UMEP
VFEP
Behavioral task
behavioral1
Sample
303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731.dll
Resource
win10v2004-20230220-en
Target
303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731
Size
1.6MB
MD5
f7bb82b0e665b494bcebefc7351f46c5
SHA1
0139818441431c72a1935e7f740a1cc458a63452
SHA256
303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731
SHA512
1a14bbd758cb47b3939cbfdd93f4f81693e2a561d2daa6abf78c8a0eca98d65e74ddd3cc14e881b669cdc9bba8bc267e622472426a7f7c153f835ecf9947a9a8
SSDEEP
49152:ptb9JIdmNgW8Du4CuK5GN8NnpUnzezUJWJEy+yDgFP:BUDsdNnOasS/xDc
File contains strings specific to ComRAT v4 samples first seen in 2017.
resource | yara_rule |
---|---|
sample | ComRAT |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
CreateFileW
ExpandEnvironmentStringsW
IsBadStringPtrA
GetCurrentProcess
OpenProcess
GetLocalTime
SetHandleInformation
ReadFile
MultiByteToWideChar
CreatePipe
GetProcAddress
LoadLibraryA
OpenEventW
GetFileSize
SetFilePointer
WriteFile
GetModuleHandleW
LoadLibraryW
GetVersionExW
VirtualProtectEx
GetExitCodeThread
lstrcmpiW
OutputDebugStringW
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
GetModuleHandleA
WriteProcessMemory
CreateThread
WideCharToMultiByte
CreateDirectoryW
DeleteFileW
CloseHandle
CreateEventW
TerminateProcess
Sleep
CreateProcessW
GetLastError
GetTickCount
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetOEMCP
InitializeCriticalSection
SetStdHandle
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
ReadConsoleW
GetSystemTimeAsFileTime
GetFileAttributesExW
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
HeapReAlloc
GetCPInfo
GetCommandLineA
GetCurrentThreadId
GetStdHandle
GetFileType
GetModuleFileNameW
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetEnvironmentVariableW
SetEnvironmentVariableA
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
FreeLibrary
LoadLibraryExW
HeapSize
GetProcessHeap
GetTimeZoneInformation
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidCodePage
GetACP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEndOfFile
CryptGenRandom
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
CryptReleaseContext
CryptAcquireContextW
GetModuleBaseNameA
EnumProcessModulesEx
EnumProcessModules
UMEP
VFEP
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ