Static task
static1
Behavioral task
behavioral1
Sample
c6b5cd5603a5de618efa07f9b4bd2a02a21b3d251accf0288f5fdc7eb5f6225c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c6b5cd5603a5de618efa07f9b4bd2a02a21b3d251accf0288f5fdc7eb5f6225c.exe
Resource
win10v2004-20221111-en
General
-
Target
c6b5cd5603a5de618efa07f9b4bd2a02a21b3d251accf0288f5fdc7eb5f6225c
-
Size
999KB
-
MD5
18ea16dcb3497dde203d1b4680a4a457
-
SHA1
41e56ed6be7a4a02fca3c7008ec9bca1adf709fd
-
SHA256
c6b5cd5603a5de618efa07f9b4bd2a02a21b3d251accf0288f5fdc7eb5f6225c
-
SHA512
42dac514c70d55b14caf47f19ecbed0b50243583107596f1f164d9d10a884f464f5152ea9d560705f5be1ee995f6d90c878b67e63f3a2f2d63365daca1c2efb6
-
SSDEEP
12288:gYdjvQ+OH3Q51I1e6jcyLuli0yLu3JVUjZFK81lw3z4JlUWF+AlJinJ1Jcy7gHIR:JY5g5yX4Tli02gVklw3z4JdF8rJcyUoR
Malware Config
Signatures
Files
-
c6b5cd5603a5de618efa07f9b4bd2a02a21b3d251accf0288f5fdc7eb5f6225c.exe windows x86
991ce5e421f3378eacc4b16b899f878e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetSystemPowerState
AddAtomA
Module32Next
SetThreadAffinityMask
GetConsoleScreenBufferInfo
GetConsoleAliasExesLengthA
GetSystemDefaultUILanguage
GetFullPathNameW
GetNamedPipeInfo
OpenSemaphoreW
CreateEventA
CreateMutexA
GetDevicePowerState
GetStdHandle
LCMapStringW
OpenFileMappingW
GetLogicalDriveStringsA
FindFirstVolumeW
OpenJobObjectA
GetConsoleAliasesA
IsValidCodePage
ChangeTimerQueueTimer
SetFileTime
EnumCalendarInfoA
GetBinaryTypeA
SetThreadPriorityBoost
Module32NextW
MapViewOfFileEx
OpenEventW
SetStdHandle
FindResourceExA
OpenMutexA
DuplicateHandle
GetPrivateProfileSectionW
CreateIoCompletionPort
GetConsoleCursorInfo
CopyFileW
SetProcessWorkingSetSize
GetConsoleAliasExesLengthW
EnumCalendarInfoW
CreateJobObjectA
ReadFile
CreateEventW
SetConsoleActiveScreenBuffer
FindVolumeMountPointClose
GetConsoleAliasExesA
SetFileAttributesW
GetDiskFreeSpaceExA
CreateWaitableTimerA
GetNamedPipeHandleStateW
GetDriveTypeW
CreateWaitableTimerW
GetFileAttributesExW
SetThreadLocale
CreateSemaphoreA
SetCalendarInfoW
CancelIo
SetConsoleMode
ReadDirectoryChangesW
VirtualAlloc
GetConsoleAliasW
GetVolumeInformationA
GetLogicalDriveStringsW
GetStringTypeExW
CreateDirectoryW
MoveFileWithProgressW
GetCurrencyFormatA
FindResourceA
SetWaitableTimer
GetPrivateProfileStringW
GetProfileIntW
CreateMutexW
GetEnvironmentStrings
SetThreadContext
GetLogicalDrives
GetCalendarInfoW
VerSetConditionMask
GetPrivateProfileStructA
EnumCalendarInfoExA
FlushConsoleInputBuffer
GetSystemWindowsDirectoryA
SetFileAttributesA
GetDiskFreeSpaceA
SetEvent
GetCurrentDirectoryA
GetProcessTimes
GetSystemDirectoryA
FindResourceW
SetSystemTimeAdjustment
OpenSemaphoreA
GetEnvironmentVariableW
FindVolumeClose
SetLocaleInfoA
GetStringTypeExA
CancelWaitableTimer
ResetWriteWatch
GetModuleFileNameW
GetTempPathA
ProcessIdToSessionId
GetConsoleAliasA
CreateFileMappingW
GetFileAttributesW
SetMailslotInfo
CreateJobObjectW
FindAtomA
MapUserPhysicalPagesScatter
GetProcessWorkingSetSize
CreateNamedPipeW
GetPrivateProfileStructW
CreateTimerQueue
CreateHardLinkA
GetUserDefaultUILanguage
ExpandEnvironmentStringsW
SetProcessPriorityBoost
GetLongPathNameA
OpenFileMappingA
CreateMailslotW
GetStringTypeA
Module32First
MapViewOfFile
SetEndOfFile
GetTimeFormatW
LCMapStringA
GetThreadLocale
CreateFileW
SetConsoleDisplayMode
GetEnvironmentVariableA
GetSystemWindowsDirectoryW
ReleaseMutex
OpenEventA
DeviceIoControl
BindIoCompletionCallback
AreFileApisANSI
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameA
GetThreadTimes
PostQueuedCompletionStatus
FindAtomW
GetShortPathNameA
GetThreadPriority
SetCurrentDirectoryA
GetPrivateProfileSectionNamesW
DeleteAtom
MapUserPhysicalPages
GetCompressedFileSizeW
GetProfileSectionW
GetSystemDefaultLangID
GetConsoleAliasesW
CreateSemaphoreW
Module32FirstW
FlushViewOfFile
GetProcessPriorityBoost
MoveFileWithProgressA
OpenJobObjectW
GetDateFormatA
CreateDirectoryExA
ResetEvent
FindFirstVolumeMountPointA
FindResourceExW
GetPrivateProfileIntW
GetSystemDirectoryW
SetThreadExecutionState
SetConsoleOutputCP
GetACP
GetNumberFormatA
GetProfileIntA
VerifyVersionInfoW
OpenWaitableTimerW
GetFileTime
CopyFileA
SetInformationJobObject
GetLocaleInfoA
CreateTapePartition
GetVolumeNameForVolumeMountPointA
GetUserDefaultLCID
SetErrorMode
GetTimeFormatA
FoldStringW
OpenProcess
SetTapeParameters
ConvertThreadToFiber
GetFileType
EnumCalendarInfoExW
GetHandleInformation
SearchPathA
GetNumberOfConsoleInputEvents
GetThreadContext
GetDiskFreeSpaceExW
DefineDosDeviceW
GetLongPathNameW
GetProcessVersion
CreateToolhelp32Snapshot
DefineDosDeviceA
SetComputerNameExW
CreateFileMappingA
FindFirstFileExA
AssignProcessToJobObject
DnsHostnameToComputerNameW
SetUnhandledExceptionFilter
GetConsoleMode
SetConsoleTextAttribute
IsBadWritePtr
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
GetUserDefaultLangID
GetNumberFormatW
DisconnectNamedPipe
GetWindowsDirectoryW
SetEnvironmentVariableA
FlushInstructionCache
GetPrivateProfileSectionA
DeleteTimerQueueTimer
CreateDirectoryExW
VirtualQuery
GetPriorityClass
SleepEx
GetMailslotInfo
FreeEnvironmentStringsW
GetFileSizeEx
GetSystemDefaultLCID
FreeLibraryAndExitThread
FindFirstFileA
SetConsoleCP
GlobalLock
OpenWaitableTimerA
CreateDirectoryA
GetFullPathNameA
WritePrivateProfileStringW
GetDiskFreeSpaceW
PrepareTape
FindNextFileA
SearchPathW
DeleteTimerQueue
SetProcessAffinityMask
FreeEnvironmentStringsA
IsSystemResumeAutomatic
SetCurrentDirectoryW
FindNextChangeNotification
SetHandleCount
WaitForSingleObjectEx
FormatMessageA
RemoveDirectoryA
GlobalUnlock
lstrcatW
GetDateFormatW
GetCPInfoExW
AddAtomW
GetCommandLineA
GetCPInfo
ReplaceFileW
SetHandleInformation
GetConsoleOutputCP
GetStringTypeW
WideCharToMultiByte
GetOEMCP
GetComputerNameW
LocalReAlloc
GetFileSize
CopyFileExA
GetAtomNameW
GetNamedPipeHandleStateA
GlobalMemoryStatus
GetProfileSectionA
TlsAlloc
SetPriorityClass
LocalFileTimeToFileTime
GlobalHandle
DeleteTimerQueueEx
IsDBCSLeadByteEx
SetTapePosition
FindFirstVolumeA
FlushFileBuffers
FreeResource
GetVolumePathNameA
GetCurrentConsoleFont
GetLocaleInfoW
EraseTape
SetLocaleInfoW
PeekNamedPipe
ContinueDebugEvent
FreeConsole
MultiByteToWideChar
SetVolumeMountPointA
GetConsoleWindow
CompareStringA
HeapReAlloc
HeapAlloc
GetProfileStringW
ExpandEnvironmentStringsA
SwitchToThread
ReleaseSemaphore
GetPrivateProfileStringA
SetConsoleCtrlHandler
GetProcessIoCounters
OpenMutexW
ConvertDefaultLocale
CopyFileExW
ReplaceFileA
SetThreadPriority
CreateNamedPipeA
GetTapeStatus
DosDateTimeToFileTime
GetProfileStringA
SetComputerNameExA
GetPrivateProfileSectionNamesA
DeleteVolumeMountPointA
GetConsoleAliasExesW
CreateMailslotA
GetCurrentThread
FormatMessageW
GetFileInformationByHandle
GetFileAttributesExA
FoldStringA
GetCurrencyFormatW
GetCPInfoExA
GetProcessAffinityMask
DnsHostnameToComputerNameA
GetAtomNameA
SetNamedPipeHandleState
LoadResource
SetThreadIdealProcessor
QueryInformationJobObject
OpenThread
FreeUserPhysicalPages
GetVolumeInformationW
GetWindowsDirectoryA
ReadProcessMemory
CompareStringW
GetShortPathNameW
GetConsoleCP
GetCalendarInfoA
GetVolumePathNameW
GetFileAttributesA
GetBinaryTypeW
CreateHardLinkW
GetCurrentProcess
GetDriveTypeA
Toolhelp32ReadProcessMemory
GetTempPathW
GetCompressedFileSizeA
GetVersion
GetPrivateProfileIntA
SetCalendarInfoA
HeapSetInformation
ExitProcess
DecodePointer
WriteFile
GetEnvironmentStringsW
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
HeapFree
Sleep
RtlUnwind
HeapSize
IsProcessorFeaturePresent
user32
IsCharAlphaA
advapi32
OpenThreadToken
RegEnumValueA
OpenSCManagerW
AllocateAndInitializeSid
InitializeAcl
RegOpenKeyW
QueryServiceStatus
RegNotifyChangeKeyValue
IsValidSid
RegEnumKeyExW
RegisterEventSourceW
CryptAcquireContextA
LsaOpenPolicy
GetSecurityDescriptorSacl
DuplicateTokenEx
OpenServiceA
SetSecurityDescriptorDacl
RegDeleteValueA
RegSetValueExA
RegEnumKeyW
SetNamedSecurityInfoW
RegOpenKeyA
CloseServiceHandle
ReportEventW
RegCreateKeyA
DeregisterEventSource
AdjustTokenPrivileges
GetSecurityDescriptorDacl
IsValidSecurityDescriptor
RegCreateKeyExA
RegEnumKeyExA
StartServiceA
RegQueryInfoKeyW
InitializeSecurityDescriptor
CryptGetHashParam
RegEnumKeyA
GetSidSubAuthority
QueryServiceConfigW
GetTokenInformation
SetThreadToken
RegCreateKeyW
MakeSelfRelativeSD
GetSidLengthRequired
RegQueryValueExA
ChangeServiceConfigW
OpenProcessToken
RegSetValueExW
CopySid
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
CryptHashData
GetSidSubAuthorityCount
CryptDestroyKey
Sections
.text Size: 261KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 352KB - Virtual size: 351KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 370KB - Virtual size: 777KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ