Static task
static1
Behavioral task
behavioral1
Sample
mstsc.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
mstsc.exe
Resource
win10v2004-20230220-en
General
-
Target
mstsc.exe
-
Size
1.3MB
-
MD5
653ee2b47d50fb6f7ae3324b522663b2
-
SHA1
a6d235cfd0f7db39812836d89dd9fe4f751ca661
-
SHA256
4a97d0929a4dfa48c700570d3638177389443543a8525ce4a2eee19c05092bfe
-
SHA512
5d38657cfc829948e41dec6d8c593d284aa8820fd2d12525e54327c8536598afb82e61f44f355851d33eb6c85f6fd0f43d57622f61a04fe5d148d0feda1b8eab
-
SSDEEP
24576:/ElCWVQ62IOW3lZtJuWdfeNbjMaTxHenZ:MlNKIOkjQWLQxHen
Malware Config
Signatures
Files
-
mstsc.exe.exe windows x86
5db499e4db97ace28bb122dcb306605c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
FreeLibrary
LoadLibraryExW
lstrcmpiW
RaiseException
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
GetModuleHandleExA
GetCommandLineW
InitializeCriticalSection
SetEvent
CreateEventW
CreateThread
DeleteFileW
GetLocalTime
GetTimeFormatW
GetDateFormatW
CreateFileW
GetFileSize
ReadFile
GetVersionExW
GetVersionExA
lstrcmpW
MulDiv
GetStartupInfoA
TerminateProcess
GetCurrentProcess
LoadLibraryW
LocalFree
GetCurrentDirectoryW
SearchPathW
CreateDirectoryW
LocalAlloc
GetFileAttributesW
CompareStringW
GetFullPathNameW
GetACP
SetFilePointer
GetTempPathW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
FindClose
VerSetConditionMask
VerifyVersionInfoW
CancelWaitableTimer
ResetEvent
SetWaitableTimer
GetTickCount64
CompareStringOrdinal
WriteFile
CreateProcessW
GetSystemDirectoryW
HeapSetInformation
Sleep
CreateFileMappingW
HeapFree
LCIDToLocaleName
UnmapViewOfFile
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
CreateSemaphoreExW
DelayLoadFailureHook
ResolveDelayLoadedAPI
OpenThread
TlsFree
TlsGetValue
SwitchToThread
GetSystemInfo
TlsAlloc
TlsSetValue
QueryPerformanceFrequency
TrySubmitThreadpoolCallback
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
InitializeCriticalSectionAndSpinCount
LockResource
FindResourceW
SystemTimeToFileTime
GetSystemTime
CreateTimerQueueTimer
LoadLibraryA
GlobalFree
LCMapStringEx
RemoveDirectoryW
CompareStringEx
GetProcessId
TerminateThread
ProcessIdToSessionId
GetComputerNameW
InitOnceExecuteOnce
ExpandEnvironmentStringsW
GetOverlappedResult
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
DisconnectNamedPipe
CreateThreadpoolIo
CancelThreadpoolIo
StartThreadpoolIo
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
QueueUserWorkItem
CreateSemaphoreW
GetTickCount
FreeLibraryAndExitThread
GetExitCodeThread
WaitForMultipleObjects
CreateWaitableTimerExW
ExpandEnvironmentStringsA
LoadLibraryExA
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
GetModuleFileNameA
MapViewOfFile
user32
GetKeyboardLayout
SetProcessDPIAware
CharUpperW
GetMessageW
TranslateMessage
InsertMenuItemW
SystemParametersInfoW
DispatchMessageW
TranslateAcceleratorW
IsDialogMessageW
PostThreadMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
LoadAcceleratorsW
DialogBoxParamW
AllowSetForegroundWindow
MessageBoxW
RegisterClassW
DefDlgProcW
GetClassInfoW
IsRectEmpty
UnregisterClassA
PostMessageW
SendMessageW
CheckDlgButton
EndDialog
SetDlgItemTextW
SetFocus
GetDlgItem
DestroyWindow
CreateWindowExW
IsChild
RegisterClassExW
SetWindowLongW
GetWindowLongW
DefWindowProcW
SetForegroundWindow
LoadIconW
GetSystemMetrics
IsIconic
GetWindowPlacement
GetWindowRect
SystemParametersInfoA
OffsetRect
IntersectRect
SetWindowPos
GetDesktopWindow
CopyRect
SetRect
RegisterWindowMessageW
LoadImageW
DestroyIcon
IsWindow
PostQuitMessage
AppendMenuW
InsertMenuW
CreateMenu
DeleteMenu
GetMenuItemInfoW
GetSystemMenu
ModifyMenuW
SetCursor
LoadCursorW
IsZoomed
SetWindowPlacement
GetClientRect
MoveWindow
ShowWindow
GetClassInfoExW
UnregisterClassW
SetMenuItemInfoW
CheckMenuItem
EnableMenuItem
SetWindowTextW
InvalidateRect
UpdateWindow
LockWindowUpdate
SetWindowRgn
IsWindowVisible
EnableWindow
EqualRect
SendInput
GetTitleBarInfo
GetCursorPos
EnumDisplaySettingsExW
AdjustWindowRectEx
ShowWindowAsync
KillTimer
GetMenu
SetTimer
RedrawWindow
IsWindowEnabled
GetDC
ReleaseDC
MapWindowPoints
SendDlgItemMessageW
BeginPaint
DrawIcon
EndPaint
CreateDialogIndirectParamW
GetDlgItemTextW
IsDlgButtonChecked
EnumDisplayMonitors
DrawTextW
GetFocus
GetWindowDC
GetMonitorInfoW
SubtractRect
ScreenToClient
MapDialogRect
GetWindow
DrawIconEx
CheckRadioButton
FillRect
EnumDisplayDevicesW
CharLowerW
LoadStringW
CreateDialogParamW
PtInRect
GetMenuItemCount
MonitorFromWindow
CharNextW
api-ms-win-crt-string-l1-1-0
wcsnlen
wcscspn
wcsncmp
memset
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__errno
_o__exit
_o__get_narrow_winmain_command_line
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__itow_s
_o__ltow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcslwr
_o__wcslwr_s
_o__wcsnicmp
_o__wtoi
_o__wtol
_o_exit
_o_free
_o_iswdigit
_o_iswspace
_o_malloc
_o_terminate
_o_toupper
_o_towlower
_o_towupper
_o_wcscat_s
_o_wcscpy_s
_o_wcsncat_s
_o_wcsncpy_s
_o_wcstok
_o_wcstok_s
_o_wcstol
_o_wcstombs_s
_o_wcstoul
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
_o__CIpow
_o__crt_atexit
_o__controlfp_s
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcschr
wcsstr
wcsrchr
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
_o__configthreadlocale
memmove
shlwapi
PathAppendW
PathStripPathW
StrStrIW
PathFindExtensionW
UrlCombineW
ShellMessageBoxW
PathCanonicalizeW
UrlCreateFromPathW
PathRemoveFileSpecW
PathFindFileNameW
normaliz
IdnToAscii
shcore
SHStrDupW
ord109
ntdll
RtlInitString
RtlNtStatusToDosError
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ