Static task
static1
Behavioral task
behavioral1
Sample
MTM4OWYz.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
MTM4OWYz.dll
Resource
win10v2004-20230220-en
General
-
Target
MTM4OWYz.exe
-
Size
148KB
-
MD5
efcfff316e9cf183ca1cd619968cd11c
-
SHA1
c350105fae1c786bc8e5b84e7ad0e9f9551d0bfe
-
SHA256
be8374fcf0fbbc02cfeb62a7e7ca2dbffdfd7afa255b70b35ba76db44f78690b
-
SHA512
eaf81baf52ed5a5ebb66450db14062897f265e7711bdb083bc03abf34842878e82939c840096f94fc7eb05d0eb04152e8ee5cea693a8d7636687f257b4f441a4
-
SSDEEP
3072:1yc7F1nQBaGbcAjCTjJ1HHcnRN+v/+JQnc/YF1Nyi9f3bnMvacPAu:1yU64pncnRkXwQUY38i9GaYA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MTM4OWYz.exe
Files
-
MTM4OWYz.exe.dll windows x64
c3ad020d88999a7ea4fe533a7ea9ece2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
netapi32
NetApiBufferFree
NetGetDCName
kernel32
GetCurrentThread
GetFileSize
SetErrorMode
GetProcessHeap
GetCommandLineA
WaitForMultipleObjectsEx
TerminateThread
Sleep
HeapDestroy
lstrcatA
ExitThread
FlushFileBuffers
GetPrivateProfileStringA
OpenMutexA
WritePrivateProfileStringA
GetCurrentProcessId
CreateThread
HeapReAlloc
SetFilePointer
MapViewOfFile
GetCurrentProcess
CreateFileMappingA
DeleteFileA
GetComputerNameA
MoveFileExA
SetHandleInformation
TerminateProcess
GetEnvironmentVariableA
CreateDirectoryA
FindFirstFileA
GetTempFileNameA
FindClose
GetLocalTime
FindNextFileA
GetModuleHandleA
GetPrivateProfileSectionA
ReleaseMutex
GetTempPathA
CancelIo
WaitForMultipleObjects
SetNamedPipeHandleState
CreateNamedPipeA
GetOverlappedResult
ReadFile
TransactNamedPipe
CreateEventA
WriteFile
ConnectNamedPipe
__chkstk
SetEvent
WaitNamedPipeA
CallNamedPipeA
PeekNamedPipe
CreateFileA
GetTickCount
SetLastError
FormatMessageA
LoadLibraryA
GetProcAddress
FreeLibrary
LocalFree
HeapFree
VerSetConditionMask
HeapAlloc
GetVersionExA
GetLastError
CloseHandle
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrlenA
UnmapViewOfFile
advapi32
MakeAbsoluteSD
RegEnumValueA
RegQueryValueExA
CryptGenRandom
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptVerifySignatureA
CryptGenKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptAcquireContextA
CryptSignHashA
CryptReleaseContext
CryptExportKey
RegCloseKey
RegCreateKeyExA
RegSetValueExA
AddAccessAllowedAce
GetTokenInformation
LookupAccountNameA
OpenThreadToken
OpenProcessToken
GetUserNameA
RevertToSelf
ImpersonateNamedPipeClient
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetFileSecurityA
GetSidLengthRequired
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExA
msvcrt
__iob_func
fprintf
free
fflush
fopen
fread
strcmp
ferror
fwrite
fclose
strcat
exit
_lrotl
memset
memcpy
sprintf
strlen
_vsnprintf
vfprintf
abs
strchr
strncpy
_strdup
strrchr
_stricmp
toupper
strcpy
malloc
strncmp
strstr
_itoa
_errno
strtok
_ultoa
strtoul
_time64
rand
strncat
sscanf
memcmp
_strlwr
rewind
_tzset
ftell
_localtime64
fseek
strpbrk
_initterm
_strnicmp
atoi
Sections
.text Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 682B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ