
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ