Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
WXCltAidEx.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
WXCltAidEx.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
clsmn.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
clsmn.exe
Resource
win10v2004-20220901-en
Target
4807e30569af6120a9b02a62d72405594d93a91cd949d91cb88f32e03daa73bd
Size
7.7MB
MD5
e2d515c9a1e5947fd1bb6956c72d2686
SHA1
f33094a87f993b7468d4b5cffe7e69fe504802cd
SHA256
4807e30569af6120a9b02a62d72405594d93a91cd949d91cb88f32e03daa73bd
SHA512
98265243feabe117d66dcebe60d4ec42a307510a0cbe5583ecbfd39d9e0eaee601d3e0bc5930e97dc321fb42e548fdcb7f3f9c8038e56cc3b436d3ebc93893d1
SSDEEP
196608:5zy3ze3RkR7e/8h2CJ268q5cxO753RuWuAJhLVhoDqUtXezc5t:4zERuS/8kCJKq5Z53RuYfMqUtOzc5t
Processes:
resource | yara_rule |
---|---|
static1/unpack001/WXCltAidEx.exe | vmprotect |
static1/unpack001/clsmn.exe | vmprotect |
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GdipImageGetFrameDimensionsList
MiniDumpWriteDump
GetProcessMemoryInfo
PathStripToRootW
ConvertDefaultLocale
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
SendMessageW
MessageBoxA
RegDeleteKeyW
OleFlushClipboard
DragFinish
VariantTimeToSystemTime
WinHttpGetProxyForUrl
gethostbyname
SetRectRgn
AlphaBlend
GetFileTitleW
DocumentPropertiesW
ImageList_GetIconSize
OleUIBusyW
LresultFromObject
ImmGetOpenStatus
PlaySoundW
VerQueryValueW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetProcessMemoryInfo
tcp_local_address
MiniDumpWriteDump
SHDeleteKeyW
WSAGetLastError
GetAdaptersInfo
GetFileTime
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
EnumDesktopWindows
MessageBoxA
RegQueryValueExW
CoCreateGuid
SHGetFolderPathW
OleLoadPicture
WinVerifyTrust
RefreshPolicyEx
SetDIBColorTable
AlphaBlend
GetFileTitleW
ClosePrinter
ImageList_GetIconSize
OleUIBusyW
GdipCreateFromHDC
LresultFromObject
ImmGetContext
PlaySoundW
GetFileVersionInfoSizeW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ