Static task
static1
Behavioral task
behavioral1
Sample
f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe
Resource
win10v2004-20220901-en
General
-
Target
f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f
-
Size
718KB
-
MD5
d7a24de75b761cb98f580dafda4ba885
-
SHA1
86dc51cfc817937f9525b8aa2fa71e918288a44d
-
SHA256
f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f
-
SHA512
c3fd50a296b4d251a614816756eb17632779c0ef0e72826d9d276ccae8b1689ca0523a22027509ce20bf125f858f713b08967ae55501c457bc9d8fca956b0e9e
-
SSDEEP
12288:YuLRIEFPULfzlsH5HCSSv5zEWptZ/Vlt:YeRIEF6zlsu5AWptRVlt
Malware Config
Signatures
Files
-
f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe windows x86
f6ebbc99dee0ebb360681d57876ef849
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetLastError
lstrcatW
DeleteFileW
RaiseException
LoadLibraryW
SetVolumeMountPointW
ExitProcess
FindVolumeClose
CopyFileW
GetConsoleWindow
GetVolumePathNamesForVolumeNameW
lstrcpyW
FindNextVolumeW
lstrcmpiW
OpenMutexW
GetModuleHandleA
lstrcmpW
GetDriveTypeW
IsDebuggerPresent
OpenProcess
ReadConsoleW
ReadFile
SetEndOfFile
DecodePointer
WriteConsoleW
HeapReAlloc
ReleaseMutex
WaitForSingleObject
CreateMutexA
lstrlenA
GetSystemDefaultUILanguage
lstrlenW
FindFirstVolumeW
GetLocalTime
MapViewOfFile
CreateFileMappingW
CloseHandle
LoadLibraryA
GetModuleFileNameW
HeapSize
SetFilePointerEx
CreateFileW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTickCount
VirtualProtect
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
CreateTimerQueue
SetEvent
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
MultiByteToWideChar
HeapAlloc
HeapFree
ExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
CompareStringW
LCMapStringW
GetFileType
GetExitCodeProcess
CreateProcessA
CreateProcessW
GetFileAttributesExW
GetProcessHeap
user32
ShowWindow
SystemParametersInfoW
wvsprintfW
wsprintfA
wsprintfW
advapi32
OpenServiceA
EnumDependentServicesA
CloseServiceHandle
OpenSCManagerA
ControlService
QueryServiceStatusEx
CryptGenKey
CryptDestroyKey
RegCloseKey
RegCreateKeyExW
CryptExportKey
RegSetValueExW
shell32
SHEmptyRecycleBinW
ShellExecuteW
SHChangeNotify
shlwapi
PathRemoveExtensionW
iphlpapi
GetIpNetTable
netapi32
NetShareEnum
NetApiBufferFree
userenv
RefreshPolicyEx
ws2_32
closesocket
WSACleanup
inet_ntoa
freeaddrinfo
recv
connect
socket
send
WSAStartup
getaddrinfo
Sections
.text Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 86KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 253KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ