Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp
-
Size
8.5MB
-
MD5
a4c8ae7ddaecaa191e4479b22cb57df5
-
SHA1
a8f0c467b865f67812efee5aaabddd05a2f0b13c
-
SHA256
d233db862f15cb89ad7c4ee55746ae4768e10aa25657e20a2ecd62ec790661cc
-
SHA512
95815d2c59dcbb905ee3bc5ed2ebf4f719a9c511fba4f242c55f5feba004c25f8fcbb9925cb349c15b123641cb962e0084e5024968ec3bd3152f8e55bc41462b
-
SSDEEP
196608:WRpjthL+ktop1+jRxVMTa/bARMbWTPP3g7D:W/zVMTa/bARNTPP4
Malware Config
Signatures
Files
-
tmp.exe windows x86
23b74aef560970f0f55de27aabcbf251
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
D3DXGetImageInfoFromFileInMemory
D3DXCreateTextureFromFileInMemory
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateFontA
D3DXSaveSurfaceToFileA
d3d9
Direct3DCreate9
kernel32
CreateEventA
GetFullPathNameA
GetCurrentDirectoryA
TerminateProcess
GetACP
GetTickCount
GetLocalTime
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
CreateThread
GetCurrentThreadId
CreateFileA
GetFileAttributesA
CreateDirectoryA
OpenEventA
LeaveCriticalSection
EnterCriticalSection
CloseHandle
TerminateThread
WaitForSingleObject
GetVersionExA
GetProcAddress
GlobalMemoryStatusEx
CopyFileA
SetFileAttributesW
SetEvent
CreateDirectoryW
GetFileAttributesW
SetFilePointer
DeleteFileW
MoveFileW
GetTempPathA
GetTempPathW
GetCurrentDirectoryW
GetFullPathNameW
GetModuleFileNameA
GetLastError
InterlockedIncrement
GetComputerNameA
SizeofResource
LockResource
LoadResource
FindResourceA
SetFileAttributesA
MoveFileA
MultiByteToWideChar
FreeLibrary
OutputDebugStringA
DeleteCriticalSection
CreateFileW
GetFileSize
WriteFile
ReadFile
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
GetSystemTimeAsFileTime
LoadLibraryExW
SetLastError
GetSystemDirectoryW
GetPriorityClass
FatalAppExitA
WTSGetActiveConsoleSessionId
LocalAlloc
Process32Next
VerifyVersionInfoW
ReadProcessMemory
OpenProcess
Process32First
ExitProcess
GetFileTime
LocalFree
FormatMessageA
GetCurrentProcess
GlobalLock
GlobalUnlock
GlobalAlloc
Sleep
InitializeCriticalSection
GetOEMCP
AllocConsole
SetConsoleTitleA
GetModuleHandleA
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
InterlockedExchange
DeleteFileA
MapViewOfFile
GetSystemInfo
InterlockedExchangeAdd
TryEnterCriticalSection
GetCurrentThread
DuplicateHandle
MulDiv
UnmapViewOfFile
CreateFileMappingA
InterlockedDecrement
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
SetUnhandledExceptionFilter
ResumeThread
VirtualAlloc
LoadLibraryA
user32
AdjustWindowRect
GetWindowLongA
SetWindowPos
ClipCursor
ReleaseCapture
SetRect
LoadStringW
LoadCursorA
LoadIconA
GetCursorPos
GetWindowRect
SetCapture
MessageBoxA
SetWindowLongA
SetWindowTextA
ShowWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetCaretBlinkTime
GetFocus
GetKeyState
OpenClipboard
GetClipboardData
CloseClipboard
DialogBoxParamA
SwitchToThisWindow
SetFocus
EnableWindow
GetDlgItem
KillTimer
SetTimer
DefWindowProcA
GetClassNameA
FindWindowExA
WindowFromPoint
EnumWindows
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
GetClientRect
ClientToScreen
ShowCursor
EndDialog
SendMessageA
GetAsyncKeyState
RegisterClassA
ChangeClipboardChain
SetClipboardViewer
EndPaint
BeginPaint
UpdateWindow
InvalidateRect
GetActiveWindow
CreateWindowExA
GetMessageW
PeekMessageW
PostQuitMessage
gdi32
SetTextColor
GetStockObject
CreateFontA
CreateCompatibleDC
LineTo
MoveToEx
ExtTextOutA
CreatePen
SetMapMode
CreateDIBSection
SetTextAlign
SetBkColor
DeleteObject
GetTextExtentPoint32A
SelectObject
DeleteDC
GetDeviceCaps
CreateICA
CreateSolidBrush
advapi32
CryptGetUserKey
BuildExplicitAccessWithNameA
SetSecurityInfo
InitializeAcl
LookupPrivilegeValueA
SetEntriesInAclA
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetUserNameA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptExportKey
CryptDestroyKey
CryptAcquireContextW
CryptGetProvParam
CryptEnumProvidersA
AdjustTokenPrivileges
shell32
ShellExecuteA
SHGetFolderPathA
ole32
CoCreateInstance
CoInitialize
CoInitializeEx
oleaut32
SysAllocString
SysFreeString
iphlpapi
GetAdaptersInfo
ntdll
VerSetConditionMask
dbghelp
MiniDumpWriteDump
MakeSureDirectoryPathExists
psapi
GetModuleInformation
wtsapi32
WTSSendMessageA
wsock32
ioctlsocket
getsockopt
setsockopt
inet_ntoa
WSAGetLastError
socket
WSAStartup
ntohs
inet_addr
getsockname
gethostbyname
htons
connect
select
__WSAFDIsSet
bind
closesocket
shutdown
recv
send
msvcr90
toupper
srand
_localtime64
_mktime64
atoi
strcat
_gmtime64
memmove
qsort
isalnum
towlower
towupper
fseek
_telli64
ftell
ferror
fread
_filelength
_filelengthi64
_atoi64
fgetc
fputc
_ctime64
_CxxThrowException
_mkdir
fflush
_assert
feof
_set_errno
_get_errno
_access_s
_errno
strcpy_s
_stat32
setvbuf
remove
_purecall
ceil
_snprintf
longjmp
strtoul
_setjmp3
atof
_aligned_free
_aligned_msize
calloc
realloc
_strupr
_tzset
_fileno
_strlwr
abort
rename
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
ungetc
_mbsstr
fgetpos
system
fsetpos
fputs
wcslen
strerror
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
strncpy
strcpy
sprintf
_wcsicmp
wcscmp
strncmp
_strnicmp
strcmp
rand
memchr
memcpy
memset
_stricmp
strlen
memcmp
__CxxFrameHandler3
free
printf
malloc
??0exception@std@@QAE@XZ
fgets
_vsnprintf
fwrite
getchar
__iob_func
freopen
_invalid_parameter_noinfo
memmove_s
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
exit
strstr
_unlink
fopen
memcpy_s
vsprintf
_beginthreadex
_time64
sprintf_s
sscanf
vsprintf_s
fclose
fprintf
strrchr
_access
strchr
setlocale
__uncaught_exception
_wfsopen
mbstowcs_s
__crtLCMapStringA
__pctype_func
isupper
___lc_codepage_func
___lc_handle_func
_calloc_crt
islower
_free_locale
_except_handler3
tolower
isspace
_aligned_malloc
dinput8
DirectInput8Create
crypt32
CryptEncryptMessage
CertFreeCertificateContext
CertNameToStrW
CertDuplicateCertificateContext
CertSetCertificateContextProperty
CryptDecodeObject
CertGetCertificateContextProperty
CertCreateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetSubjectCertificateFromStore
CryptMsgControl
CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CryptDecryptMessage
CryptEncodeObject
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 721KB - Virtual size: 721KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 277KB - Virtual size: 971KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bdata1 Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ