ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
96f8b49f110c1cd4c97a213059bbacab54bdc10631ab4320ddd4afc39ca95e3c.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
96f8b49f110c1cd4c97a213059bbacab54bdc10631ab4320ddd4afc39ca95e3c.dll
Resource
win10v2004-20221111-en
General
-
Target
96f8b49f110c1cd4c97a213059bbacab54bdc10631ab4320ddd4afc39ca95e3c
-
Size
10KB
-
MD5
d31a9393dcb1bfc6b37e443133867f6f
-
SHA1
74aa78cf156426f64277ab23b9b5f66b5269a41d
-
SHA256
96f8b49f110c1cd4c97a213059bbacab54bdc10631ab4320ddd4afc39ca95e3c
-
SHA512
5979f7692291c7b20056aa5b077362057802b8c304ac0e95be124dc71ff9bca64d918065843779acad72eca0af59e8b74413f21558b61e42927d306e2ef553d2
-
SSDEEP
192:HBZjRHY00Lq5oVEoJ1Q57Dv1w16efCWiXwW:HBZjRHPwq5AQ57S0oCWiXwW
Malware Config
Signatures
Files
-
96f8b49f110c1cd4c97a213059bbacab54bdc10631ab4320ddd4afc39ca95e3c.dll windows x86
7bbea77ee5ce958d2a09ee62fa4b6988
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrChrA
user32
wsprintfA
kernel32
OpenProcess
lstrcmpiA
CloseHandle
Process32First
CreateToolhelp32Snapshot
Sleep
RtlZeroMemory
TerminateThread
TerminateProcess
lstrcpynA
Process32Next
CreateProcessA
lstrlenA
GetCurrentProcess
LoadLibraryA
GetProcAddress
lstrcatA
CreateThread
WaitForSingleObject
advapi32
RegQueryValueExA
RegSetValueExA
DuplicateTokenEx
CreateProcessAsUserA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SetServiceStatus
RegOpenKeyExA
RegCloseKey
ws2_32
gethostname
WSAStartup
shutdown
send
closesocket
connect
gethostbyname
setsockopt
WSASocketA
recv
WSAIoctl
bind
socket
htons
WSACleanup
dnsapi
DnsQuery_A
Exports
Exports
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 474B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ