Static task
static1
Behavioral task
behavioral1
Sample
Korsakoff.exe
Resource
win7-20230220-en
General
-
Target
Korsakoff.exe
-
Size
150KB
-
MD5
d03d1839ba1d7c4c5a1941d8e3fb35eb
-
SHA1
00072a97320c04b2732339e53774762450301d93
-
SHA256
796ba530098b895341962be8f2c0de6acc18a3edcc5ed9dd2fac7867c0047fe1
-
SHA512
b23147c4e0d4f5d7a9dff7d6a19d588bd1b5726baa5883712830831679347f82f211683484fcee55b8bca829022deee2c936495d66c4d5a27428022a27851a20
-
SSDEEP
3072:xWBwnf9pn1IDouc+TiX9SHOjfaaR1clwr1w/IRkDgdyV:+oLOTFQfaa3cE1w2Ug
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Korsakoff.exe
Files
-
Korsakoff.exe.exe windows x64
d368098002d24bb51fe91ae21666133a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
CloseHandle
GetLastError
Sleep
GetCurrentProcess
CreateProcessW
GetModuleFileNameW
CreateFileA
AllocConsole
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
ExpandEnvironmentStringsW
CopyFileA
ExpandEnvironmentStringsA
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
user32
FindWindowA
MessageBoxA
ShowWindow
shell32
ShellExecuteExA
advapi32
OpenProcessToken
GetTokenInformation
msvcp140
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??Bid@locale@std@@QEAA_KXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
wininet
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA
vcruntime140
memmove
memcpy
__std_exception_copy
__std_terminate
__C_specific_handler
memset
memcmp
__std_exception_destroy
__CxxFrameHandler3
memchr
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
__p___argv
_initialize_onexit_table
_register_onexit_function
_c_exit
__p___argc
terminate
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_cexit
_register_thread_local_exe_atexit_callback
_crt_atexit
_seh_filter_exe
_exit
_initterm_e
system
exit
_invalid_parameter_noinfo_noreturn
_set_app_type
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vfprintf
_set_fmode
__acrt_iob_func
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ