?PutMutexOriginal@@IJMDFFJ@X
Static task
static1
Behavioral task
behavioral1
Sample
74380f3c84fc9996c0acdfa49102bbe1043d737639074c191333af0deaaac528.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
74380f3c84fc9996c0acdfa49102bbe1043d737639074c191333af0deaaac528.dll
Resource
win10v2004-20220812-en
General
-
Target
74380f3c84fc9996c0acdfa49102bbe1043d737639074c191333af0deaaac528
-
Size
331KB
-
MD5
42a472c0f5ea37c647bfef4482151d40
-
SHA1
dce3e7fd989558ecb520a09e6146d5b060ac8e7b
-
SHA256
74380f3c84fc9996c0acdfa49102bbe1043d737639074c191333af0deaaac528
-
SHA512
4846a6d6be5b135fb312c8518ec92761e566237caf91777933843ad105916673643df9666d9ed6e8a3f79eba123cb9c961782003bd3b39c3630edcd3aebb9b70
-
SSDEEP
6144:0ys01PLaJ3Hnv4sGA8sxWae6u2Bya/rtU61I+AK3uK6HxjnLJtQodWihh18:3ZQ3Pus4ae6lyap1I+Ayu7HxjnLbQU8
Malware Config
Signatures
Files
-
74380f3c84fc9996c0acdfa49102bbe1043d737639074c191333af0deaaac528.dll windows x86
104544ec7b8fd5109f561119852cd215
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmHighestUserAddress
MmForceSectionClosed
MmUnmapIoSpace
ZwOpenProcess
IoReleaseRemoveLockAndWaitEx
ObMakeTemporaryObject
ObfReferenceObject
CcRemapBcb
IoQueryFileDosDeviceName
SeDeleteObjectAuditAlarm
IoGetCurrentProcess
IoGetStackLimits
ExDeletePagedLookasideList
IoRegisterDeviceInterface
SeAccessCheck
ObInsertObject
RtlAreBitsClear
SePrivilegeCheck
SeQueryAuthenticationIdToken
IoMakeAssociatedIrp
RtlFreeAnsiString
RtlCopySid
PsGetProcessExitTime
ObGetObjectSecurity
IoAllocateController
KeRundownQueue
KeSynchronizeExecution
ZwDeviceIoControlFile
SeAssignSecurity
ZwMapViewOfSection
IoInitializeTimer
CcFastMdlReadWait
ZwEnumerateValueKey
IoGetDeviceToVerify
IoAcquireCancelSpinLock
RtlUpcaseUnicodeString
ZwCreateFile
ProbeForWrite
IoWriteErrorLogEntry
ObCreateObject
MmIsVerifierEnabled
SeSetSecurityDescriptorInfo
MmAdvanceMdl
PoRegisterSystemState
SeCaptureSubjectContext
RtlFillMemoryUlong
IoFreeIrp
PsGetCurrentProcessId
IoEnumerateDeviceObjectList
PsChargeProcessPoolQuota
ExRaiseAccessViolation
RtlInitString
KeInitializeMutex
SeValidSecurityDescriptor
DbgBreakPoint
RtlCopyString
KeQueryTimeIncrement
KeSaveFloatingPointState
IoSetDeviceToVerify
PsGetCurrentProcess
IoGetRequestorProcess
RtlDeleteElementGenericTable
ObReferenceObjectByPointer
IoUnregisterFileSystem
IoGetDriverObjectExtension
CcFastCopyRead
WmiQueryTraceInformation
ZwQueryKey
MmFreeMappingAddress
MmUnlockPages
IofCompleteRequest
IoFreeController
MmUnsecureVirtualMemory
PoUnregisterSystemState
ExGetSharedWaiterCount
MmLockPagableDataSection
ExNotifyCallback
RtlCreateSecurityDescriptor
IoSetDeviceInterfaceState
RtlFindNextForwardRunClear
ZwQueryVolumeInformationFile
RtlFindSetBits
IoGetLowerDeviceObject
IoCreateDevice
IoDisconnectInterrupt
KeGetCurrentThread
IoQueryFileInformation
SeTokenIsRestricted
KeReadStateSemaphore
KeSetTimerEx
CcUninitializeCacheMap
FsRtlIsDbcsInExpression
FsRtlLookupLastLargeMcbEntry
CcMdlWriteAbort
MmQuerySystemSize
CcPreparePinWrite
RtlDowncaseUnicodeString
MmAllocateMappingAddress
DbgBreakPointWithStatus
RtlGenerate8dot3Name
SeFilterToken
RtlSetBits
ExAllocatePoolWithQuota
KeEnterCriticalRegion
ExUuidCreate
ObReleaseObjectSecurity
RtlFindClearBitsAndSet
ExReinitializeResourceLite
RtlFreeUnicodeString
RtlTimeToSecondsSince1980
KefAcquireSpinLockAtDpcLevel
MmPageEntireDriver
KeInitializeSemaphore
RtlCreateRegistryKey
CcGetFileObjectFromBcb
SeOpenObjectAuditAlarm
IoRegisterFileSystem
ZwQuerySymbolicLinkObject
KeUnstackDetachProcess
IoReadDiskSignature
RtlInitAnsiString
PsGetCurrentThread
RtlGetNextRange
FsRtlCheckOplock
ZwDeleteValueKey
IoSetThreadHardErrorMode
IoGetAttachedDevice
IoVerifyVolume
MmGetPhysicalAddress
MmResetDriverPaging
IoIsWdmVersionAvailable
ZwFreeVirtualMemory
ExIsProcessorFeaturePresent
IoReadPartitionTableEx
MmUnmapLockedPages
IoIsOperationSynchronous
IoAllocateMdl
KeCancelTimer
KeResetEvent
CcMdlReadComplete
IoQueueWorkItem
RtlLengthRequiredSid
PsIsThreadTerminating
MmLockPagableSectionByHandle
MmGetSystemRoutineAddress
RtlxOemStringToUnicodeSize
IoBuildSynchronousFsdRequest
IoCheckQuotaBufferValidity
FsRtlFreeFileLock
KeSetPriorityThread
PoCallDriver
ExAcquireResourceSharedLite
ExCreateCallback
KeQuerySystemTime
RtlEqualSid
RtlUnicodeStringToInteger
RtlTimeToTimeFields
PsRevertToSelf
SeLockSubjectContext
RtlInitializeBitMap
CcDeferWrite
IoUpdateShareAccess
MmMapIoSpace
RtlUpcaseUnicodeChar
IoVerifyPartitionTable
RtlCompareString
ExQueueWorkItem
KeWaitForSingleObject
RtlGetCallersAddress
KeInitializeTimer
KeSetEvent
KeSetKernelStackSwapEnable
RtlWriteRegistryValue
KeClearEvent
RtlHashUnicodeString
MmAllocatePagesForMdl
RtlVerifyVersionInfo
MmIsDriverVerifying
KeRegisterBugCheckCallback
IoGetDeviceInterfaces
RtlSplay
ZwMakeTemporaryObject
RtlUpperString
IoThreadToProcess
MmSetAddressRangeModified
ExGetPreviousMode
IoRaiseHardError
SeFreePrivileges
IoReadPartitionTable
MmMapLockedPages
IoAllocateAdapterChannel
RtlMultiByteToUnicodeN
ZwOpenSection
IoQueryDeviceDescription
ExDeleteResourceLite
ZwOpenKey
IoSetStartIoAttributes
IoCsqRemoveIrp
ZwCreateKey
ZwQueryObject
KeInitializeSpinLock
FsRtlSplitLargeMcb
IoSetTopLevelIrp
VerSetConditionMask
ExDeleteNPagedLookasideList
ZwEnumerateKey
IoDeleteSymbolicLink
RtlFindLastBackwardRunClear
CcFlushCache
IoInitializeIrp
FsRtlIsHpfsDbcsLegal
KeRestoreFloatingPointState
IoAllocateErrorLogEntry
RtlGetVersion
ZwUnloadDriver
ProbeForRead
IoGetDeviceProperty
ZwDeleteKey
IoCreateNotificationEvent
KeInitializeDeviceQueue
SeTokenIsAdmin
KeReadStateTimer
RtlFindLongestRunClear
ZwReadFile
RtlCharToInteger
ZwFsControlFile
KeInsertByKeyDeviceQueue
MmAllocateNonCachedMemory
HalExamineMBR
IoReleaseCancelSpinLock
KeRemoveQueueDpc
MmFreeNonCachedMemory
MmUnlockPagableImageSection
IoAllocateIrp
PsGetVersion
RtlInsertUnicodePrefix
KeQueryActiveProcessors
RtlTimeFieldsToTime
KeBugCheckEx
FsRtlFastCheckLockForRead
KeInsertHeadQueue
ZwCreateEvent
ZwSetVolumeInformationFile
RtlLengthSecurityDescriptor
PsCreateSystemThread
RtlxUnicodeStringToAnsiSize
ExFreePool
MmMapLockedPagesSpecifyCache
RtlEqualUnicodeString
IoGetBootDiskInformation
IoSetSystemPartition
RtlSetDaclSecurityDescriptor
FsRtlNotifyInitializeSync
RtlDeleteNoSplay
MmCanFileBeTruncated
CcMdlWriteComplete
SeSinglePrivilegeCheck
MmSizeOfMdl
FsRtlDeregisterUncProvider
IoGetDiskDeviceObject
IoGetTopLevelIrp
Exports
Exports
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ