Static task
static1
Behavioral task
behavioral1
Sample
140000000.svchost.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
140000000.svchost.exe
Resource
win10v2004-20230220-en
General
-
Target
140000000.svchost.exe
-
Size
204KB
-
MD5
a24cd02a171721b6b1d45c0ed43c3987
-
SHA1
7b6b6b250d21a35f3dd909a9f4511a24cf0453ce
-
SHA256
30028db52808c277ffcf7cb89a470acf5e4e46579d1047ccb7c89b89ba334933
-
SHA512
3e840f3a19d785100aa2870ad1dbe964edf2b48eac710f3786b18bce6ee385f26d5df61473ced64960bfaf04fc305a9db6f193d5b13468c040eb4ee906600ea4
-
SSDEEP
3072:SmR3/JSwNPVxTl7VHv6CCsWfHpc2B9fC3cmwZTZc+datbkyg:JVJSwNPVxTJVTQfHplrK3gZylbxg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 140000000.svchost.exe
Files
-
140000000.svchost.exe.exe windows x64
7f6f162b7a7c9f8a6d358de7128a1ce1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetEvent
GetModuleHandleW
VirtualFree
VirtualQueryEx
ReadProcessMemory
TerminateProcess
GetProcAddress
VirtualAlloc
SetThreadContext
LoadLibraryA
CreateEventW
GetModuleHandleA
VirtualProtect
WriteProcessMemory
ResumeThread
ExitProcess
GetThreadContext
GetCurrentProcessId
WaitForSingleObject
GetNativeSystemInfo
GetComputerNameA
SetFileAttributesW
DeleteFileW
FindNextFileW
MoveFileW
GetCurrentDirectoryW
GetLastError
GetStartupInfoA
GetTempPathW
GetStartupInfoW
GetSystemDirectoryA
GetModuleFileNameW
CreateProcessA
GetFileAttributesW
CopyFileW
CreateProcessW
FindClose
MultiByteToWideChar
CreateFileW
WideCharToMultiByte
OpenProcess
WriteFile
FindFirstFileW
CloseHandle
Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetTickCount
InitializeCriticalSection
VirtualProtectEx
ReadConsoleW
ReadFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
HeapSize
OutputDebugStringW
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CreateThread
GetCurrentThreadId
ExitThread
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineW
SetLastError
HeapFree
HeapAlloc
RtlPcToFileHeader
RaiseException
GetModuleHandleExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwindEx
GetTimeZoneInformation
GetProcessHeap
GetStdHandle
GetFileType
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetEnvironmentVariableA
advapi32
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
CreateProcessWithTokenW
CreateProcessAsUserW
RegSetValueExW
RegCloseKey
QueryServiceConfigW
ControlService
RegOpenKeyExW
RegDeleteValueW
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
RegQueryValueExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
DuplicateTokenEx
OpenProcessToken
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptDeriveKey
CryptAcquireContextW
ole32
CoCreateGuid
ws2_32
connect
htons
shutdown
recv
bind
socket
closesocket
send
listen
accept
gethostname
inet_ntoa
inet_addr
htonl
gethostbyname
WSAStartup
WSACleanup
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ