ServiceMain
Behavioral task
behavioral1
Sample
14da4e18a03485951ed93d9fa9ea036852b65e0b7a2e7e8100d2a52d9113d128.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
14da4e18a03485951ed93d9fa9ea036852b65e0b7a2e7e8100d2a52d9113d128.exe
Resource
win10v2004-20221111-en
General
-
Target
14da4e18a03485951ed93d9fa9ea036852b65e0b7a2e7e8100d2a52d9113d128
-
Size
122KB
-
MD5
2532596187f5a3de342e2d7812ec09c9
-
SHA1
62b31d12f6dfd938597c02119d91fabd23d366cb
-
SHA256
14da4e18a03485951ed93d9fa9ea036852b65e0b7a2e7e8100d2a52d9113d128
-
SHA512
54a89f621c63069baa2253bfffaa7049fcc59fdf02561d1c34edab34c46eefedb39b01face27e035ebb564a2000a3c007cac546c2814dadf174423d49ed260f6
-
SSDEEP
3072:unDHH47khTSHz4dwqKdM6i4JGpZh37uLjudqz9d0kQ:uDn440zt46i4EruLorkQ
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
14da4e18a03485951ed93d9fa9ea036852b65e0b7a2e7e8100d2a52d9113d128.exe windows x86
80c2a7bb330a1d345e5a0aa80091a6cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strchr
memset
strcspn
atoi
strstr
memcpy
strtoul
strncpy
srand
rand
kernel32
LoadLibraryA
CloseHandle
WriteFile
lstrlenA
CreateFileA
lstrcatA
GetTickCount
GetTempPathA
GetModuleFileNameA
GetProcAddress
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
InterlockedExchangeAdd
LocalFree
LocalAlloc
CreateProcessA
SetErrorMode
CreateThread
WaitForSingleObject
InterlockedExchange
CopyFileA
TerminateProcess
DisconnectNamedPipe
ReadFile
ExitProcess
CreateNamedPipeA
SetFilePointer
GetWindowsDirectoryA
DeleteFileA
Sleep
ConnectNamedPipe
VirtualProtect
ExitProcess
user32
wsprintfA
advapi32
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
CreateServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ole32
CoInitializeEx
ws2_32
setsockopt
WSAGetLastError
WSASocketA
recv
connect
gethostbyname
inet_addr
WSAIoctl
WSAStartup
send
socket
closesocket
htons
sendto
htonl
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 984B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ