Static task
static1
Behavioral task
behavioral1
Sample
eventcreate.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
eventcreate.exe
Resource
win10v2004-20230220-en
General
-
Target
eventcreate.exe
-
Size
34KB
-
MD5
080ac7ed2443733e6ff2a5bf0553f9c6
-
SHA1
2b6947d7ee21c2d183a84d791f292302170133af
-
SHA256
051ac0d7c28587b99f43b8286587c85cb7b5f40e7c30141b183ac5d1b3b2ed36
-
SHA512
4c77f6f42cdf5b622af27a40864fcd5540eb1accbd30e1ce215a9f19286a4a945f69cee795460a86d2065d1dbeca10327edd75a4860c9585ee4dbf56939ee021
-
SSDEEP
768:BYgLOTDz2rjgAB7tW0bi6ZVrXGDlX3QWuxlMMqoaC2MXdB:BYgLOTDAVSmR0lMxlMMLaC2MX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eventcreate.exe
Files
-
eventcreate.exe.exe windows x86
9aa2b0ab7dc35fbb1ed0455f25254d9f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
_except_handler4_common
wcstoul
_initterm
exit
_exit
__set_app_type
_cexit
__wgetmainargs
_amsg_exit
__p__commode
__p__fmode
__iob_func
_vsnwprintf
wcstok
wcstol
__setusermatherr
wcstod
?terminate@@YAXXZ
fflush
fprintf
_get_osfhandle
memset
_fileno
_errno
_memicmp
_XcptFilter
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
api-ms-win-eventlog-legacy-l1-1-0
ReportEventW
RegisterEventSourceW
DeregisterEventSource
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
ExitProcess
OpenProcessToken
GetCurrentThreadId
TerminateProcess
api-ms-win-core-registry-l2-1-0
RegConnectRegistryW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameW
FindStringOrdinal
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount
ntdll
RtlVerifyVersionInfo
VerSetConditionMask
mpr
WNetCancelConnection2W
WNetAddConnection2W
WNetGetLastErrorW
ws2_32
WSAGetLastError
WSAStartup
GetAddrInfoW
GetNameInfoW
WSACleanup
FreeAddrInfoW
sspicli
GetUserNameExW
netutils
NetApiBufferFree
srvcli
NetServerGetInfo
advapi32
CloseEventLog
OpenEventLogW
user32
CharUpperW
LoadStringW
api-ms-win-core-localization-l1-2-0
GetThreadLocale
FormatMessageW
SetThreadUILanguage
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-shlwapi-obsolete-l1-1-0
StrChrW
api-ms-win-core-file-l1-1-0
GetFileType
ReadFile
api-ms-win-core-console-l1-1-0
SetConsoleMode
GetConsoleOutputCP
WriteConsoleW
GetConsoleMode
ReadConsoleW
api-ms-win-core-processenvironment-l1-1-0
GetStdHandle
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
lstrlenA
api-ms-win-core-localization-obsolete-l1-2-0
CompareStringA
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapSize
HeapAlloc
HeapFree
HeapValidate
api-ms-win-core-version-l1-1-0
VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ