Behavioral task
behavioral1
Sample
sotema_5.txt.exe
Resource
win7-20221111-en
General
-
Target
sotema_5.txt.exe
-
Size
773KB
-
MD5
51e7f03ae54c977764c32b0dedf0b9ac
-
SHA1
03cf8e81b1b8a96097c9e3da11f925e7dc6819b7
-
SHA256
0580678f81e9801e3678c5d4cf1cfe674aa52ce95092e67908d6a7d4192a429b
-
SHA512
03ea4d2dd652c3fd858c54cf579c410a12c7296acf222ebad57bcfaea33b71fc411122bc35a7b8ff56cb0254e42a6042fbe6efdb47a97ba61fb6ed15c9931661
-
SSDEEP
24576:Wu/phBzW6ZEaA9Wip9TPP+szWC7SORTwrGKcq:LhzJG6E3TCGVq
Malware Config
Signatures
-
Privateloader family
Files
-
sotema_5.txt.exe.exe windows x86
9b239827ad94cf9e43aed2c8aec6e783
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
FindClose
lstrcatA
GetModuleHandleA
MultiByteToWideChar
GlobalAlloc
lstrcpyA
VerSetConditionMask
WideCharToMultiByte
VerifyVersionInfoW
GetSystemTimeAsFileTime
GetComputerNameA
GetProcAddress
HeapFree
lstrlenA
HeapAlloc
lstrcpynA
GetProcessHeap
GetLastError
CreateFileW
CreateFileA
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
FormatMessageW
CreateDirectoryW
DeleteFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
SetLastError
SetFilePointer
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
GetCPInfo
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCurrentThread
GetThreadTimes
InterlockedPushEntrySList
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
GetFileType
ExitProcess
GetModuleHandleExW
SetEnvironmentVariableA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
WriteConsoleW
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetStdHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapReAlloc
OutputDebugStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
WriteFile
ReadFile
SetEvent
ResetEvent
WaitForSingleObjectEx
user32
CharToOemA
CharNextA
advapi32
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
ConvertSidToStringSidA
LookupAccountNameA
Sections
.text Size: 585KB - Virtual size: 584KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ