Static task
static1
Behavioral task
behavioral1
Sample
d645587074b824627f2257ff6070db700bd02fa99a0da913b881af6d8d6edf59.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d645587074b824627f2257ff6070db700bd02fa99a0da913b881af6d8d6edf59.exe
Resource
win10v2004-20220812-en
General
-
Target
d645587074b824627f2257ff6070db700bd02fa99a0da913b881af6d8d6edf59
-
Size
194KB
-
MD5
74a89126ca8939f43a194a3cfbde87e2
-
SHA1
ed5aa0bfc6971e5237061e751ad2cc236217e87c
-
SHA256
d645587074b824627f2257ff6070db700bd02fa99a0da913b881af6d8d6edf59
-
SHA512
974cdbeab8172c0229e20e9e3c96bbb78a7617bee91c7e44abda2e1544c834ba5bb79301f78a4ccb878694a337df87e89e05632d7e019ba8a88418ddabd18dfd
-
SSDEEP
3072:01N1fWGozJavIm4xX2PyGUZI1DdWfRvf7P/n7JkJDV9Az+9MXAwZOu8Ou57:012HzJagRxmwADdWf5f7LBXXZOuDu5
Malware Config
Signatures
Files
-
d645587074b824627f2257ff6070db700bd02fa99a0da913b881af6d8d6edf59.exe windows x86
a53a02b997935fd8eedcb5f7abab9b9f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleInformation
advapi32
CloseServiceHandle
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
NotifyChangeEventLog
OpenEventLogA
GetNumberOfEventLogRecords
GetOldestEventLogRecord
ReadEventLogA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CreateServiceA
OpenSCManagerA
DeleteService
QueryServiceStatus
OpenServiceA
StartServiceA
ControlService
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegQueryValueExA
secur32
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
ws2_32
ntohl
ntohs
htonl
kernel32
ReadFile
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
DeleteFileA
GetModuleHandleA
OpenProcess
Sleep
SetConsoleCtrlHandler
GetCurrentDirectoryA
GetTempPathA
GetVersionExA
ProcessIdToSessionId
GetCurrentProcessId
GetModuleFileNameA
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
WaitForSingleObject
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
GetProcAddress
LoadLibraryA
GetCurrentProcess
TerminateProcess
MultiByteToWideChar
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
FreeResource
ResetEvent
GetLastError
CreateEventA
FreeLibrary
GetSystemWindowsDirectoryA
SetEvent
CreateThread
WriteFile
WaitNamedPipeA
DisconnectNamedPipe
FlushFileBuffers
ConnectNamedPipe
CreateNamedPipeA
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
IsBadReadPtr
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
EncodePointer
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
GetCommandLineA
HeapSetInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
RtlUnwind
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetModuleFileNameW
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
SetStdHandle
LCMapStringW
GetStringTypeW
Sections
.text Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ