Static task
static1
Behavioral task
behavioral1
Sample
Carrion.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Carrion.exe
Resource
win10v2004-20230220-en
General
-
Target
Carrion.exe
-
Size
20.0MB
-
MD5
102e1ab79b459a9cd084b2ba48039a97
-
SHA1
316188a6a99222637d3571f5b4c60b1c92dbd334
-
SHA256
07cefe0af3c34a1ba87fc2f159b8d5b7f570f8f4b4ed1a38a1fa948c46f8fc7b
-
SHA512
5a759a7af1bcda4640aba7b5dd2fbc0243b6847908892d2b77fa0e477f796055164e77ea643d3d7b025f5cf3d9dfbe79912dc5529665d6bc8914f2b62cfe5b88
-
SSDEEP
196608:fjCj/09C2Blo4QpqAIL2JSeBEEoS0QhK4JFU:pNHoJs4SeWENr
Malware Config
Signatures
Files
-
Carrion.exe.exe windows x64
efeb9d86857738288c9b3c7704d1a091
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetTickCount64
HeapFree
Sleep
GetCurrentProcessorNumber
WaitForSingleObject
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetProcAddress
IsDebuggerPresent
RaiseFailFastException
WaitForThreadpoolWaitCallbacks
LoadLibraryExW
FreeLibrary
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
WaitForMultipleObjectsEx
SetEvent
ResetEvent
CreateEventExW
FlushProcessWriteBuffers
WaitForSingleObjectEx
GetCurrentThreadId
DuplicateHandle
GetCurrentProcess
GetCurrentThread
RaiseException
GetFileAttributesExW
ReadFile
GetSystemInfo
VirtualQuery
RtlVirtualUnwind
GetStdHandle
CreateFileW
WriteFile
AddVectoredExceptionHandler
FlsAlloc
CloseThreadpoolIo
FlsSetValue
CreateEventW
SwitchToThread
CreateThread
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
GetTickCount
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleExW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetEnvironmentVariableW
GetSystemTimeAsFileTime
DebugBreak
InitializeCriticalSection
SleepEx
GlobalMemoryStatusEx
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
GetNumaHighestNodeNumber
GetProcessAffinityMask
WriteConsoleW
HeapReAlloc
HeapAlloc
GetProcessHeap
CloseHandle
GetLastError
FlsGetValue
SetLastError
HeapSize
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
RtlPcToFileHeader
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
GetFileType
MultiByteToWideChar
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
advapi32
AdjustTokenPrivileges
OpenProcessToken
EventEnabled
EventWrite
EventRegister
LookupPrivilegeValueW
ole32
CoWaitForMultipleHandles
CoInitializeEx
CoCreateInstance
CoUninitialize
CoGetApartmentType
bcrypt
BCryptGenRandom
Sections
.text Size: 473KB - Virtual size: 472KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.managed Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9.0MB - Virtual size: 9.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 617KB - Virtual size: 641KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 694KB - Virtual size: 693KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 449KB - Virtual size: 448KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ