Static task
static1
Behavioral task
behavioral1
Sample
61b9ddaa0fc14908eda8aeba85b217e21dcfbef25a4d26eb3744b6ed0c2af2c2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
61b9ddaa0fc14908eda8aeba85b217e21dcfbef25a4d26eb3744b6ed0c2af2c2.exe
Resource
win10v2004-20220812-en
General
-
Target
61b9ddaa0fc14908eda8aeba85b217e21dcfbef25a4d26eb3744b6ed0c2af2c2
-
Size
87KB
-
MD5
f15b4490ffe7a409e096c95a099c0c15
-
SHA1
88177f53725ad70c40ef192c189a4ee293e3c73a
-
SHA256
61b9ddaa0fc14908eda8aeba85b217e21dcfbef25a4d26eb3744b6ed0c2af2c2
-
SHA512
f811745e21f042deebb9e9a8915f5b1f118c3cbd729eca0f4fbb226fc4fcca247838bf432c5694628674e7ae06c2902739e467a9c7c4d807fbb79c840809ebf5
-
SSDEEP
1536:JjlA5i/DcDSemPyA3srVt6pPSMOTCCt8QgI/lL34cmesaPGBj0kpp:JjK0/Ye78rVsBEuCH9JDmes70
Malware Config
Signatures
Files
-
61b9ddaa0fc14908eda8aeba85b217e21dcfbef25a4d26eb3744b6ed0c2af2c2.exe windows x86
64b3b3579c4ff3b856521fe174d6386f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetFocus
DdeSetUserHandle
CreateDialogParamW
MessageBoxW
CreateDialogIndirectParamA
SwitchDesktop
ModifyMenuW
SetMenuItemBitmaps
LoadStringW
SetCaretPos
GetDC
GetProcessWindowStation
UnionRect
GetMessageExtraInfo
SendMessageCallbackA
SetWindowsHookExW
DefWindowProcW
CloseWindow
SwitchToThisWindow
LoadMenuA
GetKeyboardLayoutList
GetKeyboardLayout
DdeUninitialize
GetMenuItemRect
MessageBoxExW
RegisterClassA
PostThreadMessageA
ExitWindowsEx
CallMsgFilterA
DdeFreeDataHandle
MessageBeep
ToUnicodeEx
UnregisterClassA
MessageBoxIndirectA
EnableMenuItem
DefFrameProcA
HiliteMenuItem
CascadeWindows
VkKeyScanA
CheckDlgButton
LoadMenuIndirectW
DrawCaption
DlgDirSelectComboBoxExW
FindWindowExA
DdeImpersonateClient
GetClassNameA
EnumDesktopsA
LoadCursorA
ChangeDisplaySettingsExA
EnumDisplaySettingsExA
GetCaretPos
ShowWindowAsync
TrackMouseEvent
InsertMenuW
GetDesktopWindow
CharLowerA
EnumPropsA
DialogBoxIndirectParamA
SetMenuContextHelpId
InvertRect
InsertMenuItemW
CreateWindowExA
UnregisterHotKey
EnableScrollBar
DialogBoxIndirectParamW
EnumDisplayDevicesW
OemKeyScan
GetUserObjectSecurity
DdeAccessData
CharUpperA
WindowFromPoint
ShowOwnedPopups
IsDialogMessage
LoadAcceleratorsA
CharNextW
CallMsgFilterW
RealChildWindowFromPoint
ValidateRect
UnregisterDeviceNotification
SetSysColors
SendMessageTimeoutW
SetDlgItemTextA
GetMenuStringW
DrawFocusRect
SetWindowTextA
FlashWindow
SetSystemCursor
GetUserObjectInformationW
OemToCharBuffW
CharToOemBuffA
CreateMenu
IsCharUpperA
SetDlgItemInt
SetWindowsHookW
CascadeChildWindows
DrawTextW
GetUpdateRect
InternalGetWindowText
DdeConnectList
SetScrollPos
TileWindows
FlashWindowEx
WINNLSGetEnableStatus
EndMenu
DdeQueryStringA
ExcludeUpdateRgn
GetKeyboardLayoutNameA
GetInputState
ChildWindowFromPoint
LoadImageW
RegisterHotKey
GetGUIThreadInfo
LoadStringA
EnumPropsExW
GetMenuItemID
CheckRadioButton
UnhookWindowsHookEx
GetClassLongA
GetKBCodePage
IsCharAlphaW
GetMessageW
OpenWindowStationW
SetUserObjectSecurity
GetWindowTextA
ShowCaret
CharPrevW
GetWindowPlacement
RegisterClassExA
GetCursorInfo
InvalidateRgn
RegisterClipboardFormatW
AnimateWindow
DrawTextExW
DdeAddData
ScrollDC
GetSubMenu
DlgDirListComboBoxA
MapWindowPoints
SwapMouseButton
IsCharLowerA
SetWinEventHook
RegisterWindowMessageW
OffsetRect
CloseWindowStation
AdjustWindowRect
RegisterDeviceNotificationW
kernel32
EnumDateFormatsExA
FormatMessageW
SetTapeParameters
lstrcatW
CreatePipe
GetThreadContext
SetVolumeLabelW
GlobalAddAtomW
FindFirstChangeNotificationW
GetEnvironmentVariableW
GlobalSize
GetPrivateProfileIntW
WaitForMultipleObjectsEx
IsBadReadPtr
GlobalDeleteAtom
OpenEventW
WaitCommEvent
GenerateConsoleCtrlEvent
GetLargestConsoleWindowSize
GlobalFix
GetCalendarInfoA
SetConsoleTitleA
GetCurrencyFormatA
VirtualAlloc
ReadConsoleOutputCharacterA
GlobalLock
GlobalFindAtomA
ExpandEnvironmentStringsA
GetModuleHandleA
WaitForDebugEvent
FoldStringW
WritePrivateProfileStringA
GetSystemPowerStatus
FlushConsoleInputBuffer
ReadConsoleW
GetNamedPipeHandleStateA
QueueUserAPC
ContinueDebugEvent
GetVersionExW
ClearCommBreak
IsBadCodePtr
CreateDirectoryExA
FindNextFileA
QueryPerformanceFrequency
GlobalCompact
WritePrivateProfileSectionA
EnumTimeFormatsA
BuildCommDCBAndTimeoutsW
ReadProcessMemory
CommConfigDialogW
VirtualAllocEx
QueryDosDeviceA
GetEnvironmentStringsW
WriteFileEx
GetLogicalDriveStringsW
FreeEnvironmentStringsA
CreateMutexA
EscapeCommFunction
GetCommProperties
SetHandleInformation
SizeofResource
CompareStringW
GetDiskFreeSpaceW
WriteProcessMemory
SetProcessPriorityBoost
TlsAlloc
SetComputerNameA
UnlockFileEx
ReadFileScatter
ReleaseSemaphore
EnumSystemCodePagesW
GetMailslotInfo
SetConsoleTextAttribute
GetShortPathNameA
Process32First
GetDateFormatW
GetProfileIntA
EnumTimeFormatsW
GetFileAttributesExA
GetConsoleCursorInfo
CreateProcessW
lstrcpynA
SetCurrentDirectoryW
GetTempPathW
EnumCalendarInfoExW
GetPrivateProfileStringW
UnlockFile
ReadConsoleOutputW
SetThreadAffinityMask
GetComputerNameW
ReadConsoleInputW
ConvertDefaultLocale
OpenWaitableTimerA
GetOverlappedResult
GetPrivateProfileSectionNamesW
FileTimeToDosDateTime
GetOEMCP
SetConsoleActiveScreenBuffer
ClearCommError
WritePrivateProfileSectionW
GetBinaryTypeA
PeekConsoleInputA
SetCalendarInfoW
PeekNamedPipe
Heap32Next
WritePrivateProfileStructA
SetConsoleMode
GetSystemDefaultLangID
SetupComm
SetComputerNameW
lstrcmpiW
GetCommState
SetConsoleScreenBufferSize
VirtualProtect
ReleaseMutex
GetExitCodeThread
GlobalReAlloc
DosDateTimeToFileTime
OpenSemaphoreW
FindResourceW
GetLongPathNameW
LocalAlloc
GetCPInfoExW
ReadFile
BackupWrite
GetProfileSectionA
GetProcessPriorityBoost
GetFileAttributesA
SetFileTime
VerLanguageNameA
LocalFree
FatalAppExitW
GetDriveTypeA
GetProcessTimes
FindFirstChangeNotificationA
advapi32
GetSecurityDescriptorControl
OpenBackupEventLogW
CryptSetProviderExW
InitializeAcl
SetEntriesInAclW
NotifyChangeEventLog
OpenEventLogA
RegQueryInfoKeyA
ObjectPrivilegeAuditAlarmA
GetOverlappedAccessResults
GetFileSecurityA
RegConnectRegistryW
ObjectOpenAuditAlarmW
CryptGetDefaultProviderA
GetServiceKeyNameA
LookupAccountNameA
ObjectDeleteAuditAlarmW
ImpersonateLoggedOnUser
EnumServicesStatusW
CryptEnumProviderTypesW
ControlService
RegCreateKeyExW
GetTrusteeTypeA
DestroyPrivateObjectSecurity
InitializeSid
InitiateSystemShutdownW
GetAuditedPermissionsFromAclA
CryptDuplicateHash
CryptGenRandom
CreatePrivateObjectSecurity
GetEffectiveRightsFromAclW
RegUnLoadKeyW
GetAclInformation
GetNamedSecurityInfoExA
CryptDeriveKey
GetEffectiveRightsFromAclA
OpenEventLogW
RegNotifyChangeKeyValue
RegEnumValueA
ObjectCloseAuditAlarmW
RegLoadKeyW
LookupSecurityDescriptorPartsA
GetSecurityDescriptorSacl
GetPrivateObjectSecurity
ReadEventLogA
SetSecurityDescriptorDacl
GetOldestEventLogRecord
GetMultipleTrusteeOperationA
ObjectOpenAuditAlarmA
RegReplaceKeyA
PrivilegedServiceAuditAlarmW
GetNamedSecurityInfoExW
EnumDependentServicesA
AddAccessAllowedAce
OpenBackupEventLogA
QueryServiceConfigA
GetAccessPermissionsForObjectA
LookupPrivilegeValueW
UnlockServiceDatabase
LookupPrivilegeDisplayNameW
SetSecurityInfo
SetSecurityInfoExW
CryptEnumProvidersW
StartServiceCtrlDispatcherA
AddAce
SetServiceObjectSecurity
TrusteeAccessToObjectA
LookupPrivilegeDisplayNameA
CryptSetProviderExA
ConvertAccessToSecurityDescriptorW
LookupAccountSidW
CryptGetUserKey
SetSecurityDescriptorGroup
BackupEventLogA
RegOpenKeyExW
RegEnumKeyA
RegQueryMultipleValuesW
OpenSCManagerW
ObjectPrivilegeAuditAlarmW
BuildSecurityDescriptorW
RegQueryInfoKeyW
RegCreateKeyA
GetTrusteeNameA
ReadEventLogW
CreateProcessAsUserW
ObjectDeleteAuditAlarmA
GetSecurityInfo
CryptAcquireContextW
GetLengthSid
SetEntriesInAclA
OpenServiceA
GetCurrentHwProfileA
AreAnyAccessesGranted
GetNamedSecurityInfoW
FindFirstFreeAce
ChangeServiceConfigW
AddAccessDeniedAce
RegReplaceKeyW
BuildImpersonateTrusteeW
RegUnLoadKeyA
MakeSelfRelativeSD
RegCreateKeyExA
SetServiceStatus
InitiateSystemShutdownA
PrivilegedServiceAuditAlarmA
GetMultipleTrusteeW
SetServiceBits
ClearEventLogA
RegEnumKeyW
ChangeServiceConfigA
GetExplicitEntriesFromAclA
GetAccessPermissionsForObjectW
RegSaveKeyA
StartServiceW
GetSecurityDescriptorLength
AdjustTokenGroups
RevertToSelf
BackupEventLogW
shlwapi
ChrCmpIW
PathIsFileSpecA
PathIsContentTypeA
PathIsContentTypeW
PathIsURLA
StrIsIntlEqualA
PathAddBackslashA
PathIsUNCServerW
StrChrA
StrIsIntlEqualW
SHGetInverseCMAP
PathCombineA
UrlHashW
IntlStrEqWorkerA
StrToIntExA
PathGetCharTypeA
PathSearchAndQualifyA
PathCreateFromUrlA
SHSetValueW
UrlCanonicalizeW
PathSkipRootW
PathFindSuffixArrayW
PathIsRootW
PathMakePrettyA
UrlCreateFromPathW
PathRemoveBlanksA
PathFindOnPathA
StrCmpNW
UrlUnescapeA
PathGetArgsA
PathIsUNCServerShareW
SHOpenRegStreamW
PathSearchAndQualifyW
StrPBrkA
SHRegGetUSValueA
SHRegCreateUSKeyW
StrCpyNW
ColorHLSToRGB
SHDeleteEmptyKeyA
UrlIsOpaqueW
SHRegSetUSValueA
SHRegSetUSValueW
PathIsSameRootW
StrCmpNA
PathUndecorateW
SHQueryValueExA
StrToIntA
PathIsPrefixA
UrlUnescapeW
PathIsFileSpecW
PathCreateFromUrlW
StrStrIA
PathGetDriveNumberA
PathGetCharTypeW
SHEnumKeyExW
PathAddBackslashW
PathCompactPathW
PathBuildRootW
PathCompactPathA
PathRelativePathToA
PathCanonicalizeW
PathFindOnPathW
SHAutoComplete
PathFindNextComponentA
UrlGetPartA
StrCmpIW
PathAppendA
IntlStrEqWorkerW
ColorAdjustLuma
SHDeleteKeyW
SHRegQueryUSValueA
PathIsRelativeW
AssocQueryStringByKeyA
AssocQueryStringByKeyW
StrRetToStrW
PathFindNextComponentW
SHQueryInfoKeyA
PathRemoveFileSpecW
AssocQueryKeyA
PathMatchSpecW
PathRemoveExtensionW
PathGetArgsW
AssocQueryStringA
StrCSpnA
wnsprintfW
PathIsDirectoryEmptyA
UrlIsOpaqueA
PathRemoveBackslashA
PathCompactPathExA
PathBuildRootA
UrlIsA
StrChrW
StrCatBuffW
UrlGetLocationA
UrlCompareW
ole32
GetHookInterface
CoGetStandardMarshal
CoLockObjectExternal
CoMarshalInterThreadInterfaceInStream
CoUnmarshalHresult
CoDisconnectObject
CoMarshalHresult
CoTaskMemAlloc
FreePropVariantArray
OleTranslateAccelerator
CoTaskMemFree
CoGetInterfaceAndReleaseStream
OleBuildVersion
GetClassFile
OleSetAutoConvert
CoRegisterMessageFilter
WriteClassStm
CreateAntiMoniker
OleCreateFromFile
CoSwitchCallContext
IsAccelerator
DllDebugObjectRPCHook
IsEqualGUID
CoQueryAuthenticationServices
CoBuildVersion
CoGetInstanceFromFile
OleCreateFromFileEx
EnableHookObject
WriteFmtUserTypeStg
OleFlushClipboard
CoIsOle1Class
CoResumeClassObjects
PropVariantClear
OleCreateFromData
CreateILockBytesOnHGlobal
ProgIDFromCLSID
OleDestroyMenuDescriptor
OleCreateDefaultHandler
ReadClassStm
UpdateDCOMSettings
CoFileTimeToDosDateTime
StgOpenStorageEx
SetDocumentBitStg
OleCreate
IIDFromString
OleRegGetMiscStatus
CoUnmarshalInterface
CoCreateFreeThreadedMarshaler
UtConvertDvtd32toDvtd16
CoFileTimeNow
OleCreateLinkToFileEx
CoRegisterMallocSpy
StgOpenStorage
OleCreateLinkEx
OleDuplicateData
ReadOleStg
CreateDataCache
ReadFmtUserTypeStg
CoInitialize
CoFreeAllLibraries
OleGetAutoConvert
GetHGlobalFromILockBytes
ReleaseStgMedium
DoDragDrop
CoQueryReleaseObject
ReadClassStg
CoQueryProxyBlanket
OleSetClipboard
OleCreateFromDataEx
OleCreateEx
CoRevokeClassObject
CoRegisterSurrogate
WriteClassStg
OleCreateEmbeddingHelper
OleRegGetUserType
StringFromCLSID
OleConvertIStorageToOLESTREAM
CoIsHandlerConnected
CoGetCurrentProcess
CoReleaseServerProcess
OleConvertIStorageToOLESTREAMEx
OleRun
SetConvertStg
CreateItemMoniker
CoDosDateTimeToFileTime
CoTaskMemRealloc
OleIsCurrentClipboard
CoTreatAsClass
CoFreeUnusedLibraries
GetDocumentBitStg
OleCreateStaticFromData
StgCreateStorageEx
OleMetafilePictFromIconAndLabel
OleCreateLink
OleSaveToStream
OleConvertOLESTREAMToIStorage
CoImpersonateClient
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 241B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE