Static task
static1
Behavioral task
behavioral1
Sample
74f66bb24fd8810dfa37de1a712ac1f3483f5606fc6cb5125570553e5b5202a9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
74f66bb24fd8810dfa37de1a712ac1f3483f5606fc6cb5125570553e5b5202a9.dll
Resource
win10v2004-20220812-en
General
-
Target
74f66bb24fd8810dfa37de1a712ac1f3483f5606fc6cb5125570553e5b5202a9
-
Size
445KB
-
MD5
76176b84cd50706e3a6cbdcec6505fb0
-
SHA1
de1af39f979ba5910b24214c4ebc43a0b4a6c1c6
-
SHA256
74f66bb24fd8810dfa37de1a712ac1f3483f5606fc6cb5125570553e5b5202a9
-
SHA512
b062851bcdfd1c7b5df1b23af5a795eb55f58217924fd04687b8289149af7e2864449d4eea9fbbff91f0f6960a2d1305b0d00bc72dab5653fd4326eb05c23cb4
-
SSDEEP
6144:eAcPsnO5WdKt4ZiOuLyXBOG9xty6gJ3KKPrjBvQLDsKWBVk1R2YXmPErKFJ:eAcf5QEOuLyXBOG9Py6gJ3ZjBoCkrrk
Malware Config
Signatures
Files
-
74f66bb24fd8810dfa37de1a712ac1f3483f5606fc6cb5125570553e5b5202a9.dll windows x86
ccc465bb7c35f8d3468bf281d0d37dc2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoStartPacket
IoRaiseHardError
IoGetDeviceToVerify
PsSetLoadImageNotifyRoutine
FsRtlNotifyUninitializeSync
IoAllocateErrorLogEntry
PsDereferencePrimaryToken
IoSetDeviceInterfaceState
KeInitializeMutex
IoGetDeviceObjectPointer
IoGetDeviceInterfaceAlias
RtlAnsiStringToUnicodeString
FsRtlNotifyInitializeSync
ZwQueryKey
MmIsAddressValid
RtlUpperChar
PsCreateSystemThread
FsRtlIsNameInExpression
MmSizeOfMdl
IoReleaseCancelSpinLock
MmLockPagableSectionByHandle
ExAllocatePoolWithTag
RtlEqualString
FsRtlIsDbcsInExpression
CcRemapBcb
PoRegisterSystemState
KeQueryTimeIncrement
MmUnlockPagableImageSection
IoAcquireCancelSpinLock
RtlSetDaclSecurityDescriptor
KeInitializeSpinLock
RtlInitString
MmAdvanceMdl
RtlGUIDFromString
RtlEqualUnicodeString
FsRtlIsTotalDeviceFailure
PsGetCurrentThread
KeInitializeApc
PoCallDriver
RtlDowncaseUnicodeString
SeDeassignSecurity
RtlHashUnicodeString
ExRaiseDatatypeMisalignment
RtlAppendStringToString
FsRtlIsHpfsDbcsLegal
ZwOpenProcess
SeAccessCheck
IoInitializeIrp
RtlGetNextRange
ZwCreateFile
IoCheckQuotaBufferValidity
KeInsertQueue
ZwCreateSection
RtlEnumerateGenericTable
IoCreateSynchronizationEvent
RtlInitializeSid
KeReleaseMutex
MmBuildMdlForNonPagedPool
MmUnlockPages
ZwMakeTemporaryObject
RtlInitializeUnicodePrefix
CcCopyWrite
KeRegisterBugCheckCallback
IoGetRelatedDeviceObject
MmCanFileBeTruncated
RtlTimeToTimeFields
RtlSetAllBits
ZwFlushKey
PsLookupProcessByProcessId
RtlValidSecurityDescriptor
RtlFindUnicodePrefix
KeResetEvent
RtlCompareString
PoSetPowerState
ZwQueryValueKey
RtlAppendUnicodeToString
IoDeleteDevice
RtlUpcaseUnicodeString
CcUnpinDataForThread
KeRemoveQueueDpc
RtlUpcaseUnicodeToOemN
RtlNumberOfClearBits
ZwEnumerateKey
RtlCopyLuid
MmPageEntireDriver
IoUpdateShareAccess
IoDeleteController
ZwCreateKey
PsGetCurrentThreadId
KeStackAttachProcess
MmUnmapLockedPages
PsGetVersion
IoGetDeviceInterfaces
RtlInsertUnicodePrefix
ExFreePool
KeBugCheckEx
RtlInt64ToUnicodeString
PsLookupThreadByThreadId
PoStartNextPowerIrp
ExRaiseAccessViolation
ZwEnumerateValueKey
SeValidSecurityDescriptor
IoGetAttachedDeviceReference
KeLeaveCriticalRegion
IoDeleteSymbolicLink
KeRemoveDeviceQueue
RtlRemoveUnicodePrefix
KeInitializeTimer
CcFastMdlReadWait
ZwQueryInformationFile
ExSystemTimeToLocalTime
RtlLengthSecurityDescriptor
ExGetExclusiveWaiterCount
RtlFindLeastSignificantBit
MmQuerySystemSize
MmFreeContiguousMemory
KeEnterCriticalRegion
IoDetachDevice
KeWaitForMultipleObjects
RtlClearBits
KdDisableDebugger
ExSetResourceOwnerPointer
IoGetCurrentProcess
IoWriteErrorLogEntry
IoSetThreadHardErrorMode
KeSetTimerEx
ZwMapViewOfSection
ObGetObjectSecurity
KeBugCheck
IoBuildSynchronousFsdRequest
ExDeleteNPagedLookasideList
IoFreeMdl
IoGetAttachedDevice
ZwOpenSection
FsRtlCheckLockForReadAccess
MmIsDriverVerifying
RtlDeleteNoSplay
ProbeForWrite
IoOpenDeviceRegistryKey
MmAllocateNonCachedMemory
PsGetCurrentProcessId
IoStopTimer
MmUnmapIoSpace
RtlValidSid
KeRemoveByKeyDeviceQueue
KeInitializeTimerEx
KeRundownQueue
ExSetTimerResolution
RtlInitAnsiString
ExUnregisterCallback
IoDeviceObjectType
ExAcquireResourceSharedLite
KeFlushQueuedDpcs
RtlFindLastBackwardRunClear
PsGetCurrentProcess
IoAllocateIrp
KeDelayExecutionThread
RtlUnicodeToMultiByteN
IoGetDeviceProperty
IoGetBootDiskInformation
RtlFindMostSignificantBit
RtlInitializeBitMap
DbgBreakPointWithStatus
FsRtlMdlWriteCompleteDev
KeInitializeDeviceQueue
ExLocalTimeToSystemTime
KeQueryInterruptTime
KeInsertByKeyDeviceQueue
IoCheckEaBufferValidity
KeInsertDeviceQueue
SeQueryAuthenticationIdToken
IoSetHardErrorOrVerifyDevice
SeAssignSecurity
ZwClose
RtlxAnsiStringToUnicodeSize
MmGetSystemRoutineAddress
RtlAreBitsClear
IoDisconnectInterrupt
KeReadStateMutex
ZwCreateDirectoryObject
IoAttachDeviceToDeviceStack
IoCreateFile
RtlSecondsSince1970ToTime
IoQueueWorkItem
IoRegisterDeviceInterface
ExDeletePagedLookasideList
MmSecureVirtualMemory
RtlQueryRegistryValues
IoInvalidateDeviceState
RtlCompareMemory
ObCreateObject
CcPreparePinWrite
KeQueryActiveProcessors
FsRtlIsFatDbcsLegal
FsRtlCheckOplock
RtlMultiByteToUnicodeN
MmIsVerifierEnabled
IoSetSystemPartition
IoGetRequestorProcessId
KeSetTimer
KeSaveFloatingPointState
MmForceSectionClosed
ExVerifySuite
FsRtlFreeFileLock
PoSetSystemState
KeRemoveQueue
SeCreateClientSecurity
ZwQueryObject
MmProbeAndLockPages
RtlFindNextForwardRunClear
RtlUnicodeStringToAnsiString
ExReinitializeResourceLite
KeSetEvent
ExGetPreviousMode
CcCopyRead
IoInitializeTimer
RtlInitUnicodeString
RtlFreeAnsiString
RtlCreateUnicodeString
FsRtlFastUnlockSingle
KeQuerySystemTime
RtlCreateRegistryKey
IoRemoveShareAccess
IoCheckShareAccess
IoRequestDeviceEject
IoConnectInterrupt
FsRtlCheckLockForWriteAccess
CcSetBcbOwnerPointer
ZwReadFile
ZwFreeVirtualMemory
ZwDeleteKey
RtlCreateSecurityDescriptor
ObQueryNameString
FsRtlFastCheckLockForRead
KePulseEvent
KeGetCurrentThread
IoGetDriverObjectExtension
KeDeregisterBugCheckCallback
RtlAddAccessAllowedAceEx
ZwDeviceIoControlFile
IoReportResourceForDetection
RtlCheckRegistryKey
ZwDeleteValueKey
RtlAnsiCharToUnicodeChar
KeClearEvent
PsTerminateSystemThread
ZwQuerySymbolicLinkObject
RtlTimeFieldsToTime
IoFreeController
FsRtlDeregisterUncProvider
IoGetDmaAdapter
KeReadStateEvent
KeSetKernelStackSwapEnable
RtlCompareUnicodeString
MmHighestUserAddress
KeCancelTimer
Sections
.text Size: 25KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ