Static task
static1
Behavioral task
behavioral1
Sample
monitor.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
monitor.exe
Resource
win10v2004-20230220-en
General
-
Target
monitor.exe
-
Size
443KB
-
MD5
339927468e43abd5bc6cd7e193ee7f45
-
SHA1
b0306eed2bc415e4a362e1a93cc069b0a2f6bfc4
-
SHA256
8c7811af7415e045c3fe8b28f001ed23e6cb78ac4dcc4c63878f1007110881ee
-
SHA512
29e749a2a70c477bed2045d6ae11b6e17aaa5737a92b537887d242222b9820898e21de0eed17731de19497a6e0b69f61c6c9e5f0d8a28af6170f8a635d9dc34c
-
SSDEEP
12288:vMmC1RKQyKgkXjLxmXLUFZY+KOrU+Jxv9pGHNu4B2UBl:vHnkXjLxmX4FO+RU+ryI4rP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource monitor.exe
Files
-
monitor.exe.exe windows x86
ae8d388b1e0c8bcccc2d22cc55c0033a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
lua51
luaL_addstring
luaL_checkoption
luaL_openlib
lua_pushnil
lua_replace
luaL_buffinit
luaL_optlstring
luaL_addlstring
lua_tonumber
luaL_pushresult
lua_pushlstring
luaL_argerror
lua_typename
lua_rawset
lua_rawget
lua_error
lua_getmetatable
luaL_openlibs
luaL_loadfile
lua_pcall
luaL_newstate
luaL_loadstring
lua_isnumber
lua_insert
lua_rawseti
lua_toboolean
lua_checkstack
lua_pushstring
lua_rawgeti
lua_touserdata
lua_call
lua_objlen
lua_isstring
lua_tolstring
lua_tointeger
lua_isuserdata
lua_pushboolean
lua_createtable
luaL_checkinteger
luaL_error
luaL_checktype
lua_pushlightuserdata
lua_type
luaL_checklstring
lua_pushinteger
lua_pushcclosure
lua_pushvalue
luaL_newmetatable
lua_settop
lua_setmetatable
luaL_register
lua_getfield
lua_gettop
lua_pushnumber
luaL_checknumber
luaL_checkudata
lua_pushfstring
luaL_optnumber
lua_newuserdata
lua_setfield
lua_gettable
lua_settable
luaL_prepbuffer
libmysql
mysql_close
mysql_real_connect
mysql_real_escape_string
mysql_store_result
mysql_init
mysql_next_result
mysql_real_query
mysql_error
mysql_get_client_info
mysql_more_results
mysql_errno
mysql_set_server_option
mysql_options
mysql_fetch_field
mysql_num_fields
mysql_field_seek
mysql_fetch_row
mysql_free_result
mysql_fetch_lengths
mysql_num_rows
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@_N@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?classic@locale@std@@SAABV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
mfc140
ord9166
ord10202
ord5742
ord7282
ord2200
ord952
ord6831
ord993
ord13830
ord6323
ord14582
ord6324
ord14583
ord6322
ord14581
ord7964
ord12474
ord14380
ord11928
ord11927
ord2027
ord7905
ord12888
ord4082
ord4143
ord9353
ord14507
ord7886
ord14509
ord12485
ord12484
ord2484
ord10330
ord5336
ord8285
ord7961
ord4580
ord12806
ord12869
ord10383
ord12190
ord8347
ord1468
ord7618
ord8429
ord13378
ord12162
ord12194
ord8180
ord12182
ord5894
ord3844
ord1696
ord12705
ord1692
ord2241
ord890
ord1389
ord6505
ord458
ord12115
ord10986
ord7459
ord8713
ord9213
ord3825
ord3808
ord1529
ord5096
ord2210
ord6581
ord3924
ord4869
ord2524
ord14291
ord4218
ord8705
ord8031
ord8026
ord6540
ord3874
ord8182
ord5388
ord7677
ord7688
ord7687
ord5390
ord5231
ord5504
ord9305
ord5739
ord5528
ord5228
ord2298
ord6463
ord1111
ord3159
ord3395
ord3396
ord10421
ord11343
ord10963
ord8997
ord1109
ord9167
ord2758
ord13677
ord6193
ord12074
ord12111
ord3258
ord3363
ord3364
ord3933
ord12067
ord2680
ord5401
ord14054
ord7783
ord5911
ord13628
ord11663
ord6848
ord14508
ord7887
ord14510
ord3050
ord4485
ord9647
ord5769
ord4493
ord4972
ord4911
ord4896
ord4958
ord5003
ord4926
ord4981
ord4997
ord4938
ord4944
ord4950
ord4932
ord4987
ord4920
ord1772
ord1751
ord1765
ord1739
ord1717
ord12201
ord12205
ord13798
ord3259
ord10950
ord6947
ord8922
ord14502
ord11881
ord3830
ord12032
ord9096
ord11672
ord11671
ord5631
ord10240
ord10236
ord10238
ord10239
ord10237
ord14699
ord8173
ord10207
ord3295
ord3298
ord7078
ord462
ord12116
ord9192
ord7461
ord316
ord2986
ord5898
ord305
ord3005
ord5155
ord13278
ord4807
ord1526
ord1044
ord310
ord300
ord5095
ord501
ord1141
ord4085
ord6290
ord2407
ord2383
ord5826
ord13584
ord2387
ord4084
ord5210
kernel32
SetEvent
GetTickCount
GetFileAttributesW
FindNextFileW
SetLastError
FindFirstFileW
GetSystemTimeAsFileTime
FormatMessageA
GetModuleHandleA
FindClose
FindNextFileA
FindFirstFileA
GetModuleFileNameA
WinExec
WideCharToMultiByte
CloseHandle
Process32Next
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
Process32First
DeleteCriticalSection
ResetEvent
GetLastError
Sleep
MultiByteToWideChar
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
OutputDebugStringW
WaitForSingleObjectEx
user32
GetMessagePos
LoadMenuW
IsIconic
UpdateWindow
GetClientRect
LoadIconW
GetSubMenu
DrawIcon
GetSystemMetrics
EnumWindows
GetWindowTextA
SendMessageA
SetWindowLongA
GetWindowLongA
SetTimer
EnableWindow
oleaut32
VarDateFromStr
VariantTimeToSystemTime
vcruntime140
__std_terminate
memmove
__std_exception_copy
memchr
_purecall
strstr
strchr
strrchr
__std_type_info_compare
__std_type_info_name
__RTtypeid
__vcrt_InitializeCriticalSectionEx
memset
_except_handler4_common
_CxxThrowException
__CxxFrameHandler3
__RTDynamicCast
memcpy
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
__p__commode
fputc
__stdio_common_vsscanf
ferror
fread
fputs
rewind
fseek
_set_fmode
ftell
_wfopen
fflush
fopen
fclose
fgetc
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
__stdio_common_vsprintf
setvbuf
fgetpos
__acrt_iob_func
__stdio_common_vsprintf_s
fwrite
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
realloc
malloc
free
_set_new_mode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atoi
_atoi64
_itoa
strtol
strtoul
_strtoi64
strtod
atof
api-ms-win-crt-runtime-l1-1-0
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_errno
_set_app_type
_invalid_parameter_noinfo
strerror
_get_narrow_winmain_command_line
terminate
_invalid_parameter_noinfo_noreturn
_initterm
_resetstkoflw
_initterm_e
_exit
exit
system
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_controlfp_s
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
_mbsnbcpy
api-ms-win-crt-time-l1-1-0
strftime
_mktime64
_localtime64_s
_time64
api-ms-win-crt-filesystem-l1-1-0
remove
rename
_mkdir
_unlock_file
_lock_file
_wstat64
api-ms-win-crt-string-l1-1-0
isdigit
isalnum
strncmp
strncpy_s
strncpy
api-ms-win-crt-math-l1-1-0
modf
_except1
floor
__setusermatherr
ceil
_dtest
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_setmbcp
ws2_32
inet_ntoa
getsockname
getpeername
freeaddrinfo
getnameinfo
gethostname
htonl
ntohs
getservbyname
WSACleanup
accept
bind
closesocket
gethostbyname
select
shutdown
listen
WSAStartup
gethostbyaddr
send
socket
connect
recvfrom
recv
sendto
ioctlsocket
WSAGetLastError
__WSAFDIsSet
inet_pton
getsockopt
setsockopt
getaddrinfo
Sections
.text Size: 229KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ