?HideMutex@@IJPAFGHPAI@X
Static task
static1
Behavioral task
behavioral1
Sample
5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415.dll
Resource
win10v2004-20220812-en
General
-
Target
5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415
-
Size
445KB
-
MD5
2f0bea008100f461a6ec023d190ee710
-
SHA1
538e31f27d0889359410628cc67390c28a6f6d03
-
SHA256
5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415
-
SHA512
284c3306f3b567dfd4c9f8063f7f8751863c8c249a868f3f0ab0abd06182eac4d55de4e7e1d7992faff3c9da33ec04b9c88f7f498b046ea5bfdbf76abecbbd7a
-
SSDEEP
6144:N4Xr3nR6t8gbCCeglCeskyLwIcJ5puCOuF+53IykoNCDbRuNLdkzaE4:NE9glC3kwwIcJCCrdo8o5
Malware Config
Signatures
Files
-
5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415.dll windows x86
85b1a6638a83f07d84c4d9cef15dc400
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoConnectInterrupt
IoGetTopLevelIrp
PsGetVersion
IoCreateDevice
IoAllocateMdl
KeInitializeSemaphore
RtlSetAllBits
PsImpersonateClient
SeCaptureSubjectContext
RtlFindSetBits
RtlOemToUnicodeN
IoVerifyVolume
IoSetThreadHardErrorMode
RtlIsNameLegalDOS8Dot3
CcFastCopyRead
ExAllocatePoolWithTag
PoRegisterSystemState
KeInitializeApc
IoQueryFileInformation
RtlTimeToTimeFields
PoCallDriver
CcSetReadAheadGranularity
ObInsertObject
KeInitializeSpinLock
FsRtlFreeFileLock
CcUnpinRepinnedBcb
KeDelayExecutionThread
IoAcquireVpbSpinLock
MmAllocateMappingAddress
ZwEnumerateValueKey
FsRtlNotifyUninitializeSync
KeBugCheckEx
ObReferenceObjectByPointer
RtlCreateSecurityDescriptor
RtlValidSecurityDescriptor
RtlMultiByteToUnicodeN
PsGetCurrentProcess
RtlUnicodeToOemN
KeEnterCriticalRegion
ZwQueryObject
IoWMIWriteEvent
MmFreeContiguousMemory
KeSetTargetProcessorDpc
IoRegisterDeviceInterface
RtlCreateUnicodeString
ExInitializeResourceLite
RtlAreBitsClear
RtlQueryRegistryValues
SeTokenIsAdmin
FsRtlIsHpfsDbcsLegal
KeQueryActiveProcessors
IoCreateFile
IoReportResourceForDetection
MmUnmapIoSpace
CcSetDirtyPinnedData
ZwDeleteKey
IoGetAttachedDevice
KeReadStateTimer
SeAppendPrivileges
RtlGetNextRange
IoVolumeDeviceToDosName
PsRevertToSelf
CcCopyRead
CcRepinBcb
SeDeleteObjectAuditAlarm
IoGetAttachedDeviceReference
IoDeviceObjectType
ZwReadFile
RtlValidSid
ExGetExclusiveWaiterCount
CcPurgeCacheSection
IoQueueWorkItem
RtlFindLastBackwardRunClear
SePrivilegeCheck
ExReleaseResourceLite
RtlGUIDFromString
IoGetDeviceAttachmentBaseRef
IoGetStackLimits
IoUpdateShareAccess
KeReleaseSemaphore
ZwDeleteValueKey
ExAllocatePool
DbgPrompt
ZwCreateSection
RtlRemoveUnicodePrefix
RtlFindClearRuns
ZwOpenSection
IoAcquireCancelSpinLock
PsGetCurrentProcessId
ExUnregisterCallback
IoInitializeRemoveLockEx
ObReferenceObjectByHandle
ExFreePoolWithTag
RtlUnicodeStringToAnsiString
RtlInitializeSid
RtlFindLeastSignificantBit
RtlCompareUnicodeString
IoFreeErrorLogEntry
PsSetLoadImageNotifyRoutine
PsIsThreadTerminating
IoMakeAssociatedIrp
RtlInitializeGenericTable
IoInvalidateDeviceState
KeRevertToUserAffinityThread
ProbeForWrite
MmAddVerifierThunks
MmResetDriverPaging
KePulseEvent
RtlxAnsiStringToUnicodeSize
RtlDelete
IoInitializeTimer
PsChargeProcessPoolQuota
FsRtlGetNextFileLock
CcMapData
ZwCreateEvent
KeSetTimer
PsTerminateSystemThread
PoSetSystemState
MmCanFileBeTruncated
MmMapUserAddressesToPage
KeReleaseMutex
PoUnregisterSystemState
PoSetPowerState
RtlInsertUnicodePrefix
SeQueryInformationToken
IoCancelIrp
IoSetSystemPartition
ExRaiseAccessViolation
MmSetAddressRangeModified
FsRtlNotifyInitializeSync
ZwUnloadDriver
MmUnmapReservedMapping
ExFreePool
MmGetPhysicalAddress
ExAllocatePoolWithQuotaTag
FsRtlMdlWriteCompleteDev
PsReturnPoolQuota
KeInitializeDpc
ZwClose
RtlInitializeBitMap
CcUninitializeCacheMap
MmGetSystemRoutineAddress
CcPinMappedData
IoGetDeviceInterfaces
ExSetTimerResolution
SeOpenObjectAuditAlarm
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
MmMapLockedPages
MmSizeOfMdl
PsReferencePrimaryToken
RtlGenerate8dot3Name
MmFreePagesFromMdl
MmUnlockPages
ExSystemTimeToLocalTime
ZwNotifyChangeKey
PoRequestPowerIrp
RtlFindUnicodePrefix
IoIsOperationSynchronous
KeReadStateSemaphore
ExRaiseStatus
RtlPrefixUnicodeString
MmForceSectionClosed
ExGetSharedWaiterCount
ZwSetValueKey
IoSetTopLevelIrp
IoRemoveShareAccess
FsRtlIsFatDbcsLegal
MmHighestUserAddress
IoWMIRegistrationControl
RtlUpcaseUnicodeToOemN
CcInitializeCacheMap
SeQueryAuthenticationIdToken
SeReleaseSubjectContext
FsRtlFastUnlockSingle
ZwLoadDriver
MmAllocateNonCachedMemory
RtlDowncaseUnicodeString
RtlInitAnsiString
IoDisconnectInterrupt
FsRtlIsDbcsInExpression
ZwCreateDirectoryObject
ZwOpenKey
SeLockSubjectContext
KeClearEvent
ExAcquireResourceSharedLite
RtlUpcaseUnicodeString
MmIsDriverVerifying
ZwQueryInformationFile
IoGetCurrentProcess
ZwSetVolumeInformationFile
SeAssignSecurity
CcDeferWrite
ExUuidCreate
IoGetRequestorProcess
IoGetDiskDeviceObject
KeSetEvent
RtlAnsiStringToUnicodeString
ObReleaseObjectSecurity
MmUnmapLockedPages
KeUnstackDetachProcess
RtlEqualString
RtlSetBits
IoBuildPartialMdl
ExAcquireFastMutexUnsafe
IoSetHardErrorOrVerifyDevice
FsRtlSplitLargeMcb
SeSetSecurityDescriptorInfo
IoAllocateAdapterChannel
ZwQueryVolumeInformationFile
ZwEnumerateKey
ExGetPreviousMode
KeRemoveQueue
ExReleaseFastMutexUnsafe
KeAttachProcess
ExQueueWorkItem
IoInvalidateDeviceRelations
CcFastCopyWrite
CcUnpinData
KdEnableDebugger
IoGetDeviceToVerify
CcRemapBcb
IoDeleteSymbolicLink
ZwQueryKey
IoCreateStreamFileObjectLite
ObOpenObjectByPointer
MmIsVerifierEnabled
ZwDeviceIoControlFile
RtlCompareMemory
KeInitializeMutex
ObMakeTemporaryObject
IoCsqRemoveIrp
PsGetCurrentThread
SeFilterToken
PsDereferencePrimaryToken
IoBuildSynchronousFsdRequest
KeDeregisterBugCheckCallback
RtlDeleteNoSplay
RtlClearAllBits
KeInitializeEvent
MmSecureVirtualMemory
RtlCopySid
KeSetBasePriorityThread
IoSetShareAccess
RtlGetVersion
PsGetProcessId
IoReportDetectedDevice
ZwOpenFile
RtlUpcaseUnicodeChar
IoWriteErrorLogEntry
ProbeForRead
RtlDeleteElementGenericTable
IoCheckQuotaBufferValidity
MmFreeMappingAddress
ExDeleteNPagedLookasideList
KeQuerySystemTime
Exports
Exports
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ