DllInstall
DllRegisterServer
Behavioral task
behavioral1
Sample
b42618a418af2ee3fc0606c56bbec119b22b8f59e0f6a24356a28e9c91517b47.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b42618a418af2ee3fc0606c56bbec119b22b8f59e0f6a24356a28e9c91517b47.dll
Resource
win10v2004-20230221-en
Target
b42618a418af2ee3fc0606c56bbec119b22b8f59e0f6a24356a28e9c91517b47.exe
Size
2.1MB
MD5
ebeb28c6b25088798a49f1d8fcc15e93
SHA1
15ea3e3e2f0dbc3daac3d87e3e87feb7b7c6859b
SHA256
b42618a418af2ee3fc0606c56bbec119b22b8f59e0f6a24356a28e9c91517b47
SHA512
7ee78c87b19fb4ffc06877dd2d2e5e6d229c9c295557ca77da5af8af6a1d9cf9f979418be90bd10c2ee605b65b329f0b00de48ce8718eb9c0375382fdb676a21
SSDEEP
49152:UK9imiZQ5V0i3fmpM/iP6dzvRN3YVuMtG:UK9dNXupMjN
resource | yara_rule |
---|---|
sample | family_royal |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
SleepConditionVariableCS
ReadFile
GetFileSizeEx
GetCurrentProcess
WakeAllConditionVariable
GetProcessId
SetEndOfFile
CreateToolhelp32Snapshot
GetLastError
Process32NextW
Process32FirstW
GetNativeSystemInfo
SetFilePointerEx
MoveFileExW
FlushFileBuffers
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
FormatMessageA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualFree
GetEnvironmentVariableW
MultiByteToWideChar
GetACP
GetStdHandle
GetFileType
CreateIoCompletionPort
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
HeapSize
GetTimeZoneInformation
GetStringTypeW
GetProcessHeap
GetQueuedCompletionStatus
CancelIo
lstrcmpW
WideCharToMultiByte
CreateProcessW
DeleteCriticalSection
WaitForSingleObject
lstrlenA
InitializeConditionVariable
InitializeCriticalSection
WaitForMultipleObjects
lstrlenW
lstrcmpiW
CreateThread
CloseHandle
Sleep
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
DecodePointer
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
LCMapStringW
CompareStringW
HeapAlloc
HeapFree
GetModuleFileNameW
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
ExitThread
CreateFileW
FindClose
LeaveCriticalSection
WriteFile
FindNextFileW
EnterCriticalSection
FindFirstFileW
GetModuleHandleW
GetLogicalDrives
EncodePointer
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
RaiseException
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
wsprintfW
GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
DeregisterEventSource
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
ReportEventW
RegisterEventSourceW
CryptAcquireContextW
CryptEnumProvidersW
CryptSignHashW
CommandLineToArgvW
StrStrIW
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
send
WSAGetLastError
htons
gethostbyname
select
ntohs
getsockopt
ioctlsocket
bind
WSAIoctl
closesocket
ntohl
WSASocketW
socket
WSAAddressToStringW
htonl
WSAStartup
connect
setsockopt
recv
shutdown
inet_addr
WSACleanup
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
GetIpAddrTable
NetShareEnum
NetApiBufferFree
RmStartSession
RmGetList
RmRegisterResources
RmShutdown
RmEndSession
BCryptGenRandom
DllInstall
DllRegisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ