ServiceMain
Behavioral task
behavioral1
Sample
c31a8d3b14394c36c39e4095d049a3404c835879559467d2a0c58b344104b4be.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c31a8d3b14394c36c39e4095d049a3404c835879559467d2a0c58b344104b4be.exe
Resource
win10v2004-20221111-en
General
-
Target
c31a8d3b14394c36c39e4095d049a3404c835879559467d2a0c58b344104b4be
-
Size
122KB
-
MD5
a4cd16ba3f51b62eb9ae3ac906a0a217
-
SHA1
1472576b62096a1efe813d750d9a01b236744ccf
-
SHA256
c31a8d3b14394c36c39e4095d049a3404c835879559467d2a0c58b344104b4be
-
SHA512
7d507f4645b23c971ed2230149295852ad9657ac537895f558dfe364ca0304aad2e9bc16f59dfe023eafab802899dce14f493349f1d5cb9c8de0a4d8071bb8fc
-
SSDEEP
3072:TnDHH47khTSHz4dwqKdM6i4JGpZh37uLjudqz9d0kqC:TDn440zt46i4EruLorkr
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
c31a8d3b14394c36c39e4095d049a3404c835879559467d2a0c58b344104b4be.exe windows x86
80c2a7bb330a1d345e5a0aa80091a6cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strchr
memset
strcspn
atoi
strstr
memcpy
strtoul
strncpy
srand
rand
kernel32
LoadLibraryA
CloseHandle
WriteFile
lstrlenA
CreateFileA
lstrcatA
GetTickCount
GetTempPathA
GetModuleFileNameA
GetProcAddress
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
InterlockedExchangeAdd
LocalFree
LocalAlloc
CreateProcessA
SetErrorMode
CreateThread
WaitForSingleObject
InterlockedExchange
CopyFileA
TerminateProcess
DisconnectNamedPipe
ReadFile
ExitProcess
CreateNamedPipeA
SetFilePointer
GetWindowsDirectoryA
DeleteFileA
Sleep
ConnectNamedPipe
VirtualProtect
ExitProcess
user32
wsprintfA
advapi32
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
CreateServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ole32
CoInitializeEx
ws2_32
setsockopt
WSAGetLastError
WSASocketA
recv
connect
gethostbyname
inet_addr
WSAIoctl
WSAStartup
send
socket
closesocket
htons
sendto
htonl
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 984B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ