Behavioral task
behavioral1
Sample
46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed.exe
Resource
win10v2004-20230221-en
General
-
Target
9798816280.zip
-
Size
421KB
-
MD5
0c67a67ad98a17a78eac19766400e9aa
-
SHA1
987cd53d60b67c685e715e15e95c69b7063f3862
-
SHA256
7077fd806338f187322f81146e3592aaa0929f24ebe9a7ab030fc90f72125633
-
SHA512
0c31ddc6798d4bbfe57105b96dab250fa74c55e4edbc457f6d01b43927cd0499ff867639f2f072cb63a5c28df38702a1d3e82c570621b69f2e06df106f6e0b75
-
SSDEEP
6144:/Ln5dfcDzvEXwCfvGp67LQfZ7YqWo7k+6IHid/m2QsA84sao+MhkQREyV:/L5pcP8XwgGyLWZXL4+AmJpzstzREyV
Malware Config
Signatures
-
Clop family
-
Detects Clop payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed family_clop
Files
-
9798816280.zip.zip
Password: infected
-
46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed.exe windows x86
Password: infected
d8b6baf12a07141de229c7d33c80f943
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryInformationJobObject
CreateActCtxW
GetOEMCP
SearchPathW
GetFileAttributesExA
WritePrivateProfileStringW
EraseTape
GetConsoleAliasesW
FindFirstVolumeW
GetSystemDefaultLCID
GetGeoInfoA
HeapFree
SetPriorityClass
GetCommandLineW
GetFullPathNameW
GetCurrentProcess
GetConsoleOutputCP
lstrlenW
GetThreadErrorMode
ScrollConsoleScreenBufferA
GetSystemDefaultUILanguage
UnregisterWait
GetStringTypeExW
TerminateProcess
WakeAllConditionVariable
GetUserDefaultLangID
GetModuleFileNameW
GetSystemTimes
RequestWakeupLatency
GetConsoleCP
GetThreadLocale
GlobalUnWire
GetProcessId
GetUserDefaultUILanguage
LockFile
InitializeCriticalSectionAndSpinCount
DeleteAtom
EnumCalendarInfoA
InitOnceInitialize
GetSystemPowerStatus
FlushProcessWriteBuffers
PeekConsoleInputA
FindActCtxSectionStringW
GetLargePageMinimum
GetFileAttributesTransactedA
lstrlenA
CreateMutexA
GetCurrentThreadId
OpenJobObjectW
GetVersionExW
UnregisterApplicationRecoveryCallback
IsSystemResumeAutomatic
HeapWalk
GlobalDeleteAtom
HeapValidate
GetSystemDefaultLangID
GetACP
RtlCaptureStackBackTrace
OpenProcess
GetVersion
GetCommandLineA
CreateToolhelp32Snapshot
CreateEventW
ProcessIdToSessionId
Sleep
GetTickCount64
BuildCommDCBW
VerifyScripts
GetCurrencyFormatEx
ChangeTimerQueueTimer
GetFileAttributesExW
Process32NextW
GetMaximumProcessorGroupCount
GetStringTypeExA
GetThreadUILanguage
GetUserDefaultLCID
SetEvent
GetCurrentThread
GetActiveProcessorGroupCount
LoadLibraryA
WriteProfileStringA
TlsAlloc
DeleteFileA
GetSystemDEPPolicy
Process32FirstW
MoveFileTransactedW
GetLogicalDrives
AddConsoleAliasA
CreateThreadpoolCleanupGroup
GetNativeSystemInfo
RaiseException
CloseHandle
ReadFileEx
IsDBCSLeadByte
HeapAlloc
Wow64SuspendThread
FatalAppExitW
GetCurrentDirectoryW
UpdateResourceW
GetLogicalDriveStringsA
SwitchToThread
IsThreadAFiber
GetCurrentProcessorNumber
GetThreadContext
InitAtomTable
GetWindowsDirectoryW
PeekConsoleInputW
GetErrorMode
UnregisterApplicationRestart
DebugActiveProcess
GetTimeFormatW
SetFileApisToOEM
WTSGetActiveConsoleSessionId
ExitProcess
GetPrivateProfileStructA
FindFirstStreamW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
GetLongPathNameA
GetConsoleWindow
CreateEventExA
SystemTimeToTzSpecificLocalTime
QueryFullProcessImageNameW
ReadConsoleOutputCharacterW
CommConfigDialogW
ConvertFiberToThread
GetFileType
DeleteTimerQueueTimer
SetFileApisToANSI
FormatMessageA
lstrcmpiW
BackupSeek
GetNLSVersion
HeapUnlock
GetDateFormatW
GetEnvironmentStringsW
CreateFiberEx
GetConsoleAliasExesLengthA
CreateFiber
GetDriveTypeW
InterlockedPopEntrySList
IsDebuggerPresent
CreateTimerQueue
SizeofResource
LockResource
LoadResource
FindResourceW
WriteConsoleW
SetFilePointerEx
ReadConsoleW
SetEndOfFile
GetConsoleMode
FlushFileBuffers
HeapReAlloc
HeapSize
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetCPInfo
IsValidCodePage
FindFirstFileExW
GetConsoleAliasExesLengthW
RemoveDirectoryTransactedW
GetNamedPipeClientComputerNameA
AreFileApisANSI
CopyFileExA
GlobalUnlock
GetTickCount
MapViewOfFile
CreateFileMappingW
lstrcpyW
GlobalLock
EnumSystemCodePagesA
CreateThread
GlobalFree
lstrcpyA
GlobalAlloc
lstrcatW
GetLastError
SetFileAttributesW
ExitThread
UnmapViewOfFile
CreateFileW
WaitForSingleObject
FindClose
SetFilePointer
SetErrorMode
VirtualAlloc
WriteFile
FindNextFileW
GetModuleHandleExW
WideCharToMultiByte
MultiByteToWideChar
GetStdHandle
LoadLibraryExW
GetProcAddress
VirtualFree
FindFirstFileW
FreeConsole
ReadFile
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
DecodePointer
user32
wsprintfW
InvalidateRect
GetDesktopWindow
CharUpperBuffW
AppendMenuW
CharUpperW
DestroyCursor
GetClipboardData
DeferWindowPos
DefWindowProcW
OpenIcon
GetFocus
GetClipboardOwner
GetWindowTextLengthW
GetActiveWindow
GetClassInfoW
BeginDeferWindowPos
GetScrollRange
CloseClipboard
CharUpperBuffA
GetSysColor
GetForegroundWindow
DefMDIChildProcW
LoadBitmapW
gdi32
CloseMetaFile
CreateDCW
CreateRectRgnIndirect
TextOutW
PolyPolygon
CreateDiscardableBitmap
Polygon
SetBkColor
Ellipse
DeleteMetaFile
UnrealizeObject
Pie
advapi32
RegLoadMUIStringW
GetTokenInformation
LookupAccountSidW
RegDisablePredefinedCacheEx
RevertToSelf
CryptAcquireContextW
SetServiceStatus
RegisterServiceCtrlHandlerW
CryptEncrypt
OpenProcessToken
CreateProcessAsUserW
StartServiceCtrlDispatcherW
RegDeleteValueA
DuplicateTokenEx
OpenThreadToken
shell32
SHGetSpecialFolderPathW
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
shlwapi
StrStrW
PathFindFileNameW
crypt32
CryptStringToBinaryA
CryptDecodeObjectEx
CryptImportPublicKeyInfo
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
wtsapi32
WTSQuerySessionInformationW
WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory
rstrtmgr
RmGetList
RmStartSession
RmShutdown
RmEndSession
RmRestart
RmRegisterResources
Sections
.text Size: 534KB - Virtual size: 534KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ