Static task
static1
Behavioral task
behavioral1
Sample
b0149e422a175a5cec4ffc168cb7d162f77d07680d4d165c11e84943c4bbbb71.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b0149e422a175a5cec4ffc168cb7d162f77d07680d4d165c11e84943c4bbbb71.exe
Resource
win10v2004-20220812-en
General
-
Target
b0149e422a175a5cec4ffc168cb7d162f77d07680d4d165c11e84943c4bbbb71
-
Size
1.1MB
-
MD5
dca61a94ac913ac9d2adcba962770449
-
SHA1
523a801bc5508a0df45acd66d614071f41a19144
-
SHA256
b0149e422a175a5cec4ffc168cb7d162f77d07680d4d165c11e84943c4bbbb71
-
SHA512
42deb9008e12f451f53a84b98588eddda5f4f85b400392d0b90a4f9709fc8fb270a97b18b5de8db82fbe8cc4139e4a5065f03e5bae95138ea4b8984c28e32b39
-
SSDEEP
24576:QMWCTxNjG1Bhu8obYoSTdS4glYBN6j6Nnpj4nFy67:lTnYvu1Yf04glYBNBpj4F97
Malware Config
Signatures
Files
-
b0149e422a175a5cec4ffc168cb7d162f77d07680d4d165c11e84943c4bbbb71.exe windows x86
e141c8b0776b0def79cd35a781dfde11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnmapViewOfFile
GetFileSize
FreeLibrary
GetPrivateProfileStringA
lstrcmpA
LocalReAlloc
DeleteFileA
IsBadReadPtr
GetModuleFileNameA
lstrcatA
LocalAlloc
LocalFree
SetFilePointer
GetTempPathA
GetTempFileNameA
FindResourceA
WritePrivateProfileStringA
WriteFile
CloseHandle
CreateFileMappingA
GetDiskFreeSpaceA
MulDiv
FindFirstFileA
GetPrivateProfileIntA
SearchPathA
GetSystemInfo
GetLocalTime
GetProfileStringA
WritePrivateProfileSectionA
GetFileTime
GetLastError
UnhandledExceptionFilter
lstrcpynA
QueryPerformanceCounter
GetFullPathNameA
ExpandEnvironmentStringsA
lstrcpyA
Sleep
DisableThreadLibraryCalls
RemoveDirectoryA
IsDBCSLeadByte
GetShortPathNameA
lstrcmpiA
GetVolumeInformationA
SetFileAttributesA
CreateDirectoryA
GetPrivateProfileSectionA
CopyFileA
MoveFileA
GetSystemDirectoryA
FindClose
GetStartupInfoA
lstrlenW
GetFileAttributesW
GetModuleFileNameW
GetSystemDirectoryW
SetLastError
lstrcmpW
CreateFileW
SetErrorMode
CreateEventW
CreateFileMappingW
OpenFileMappingW
GetCurrentThread
ProcessIdToSessionId
OpenProcess
lstrcatW
GetProcessVersion
lstrcpyW
OpenMutexW
CreateFileA
lstrlenA
CompareStringA
EnumResourceLanguagesA
GetModuleHandleA
user32
GetDesktopWindow
SetWindowTextA
ExitWindowsEx
CharToOemA
GetSystemMetrics
CharUpperA
MsgWaitForMultipleObjects
GetWindowRect
GetDC
ReleaseDC
SetWindowPos
LoadStringA
wsprintfA
GetDlgItemTextA
SetTimer
RegisterClassW
SetProcessWindowStation
OpenWindowStationW
GetProcessWindowStation
CloseWindowStation
CloseDesktop
GetUserObjectInformationW
OpenInputDesktop
SetThreadDesktop
GetWindowThreadProcessId
KillTimer
EnumWindows
SetDlgItemTextA
DialogBoxParamA
OemToCharA
DestroyWindow
UpdateWindow
CharNextA
CreateWindowExW
advapi32
SetSecurityDescriptorOwner
InitializeAcl
OpenThreadToken
RegOpenKeyExW
DuplicateToken
CheckTokenMembership
RegOpenCurrentUser
ImpersonateLoggedOnUser
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
LookupPrivilegeValueA
RegSetValueExA
RegEnumValueA
RegDeleteValueA
RegDeleteKeyA
RegFlushKey
RegLoadKeyA
RegUnLoadKeyA
CopySid
RegEnumKeyA
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
CloseServiceHandle
OpenSCManagerA
DeleteService
RevertToSelf
AccessCheck
AddAccessAllowedAce
ole32
CoUninitialize
CoCreateInstance
CoInitialize
OleUninitialize
version
GetFileVersionInfoA
msvcrt
memmove
exit
free
wcschr
_chmod
atol
swprintf
malloc
_chdir
setupapi
SetupDiDestroyDeviceInfoList
SetupDiSetDeviceRegistryPropertyA
SetupDiCallClassInstaller
SetupDiClassGuidsFromNameExA
SetupDiGetClassDescriptionExA
SetupDiSetClassInstallParamsA
rpcrt4
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
Sections
.text Size: 144KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ