ServiceMain
Behavioral task
behavioral1
Sample
0c863e9e65cd0519860d4f39c32c58737f3e336d055a29afff8c4e84631685e7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0c863e9e65cd0519860d4f39c32c58737f3e336d055a29afff8c4e84631685e7.exe
Resource
win10v2004-20221111-en
General
-
Target
0c863e9e65cd0519860d4f39c32c58737f3e336d055a29afff8c4e84631685e7
-
Size
106KB
-
MD5
3c8a36e0343d6a2af86560cba90095ea
-
SHA1
71fabc895b6036b5b4b2813138615e45b8e39717
-
SHA256
0c863e9e65cd0519860d4f39c32c58737f3e336d055a29afff8c4e84631685e7
-
SHA512
fa00ed8c141615e10bffa461be51479d0905f69fe084ea961f09824625729833ed1742eeb3215944ab57fdacf6bc3e4938868b4db9d53a97a7e7d331b273c7f7
-
SSDEEP
3072:7YBjzosGnQpOe237XE35XeE79enCiM5cEwDjAS+R:XsGQwb37XE3ZeykGnqES+R
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
0c863e9e65cd0519860d4f39c32c58737f3e336d055a29afff8c4e84631685e7.exe windows x86
2b1a9cb0a9e93da797c56cf5aa861ec8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strcspn
atoi
strchr
strtoul
strncpy
strstr
srand
rand
memset
memcpy
kernel32
LoadLibraryA
CloseHandle
WriteFile
lstrlenA
CreateFileA
lstrcatA
GetTickCount
GetTempPathA
GetModuleFileNameA
GetProcAddress
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
InterlockedExchangeAdd
LocalFree
InterlockedExchange
LocalAlloc
CreateProcessA
SetErrorMode
CreateThread
WaitForSingleObject
CopyFileA
TerminateProcess
DisconnectNamedPipe
ExitProcess
ConnectNamedPipe
CreateNamedPipeA
SetFilePointer
GetWindowsDirectoryA
DeleteFileA
Sleep
ReadFile
VirtualProtect
ExitProcess
user32
wsprintfA
advapi32
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
CreateServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ws2_32
setsockopt
WSAGetLastError
WSASocketA
send
inet_addr
connect
WSAIoctl
recv
WSAStartup
gethostbyname
htons
sendto
htonl
closesocket
socket
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 880B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ