Static task
static1
Behavioral task
behavioral1
Sample
al-khaser.exe
Resource
win10v2004-20230220-en
General
-
Target
al-khaser.exe
-
Size
240KB
-
MD5
a3bbf33f5d757f520164cd68676ff3b6
-
SHA1
12c3adbacbf6a2959ae9eecddc7a66807ceea06e
-
SHA256
ad49544b37e6c507fbec517f9f17a313d0cc5fd2574fe1697ce4fe3447382fd2
-
SHA512
e3fb933dc16243b8f4108559b138c95e6dbe65336ba29984e11ed1bfcccd79a52d1e5b8ed3809682cd853cfb848a0bc3c97b94cb23b5db389e0ba66f02345f44
-
SSDEEP
3072:cZOwbXgbVUp7n4NWFkxOb50sl+0Fx35AZHdvKEfZTHy4QG4BCPOClK22JXtU6ZxC:cZHbiUxl0slZFol58liCNX2NNNymB
Malware Config
Signatures
Files
-
al-khaser.exe.exe windows x64
cbfca8e7f8e4613dc03df3d700c2d30b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetLastError
OutputDebugStringW
GetLastError
GetModuleHandleExW
VirtualQuery
OpenProcess
K32GetModuleFileNameExW
GetWindowsDirectoryW
QueryInformationJobObject
GetCurrentProcessId
K32GetProcessImageFileNameW
QueryDosDeviceW
GetSystemDirectoryW
GetEnvironmentVariableW
GetModuleFileNameW
K32GetMappedFileNameW
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
CreateMutexW
SetHandleInformation
CreateEventW
SetEvent
CreateThread
SwitchToThread
WaitForSingleObject
SetUnhandledExceptionFilter
RaiseException
GetWriteWatch
GlobalGetAtomNameW
GetBinaryTypeW
HeapQueryInformation
ReadProcessMemory
ResetWriteWatch
GetModuleHandleW
GetComputerNameW
GetComputerNameExW
GetSystemWindowsDirectoryW
CreateFileW
LocalAlloc
DeviceIoControl
LocalFree
GetTickCount
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
Wow64DisableWow64FsRedirection
VerSetConditionMask
ExpandEnvironmentStringsW
LoadLibraryA
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleTitleW
GetConsoleWindow
FormatMessageW
lstrlenW
LocalSize
MultiByteToWideChar
GetFileAttributesW
HeapAlloc
HeapFree
Process32FirstW
Process32NextW
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueEx
VerifyVersionInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
LoadLibraryW
GetProcAddress
K32GetModuleInformation
VirtualProtect
GetSystemInfo
GetProcessHeap
IsDebuggerPresent
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
VirtualFree
GetCurrentThread
GetThreadContext
VirtualAlloc
CloseHandle
GetCurrentProcess
Wow64RevertWow64FsRedirection
CheckRemoteDebuggerPresent
user32
FindWindowW
MoveWindow
GetSystemMetrics
GetLastInputInfo
KillTimer
SetTimer
GetShellWindow
GetWindowThreadProcessId
wsprintfW
GetMessageW
TranslateMessage
GetCursorPos
DispatchMessageW
advapi32
CloseServiceHandle
RegOpenKeyExW
GetTokenInformation
OpenProcessToken
EnumServicesStatusExW
GetUserNameW
OpenSCManagerW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
shell32
SHGetSpecialFolderPathW
ole32
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
oleaut32
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
VariantClear
SafeArrayUnaccessData
SysFreeString
SysAllocString
msvcp140
_Equivalent
?_Xinvalid_argument@std@@YAXPEBD@Z
_To_wide
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
shlwapi
PathRemoveExtensionW
PathGetDriveNumberW
StrCmpIW
ord156
PathFindFileNameW
PathCombineW
wnsprintfW
StrCmpNIW
StrChrW
StrCmpW
StrStrW
StrStrIW
mpr
WNetGetProviderNameW
iphlpapi
IcmpCreateFile
IcmpSendEcho
GetAdaptersInfo
IcmpCloseHandle
winmm
timeKillEvent
timeEndPeriod
timeSetEvent
timeGetDevCaps
setupapi
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
powrprof
GetPwrCapabilities
slwga
SLIsGenuineLocal
vcruntime140
__std_exception_copy
__std_exception_destroy
wcsstr
__current_exception
__current_exception_context
memset
_CxxThrowException
memcpy
__C_specific_handler
memmove
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-stdio-l1-1-0
fclose
getchar
__stdio_common_vswprintf_s
__p__commode
_set_fmode
fputc
_wfopen_s
__stdio_common_vfwprintf
__stdio_common_vswprintf
__stdio_common_vfprintf
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
isxdigit
strtok_s
_wcsicmp
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
terminate
_cexit
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_set_app_type
exit
_errno
_initterm
_initterm_e
_exit
_crt_atexit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
calloc
_callnewh
realloc
free
api-ms-win-crt-convert-l1-1-0
_wcstoui64_l
api-ms-win-crt-locale-l1-1-0
_get_current_locale
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
_wasctime_s
_localtime64_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 98KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ