Static task
static1
Behavioral task
behavioral1
Sample
2023-05-18_111b34aea0e933c7102d74b12cef356c_destroyer_sage.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-18_111b34aea0e933c7102d74b12cef356c_destroyer_sage.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-18_111b34aea0e933c7102d74b12cef356c_destroyer_sage
-
Size
58KB
-
MD5
111b34aea0e933c7102d74b12cef356c
-
SHA1
4825680ea9e8c0720aeb516d5354ba6e58cff69f
-
SHA256
5f20eefbda20071585f92716aab3ba57af9e8e669c8b1ae6119e976995b3f7fe
-
SHA512
e07a57ce0773a1403d56e5f853aec400f1172535b808bd3200f4d444cedb0bfd88c634e54720b84835a274083b3c9ab454e7500552abae7393a26e2253209415
-
SSDEEP
1536:WF4HL5iOEGybPDUBqPhRoBKrZgzvqPrg+SNDN:WF4HLltOhNVgzyzzSNDN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-05-18_111b34aea0e933c7102d74b12cef356c_destroyer_sage
Files
-
2023-05-18_111b34aea0e933c7102d74b12cef356c_destroyer_sage.exe windows x86
5357a5854199eab7d689d7aee44944ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetSystemMetrics
SystemParametersInfoW
GetKeyboardLayoutList
GetForegroundWindow
shlwapi
StrStrIW
StrRChrW
StrStrA
advapi32
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetUserNameW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
SystemFunction036
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
ws2_32
recv
getaddrinfo
connect
freeaddrinfo
getsockopt
send
htons
socket
sendto
WSAStartup
closesocket
winhttp
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryHeaders
WinHttpCloseHandle
shell32
ShellExecuteA
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteExW
ole32
CoInitialize
CoCreateInstance
gdiplus
GdipAlloc
GdipDeleteBrush
GdipCreateStringFormat
GdipCloneStringFormat
GdipDeleteStringFormat
GdipDeleteGraphics
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipCreateLineBrushFromRectI
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetImageGraphicsContext
GdipGraphicsClear
GdipDrawString
GdipCreateFont
GdiplusStartup
GdipFree
GdipDeleteFont
kernel32
GetLastError
GetVersionExA
GetFileSizeEx
SetFilePointerEx
WriteFile
CreateFileW
SetFilePointer
lstrlenA
CloseHandle
GetComputerNameW
GetModuleHandleA
CreateFileA
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
GetExitCodeThread
TerminateThread
GetLogicalDriveStringsW
GetDriveTypeW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetFileAttributesW
ExitThread
GetTempPathW
lstrlenW
GetTickCount
Sleep
CreateMutexA
lstrcmpiW
GetShortPathNameW
GetCurrentProcess
DeleteFileW
MoveFileExW
SleepEx
OpenProcess
CreateThread
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
AttachConsole
GetStdHandle
ExitProcess
LoadLibraryA
GetModuleFileNameW
GetFileSize
GetCommandLineW
ReadFile
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 492B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ