Static task
static1
Behavioral task
behavioral1
Sample
8c6620f5b7176e03a0a2743879e1cec6f67bdf6e19b3784e85bb4e9cee4376ee.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8c6620f5b7176e03a0a2743879e1cec6f67bdf6e19b3784e85bb4e9cee4376ee.exe
Resource
win10v2004-20220812-en
General
-
Target
8c6620f5b7176e03a0a2743879e1cec6f67bdf6e19b3784e85bb4e9cee4376ee
-
Size
351KB
-
MD5
055f06353f967b79506a646807556a20
-
SHA1
2970377ac4bfa49efe5f4bf89d73c568333b3ae7
-
SHA256
8c6620f5b7176e03a0a2743879e1cec6f67bdf6e19b3784e85bb4e9cee4376ee
-
SHA512
6d50679992ed6f59cf4762dd82fd73b81a209015b6aa24662f807cd913758d19bbf78657a4c19aba042b3ddc032142eb86f83cf79b250c5fa87623f0e0db5d5e
-
SSDEEP
6144:6jIsEKnUD+UpaXJ2RzsK2kZkhNc+TyghdQBVi4QbDqQP:G7ExDXAwLZmugYi4Qb+QP
Malware Config
Signatures
Files
-
8c6620f5b7176e03a0a2743879e1cec6f67bdf6e19b3784e85bb4e9cee4376ee.exe windows x86
6574053f4d982ff70d3332cdb9dc3583
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
RpcServerListen
RpcServerRegisterIf
RpcServerRegisterAuthInfoA
RpcServerUseProtseqEpA
RpcServerUnregisterIf
RpcMgmtStopServerListening
NdrServerCall2
kernel32
DeleteFileW
GetLocalTime
PostQueuedCompletionStatus
IsDebuggerPresent
GetPriorityClass
UnlockFile
LocalFree
CompareStringW
GetFileSize
GetTempFileNameW
CreateProcessW
FreeLibrary
ReleaseMutex
QueueUserWorkItem
EnumSystemLocalesA
HeapFree
ReleaseSemaphore
LCMapStringW
CreateFileMappingA
SetFilePointer
WideCharToMultiByte
CreateFileW
CreateTimerQueue
GetACP
GetSystemTime
CreateMutexW
GetShortPathNameA
GetComputerNameW
FreeEnvironmentStringsW
QueryPerformanceFrequency
GetCommandLineA
SetThreadPriority
GetProcessHeap
GlobalMemoryStatusEx
GetUserDefaultLCID
GetVolumePathNamesForVolumeNameW
TlsFree
HeapReAlloc
SetStdHandle
MoveFileW
GetSystemTimeAsFileTime
SetHandleCount
HeapDestroy
GetDriveTypeW
TlsSetValue
CreateDirectoryW
GetOEMCP
GetVolumeInformationW
CreateFileMappingW
GetFileSizeEx
GetQueuedCompletionStatus
SetUnhandledExceptionFilter
UnmapViewOfFile
WriteConsoleA
CopyFileW
CreateTimerQueueTimer
TlsAlloc
RaiseException
GetModuleHandleA
GetSystemInfo
IsValidCodePage
SetFilePointerEx
VirtualFree
LoadLibraryExA
UnregisterWait
CreateSemaphoreW
DeleteTimerQueueEx
CreateThread
OpenProcess
SetErrorMode
ResetEvent
EnterCriticalSection
UnhandledExceptionFilter
CloseHandle
DeleteCriticalSection
LCMapStringA
FlushFileBuffers
TlsGetValue
IsValidLocale
CreateEventW
UnregisterWaitEx
VirtualAlloc
OpenEventA
WaitForSingleObject
SystemTimeToFileTime
HeapSize
SetPriorityClass
GetConsoleMode
GetConsoleOutputCP
WriteFile
SetEndOfFile
FreeEnvironmentStringsA
GetThreadPriority
ExpandEnvironmentStringsW
LockFileEx
DeleteTimerQueueTimer
CreateMutexA
OpenMutexA
GetFileType
CreateIoCompletionPort
CreateEventA
WriteConsoleW
LeaveCriticalSection
RegisterWaitForSingleObject
HeapAlloc
GetStdHandle
SetLastError
GlobalFree
GetComputerNameA
GetCurrentThreadId
GlobalAlloc
RtlUnwind
CompareStringA
GetConsoleCP
ReadFile
WaitForMultipleObjects
MapViewOfFile
CreateFileA
LoadLibraryW
VirtualAllocEx
user32
CharNextExA
CharUpperBuffW
CharPrevExA
wsprintfA
advapi32
GetTokenInformation
InitializeAcl
DuplicateTokenEx
FreeSid
GetTraceEnableFlags
SetServiceStatus
GetTraceEnableLevel
ReportEventW
GetLengthSid
LookupAccountSidA
RegCloseKey
RegisterTraceGuidsA
AddAccessAllowedAce
SetSecurityDescriptorDacl
CloseServiceHandle
RegOpenKeyExW
OpenSCManagerW
DuplicateToken
InitializeSecurityDescriptor
UnregisterTraceGuids
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenServiceW
DeregisterEventSource
AllocateAndInitializeSid
RegCreateKeyExW
StartServiceCtrlDispatcherW
GetTraceLoggerHandle
RegSetValueExW
RegisterEventSourceW
AddAccessDeniedAce
RegQueryValueExW
SetThreadToken
RegisterServiceCtrlHandlerExW
TraceMessage
ConvertStringSecurityDescriptorToSecurityDescriptorA
atmlib
ATMFinish
ATMGetNtmFields
ATMBBoxBaseXYShowTextA
ATMBeginFontChange
ATMFontSelected
ATMGetGlyphListA
ATMRemoveSubstFontW
ATMEnumFontsW
kbdic
KbdLayerDescriptor
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 324KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ