Static task
static1
Behavioral task
behavioral1
Sample
865f6a5ef26fd87da4eb958db2da982f04b681ee1721aaebfe431b51dddde7d3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
865f6a5ef26fd87da4eb958db2da982f04b681ee1721aaebfe431b51dddde7d3.exe
Resource
win10v2004-20220812-en
General
-
Target
865f6a5ef26fd87da4eb958db2da982f04b681ee1721aaebfe431b51dddde7d3
-
Size
161KB
-
MD5
0fbd2cdc3187c711a7557aab9f6862c4
-
SHA1
9b6e03e454a1965f5640f209bdf484a042869176
-
SHA256
865f6a5ef26fd87da4eb958db2da982f04b681ee1721aaebfe431b51dddde7d3
-
SHA512
e6bd0e2efe21dc16c60465b3b57c48d7072bbb3aa032810d56a44cdc51a95529f073df9a1fa50ac9e284a10546bc20c05b5178a6424b8d4ab44868718b530ac6
-
SSDEEP
3072:BDNbvGtNHXEmtzoNfXyN/VkWZuRFg2Nf0eKg2gfREZijRL:mtZUJdsWRF3ff3RR71
Malware Config
Signatures
Files
-
865f6a5ef26fd87da4eb958db2da982f04b681ee1721aaebfe431b51dddde7d3.exe windows x86
8e8a99839404430557a48c65013ed060
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
FreeSid
OpenServiceW
RegQueryInfoKeyW
RegisterServiceCtrlHandlerExW
AdjustTokenPrivileges
RegSetValueExW
GetTokenInformation
RegCreateKeyExW
RegEnumKeyExW
DuplicateTokenEx
RegOpenKeyExW
OpenProcessToken
RegNotifyChangeKeyValue
ControlService
AllocateAndInitializeSid
RegDeleteValueW
UnlockServiceDatabase
RegQueryValueExW
RegCloseKey
QueryServiceStatus
OpenSCManagerW
OpenThreadToken
CloseServiceHandle
RegDeleteKeyW
SetServiceStatus
RegEnumValueW
CheckTokenMembership
LockServiceDatabase
iphlpapi
GetAdaptersInfo
kernel32
SetConsoleOS2OemFormat
OpenEventW
lstrcmpiW
CompareStringW
GetTempFileNameA
FreeLibrary
CreateSocketHandle
LockResource
ResetEvent
GetCurrentProcessId
lstrcpynW
OpenSemaphoreW
SetCommState
LocalAlloc
DuplicateHandle
ReadConsoleOutputCharacterA
lstrlenA
TerminateProcess
EnterCriticalSection
GetStdHandle
ReadConsoleInputW
lstrlenW
GetNumaHighestNodeNumber
InterlockedDecrement
LocalHandle
MultiByteToWideChar
SetUnhandledExceptionFilter
FormatMessageW
HeapFree
UnhandledExceptionFilter
DebugActiveProcess
VirtualUnlock
lstrcmpW
GetSystemDefaultLCID
GetDriveTypeW
ReadConsoleOutputAttribute
WaitNamedPipeA
LeaveCriticalSection
VerifyVersionInfoW
GetComputerNameExW
GetOverlappedResult
LCMapStringA
FindFirstFileA
GetExpandedNameA
GetLastError
SetupComm
GetSystemPowerStatus
DelayLoadFailureHook
Beep
InterlockedExchange
GetPrivateProfileSectionNamesW
GetThreadContext
GetProcessHeap
IsDBCSLeadByte
HeapReAlloc
SetCommMask
SetConsoleMenuClose
GetLongPathNameW
GetTickCount
CancelDeviceWakeupRequest
GetCurrentThread
InitializeCriticalSectionAndSpinCount
RaiseException
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
NlsGetCacheUpdateCount
WritePrivateProfileSectionA
CreateEventW
UnregisterWaitEx
CloseHandle
lstrcpyW
SizeofResource
ContinueDebugEvent
SetLastError
GetConsoleCursorMode
lstrcatW
ReadConsoleInputA
GetPrivateProfileStringW
WideCharToMultiByte
LocalFree
HeapDestroy
InterlockedCompareExchange
QueueUserWorkItem
WaitForSingleObject
Sleep
GetCPInfoExW
VirtualAlloc
HeapAlloc
Heap32First
FindResourceW
SetHandleContext
GetProcessVersion
lstrcmpiW
BackupSeek
GetConsoleMode
RegisterWaitForSingleObject
PeekNamedPipe
BaseUpdateAppcompatCache
UnlockFile
GetSystemTimeAsFileTime
LoadResource
TryEnterCriticalSection
InterlockedIncrement
CreateFileW
AddConsoleAliasA
QueryPerformanceCounter
EndUpdateResourceW
GetPrivateProfileSectionW
VDMOperationStarted
DeleteCriticalSection
SetEvent
LocalCompact
DeviceIoControl
mprapi
MprAdminServerConnect
MprAdminServerDisconnect
MprAdminPortEnum
MprAdminBufferFree
MprAdminConnectionGetInfo
msvcrt
wcscmp
wcscat
wcsncpy
_purecall
_onexit
_CxxThrowException
wcstoul
wcscpy
qsort
malloc
__dllonexit
_initterm
wcsstr
_wtoi
_wsplitpath
_vsnprintf
strncpy
_wcsnicmp
wcslen
?terminate@@YAXXZ
_wcsicmp
wcschr
wcsncmp
_snwprintf
__CxxFrameHandler
free
mbstowcs
memmove
_snprintf
wcsrchr
netapi32
NetApiBufferFree
NetGetJoinInformation
ntdll
RtlDeregisterWaitEx
RtlDeregisterWait
RtlGetNtProductType
NtClose
NtOpenFile
RtlNtStatusToDosError
RtlOpenCurrentUser
RtlRegisterWait
RtlInitUnicodeString
VerSetConditionMask
ole32
IIDFromString
CoSetProxyBlanket
CoInitializeEx
CoRevokeClassObject
CoTaskMemFree
CoImpersonateClient
CLSIDFromString
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoRegisterClassObject
CoUninitialize
CoTaskMemAlloc
CoRevertToSelf
oleaut32
VariantInit
SysStringByteLen
VarI4FromStr
SysAllocString
SysAllocStringByteLen
SafeArrayDestroy
SysFreeString
VariantClear
SafeArrayPutElement
SafeArrayGetElement
SafeArrayCreate
rasapi32
RasDeleteEntryW
RasValidateEntryNameW
RasGetConnectStatusW
DwCloneEntry
RasEnumConnectionsW
DwEnumEntryDetails
RasRenameEntryW
RasSetAutodialAddressW
RasHangUpW
rtutils
TraceRegisterExA
TracePrintfA
TraceVprintfExA
secur32
EncryptMessage
QuerySecurityPackageInfoW
QuerySecurityContextToken
LsaRegisterLogonProcess
SaslIdentifyPackageA
QueryContextAttributesA
GetUserNameExW
SecpTranslateName
LsaFreeReturnBuffer
LsaDeregisterLogonProcess
shell32
SHGetFolderPathW
user32
CharNextW
DestroyIcon
UnregisterDeviceNotification
DispatchMessageW
MsgWaitForMultipleObjects
MessageBoxW
ExitWindowsEx
LoadImageW
wsprintfW
LoadStringW
RegisterDeviceNotificationW
wininet
InternetConfirmZoneCrossingW
InternetOpenA
InternetSetPerSiteCookieDecisionA
InternetAlgIdToStringA
InternetWriteFileExW
UnlockUrlCacheEntryStream
SetUrlCacheEntryGroup
InternetOpenW
HttpOpenRequestW
InternetSetCookieExW
InternetCanonicalizeUrlA
FreeUrlCacheSpaceW
FtpCommandW
InternetConfirmZoneCrossing
RetrieveUrlCacheEntryStreamA
InternetEnumPerSiteCookieDecisionA
FindNextUrlCacheGroup
InternetCrackUrlW
InternetSetOptionA
ws2_32
WSAGetLastError
freeaddrinfo
WSAIoctl
WSAEventSelect
WSALookupServiceNextW
WSANSPIoctl
closesocket
WSAStartup
inet_addr
WSAEnumNetworkEvents
WSALookupServiceBeginW
WSALookupServiceEnd
getnameinfo
socket
WSACleanup
getaddrinfo
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.cQmGje Size: 1KB - Virtual size: 29KB
IMAGE_SCN_MEM_READ
.P Size: 2KB - Virtual size: 17KB
IMAGE_SCN_MEM_READ
.zg Size: 1KB - Virtual size: 35KB
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.iJxwak Size: 2KB - Virtual size: 11KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CBGZO Size: 2KB - Virtual size: 35KB
IMAGE_SCN_MEM_READ
.pIMeV Size: 2KB - Virtual size: 10KB
IMAGE_SCN_MEM_READ
.rsrc Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ