Behavioral task
behavioral1
Sample
42eec2b721e59640d7b88202b80d2d9a5c84bf34534396098a497a60ef5ebb97.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
42eec2b721e59640d7b88202b80d2d9a5c84bf34534396098a497a60ef5ebb97.exe
Resource
win10v2004-20220812-en
General
-
Target
42eec2b721e59640d7b88202b80d2d9a5c84bf34534396098a497a60ef5ebb97
-
Size
2.1MB
-
MD5
99de8709cafc195cd12cfca75d35de4a
-
SHA1
aeaea352b9fe0236f281ce9456586ff39785fc74
-
SHA256
42eec2b721e59640d7b88202b80d2d9a5c84bf34534396098a497a60ef5ebb97
-
SHA512
f0f14d90aac8744a5a6e5fa99d576d90a7afb4fa3b471ad4f6785d945d930cca0d1a7af04c10900877e06e8c5d548c00e036f9cdd4dd3e02075458b658d53f08
-
SSDEEP
24576:R+KpPzIzkQoU6TPF8mkoSW12GR7qMA6v0Xwq8UcNV++e/i5dv9jOlRJYzyiMAIQg:Bq9LmKKe36MmYJPAvIPtHzH3h4UC4qk
Malware Config
Signatures
-
Royal Ransomware 1 IoCs
resource yara_rule sample family_royal -
Royal family
Files
-
42eec2b721e59640d7b88202b80d2d9a5c84bf34534396098a497a60ef5ebb97.exe windows x86
07a5f14fabca497d51b3abff84669c94
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetQueuedCompletionStatus
CreateIoCompletionPort
SleepConditionVariableCS
ReadFile
GetFileSizeEx
GetCurrentProcess
WakeAllConditionVariable
GetProcessId
SetEndOfFile
CreateToolhelp32Snapshot
GetLastError
Process32NextW
Process32FirstW
GetNativeSystemInfo
SetFilePointerEx
MoveFileExW
FlushFileBuffers
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
FormatMessageA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualFree
GetEnvironmentVariableW
MultiByteToWideChar
GetACP
GetStdHandle
CancelIo
GetModuleHandleW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
HeapSize
GetTimeZoneInformation
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
lstrcmpW
WideCharToMultiByte
CreateProcessW
ExitProcess
DeleteCriticalSection
WaitForSingleObject
lstrlenA
InitializeConditionVariable
InitializeCriticalSection
WaitForMultipleObjects
lstrlenW
GetCommandLineW
lstrcmpiW
CreateThread
CloseHandle
Sleep
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
DecodePointer
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
LCMapStringW
CompareStringW
HeapAlloc
HeapFree
GetModuleFileNameW
SetConsoleCtrlHandler
GetModuleHandleExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
EncodePointer
LoadLibraryExW
ExitThread
CreateFileW
FindClose
LeaveCriticalSection
WriteFile
FindNextFileW
EnterCriticalSection
FindFirstFileW
GetFileType
GetLogicalDrives
InitializeCriticalSectionAndSpinCount
RtlUnwind
RaiseException
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
user32
wsprintfW
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
advapi32
DeregisterEventSource
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
ReportEventW
RegisterEventSourceW
CryptAcquireContextW
CryptEnumProvidersW
CryptSignHashW
shell32
CommandLineToArgvW
shlwapi
StrStrIW
ws2_32
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
send
WSACleanup
gethostbyname
select
ntohs
getsockopt
ioctlsocket
bind
WSAIoctl
closesocket
ntohl
WSASocketW
socket
WSAAddressToStringW
htonl
htons
WSAStartup
connect
recv
setsockopt
shutdown
WSAGetLastError
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
iphlpapi
GetIpAddrTable
netapi32
NetShareEnum
NetApiBufferFree
rstrtmgr
RmStartSession
RmGetList
RmRegisterResources
RmShutdown
RmEndSession
bcrypt
BCryptGenRandom
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 500KB - Virtual size: 499KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ