Behavioral task
behavioral1
Sample
b58a6394bd8be771e287bd6d90ceb8d92d4054932e25a73b1ea4e4bf5abc2bea.exe
Resource
win7-20221111-en
General
-
Target
b58a6394bd8be771e287bd6d90ceb8d92d4054932e25a73b1ea4e4bf5abc2bea
-
Size
8.8MB
-
MD5
607351f89cddb9b9fd7b0b0c8c18171c
-
SHA1
294b8e6ef3f3af18253015959d229964b6ecee1d
-
SHA256
b58a6394bd8be771e287bd6d90ceb8d92d4054932e25a73b1ea4e4bf5abc2bea
-
SHA512
fd76c642146fde8540d28f7f9736d6a30a567aa0400e9cb0b325e385271576855726fe749e62f4feae497a3d0cc920bc5151c1b49ddd1b93fe5aa59d708cfaa2
-
SSDEEP
196608:ZpwKZnd27xQrPmL1DXctc2gfR1CPwDvt3uFTDCDyiLIKcosI3jhMSN:ZCqns1QTmLJctc2O1CPwDvt3uF/CDyUZ
Malware Config
Signatures
-
Privateloader family
Files
-
b58a6394bd8be771e287bd6d90ceb8d92d4054932e25a73b1ea4e4bf5abc2bea.exe windows x64
a5d7889a449b58021055813946de64a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLocaleInfoA
FreeResource
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
GetTempPathA
GetModuleHandleExA
GetTimeZoneInformation
GetTickCount64
CopyFileA
GetLastError
GetFileAttributesA
TzSpecificLocalTimeToSystemTime
CreateFileA
LoadLibraryA
GetVersionExA
LockResource
DeleteFileA
Process32Next
CloseHandle
GetSystemInfo
CreateThread
GetWindowsDirectoryA
LoadResource
SetFileAttributesA
GetLocalTime
GetProcAddress
LocalFree
RemoveDirectoryA
GetCurrentProcessId
GlobalMemoryStatusEx
FreeLibrary
WideCharToMultiByte
CreateDirectoryA
GetSystemTime
GetPrivateProfileStringA
GetComputerNameA
SetUnhandledExceptionFilter
lstrcpynA
ReadFile
SetFilePointer
CreateFileW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
GetCurrentThreadId
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileW
HeapReAlloc
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
GetFileSize
DeleteCriticalSection
GetProcessHeap
SystemTimeToFileTime
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
LoadLibraryExA
VirtualQuery
VirtualProtect
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
LocalAlloc
WaitForSingleObject
GetModuleFileNameA
GetVolumeInformationA
FindClose
GetModuleHandleA
lstrlenA
FindResourceA
FindNextFileA
GetUserDefaultLocaleName
TerminateProcess
WriteFile
GetCurrentProcess
FindFirstFileA
Process32First
SetStdHandle
CreateProcessW
GetExitCodeProcess
GetPrivateProfileSectionNamesA
SizeofResource
EnterCriticalSection
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
FindFirstFileExW
FindNextFileW
GetFinalPathNameByHandleW
SetFilePointerEx
GetFileInformationByHandleEx
LCMapStringEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetFileType
ExitProcess
GetModuleHandleExW
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
GetConsoleMode
RtlUnwind
user32
wsprintfA
GetDesktopWindow
GetDC
GetWindowRect
EnumDisplayDevicesA
GetKeyboardLayoutList
MessageBoxA
GetSystemMetrics
ReleaseDC
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
SelectObject
advapi32
RegQueryValueExA
RegOpenKeyExA
GetUserNameA
CredFree
RegCloseKey
GetCurrentHwProfileA
RegEnumKeyExA
CredEnumerateA
shell32
ShellExecuteA
SHGetFolderPathA
crypt32
CryptUnprotectData
CryptStringToBinaryA
gdiplus
GdiplusStartup
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusShutdown
GdipSaveImageToFile
setupapi
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInfo
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ