Static task
static1
Behavioral task
behavioral1
Sample
rollback.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
rollback.exe
Resource
win10v2004-20230220-en
General
-
Target
rollback.exe
-
Size
110KB
-
MD5
bb5c8a35a6f6b442d53022e723c2ef61
-
SHA1
b1dbc9828f75e353e047183e92be9ee990a6a104
-
SHA256
dc2eb19d9ef8226c5f3f74333dc65f9cc260bb056f3250841d60eee3c161fd65
-
SHA512
2b46686c03e2832f9dada0fdfc68be7a9f3ee82e0faa9f084bfaab8a058c93d5920925e2b4e3382030ab50176e7585e8ff8e4e85a7f28923bdd0fd6f80b8895f
-
SSDEEP
3072:cboBfyF4qN3j9r5grVtPT4OWxdBLW0nadoNRDuUlb:cuyF4y3x6B1/OLR8ojDuUl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rollback.exe
Files
-
rollback.exe.exe windows x64
0887a747413e66c14fd9d4063b830704
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
kernel32
Sleep
VirtualProtect
DelayLoadFailureHook
LoadLibraryExA
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetFileAttributesW
CopyFileW
HeapFree
GetProcessHeap
CreateProcessW
LoadLibraryW
GetModuleHandleW
GetWindowsDirectoryW
CreateFileW
WriteFile
CloseHandle
CreateMutexW
SetLastError
GetProcAddress
FreeLibrary
GetTickCount
GetFullPathNameW
WaitForSingleObject
CreateDirectoryW
CreateThread
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
HeapAlloc
CompareStringW
lstrlenW
ReleaseMutex
GetDiskFreeSpaceW
ReadFile
FindFirstFileW
GetCurrentDirectoryW
FindClose
FindNextFileW
RemoveDirectoryW
DeviceIoControl
SetFileAttributesW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
GetLastError
GetCurrentThreadId
gdi32
GetObjectW
CreateFontIndirectW
SetTextAlign
GetTextAlign
SetBkMode
SetTextColor
DeleteDC
GetStockObject
DeleteObject
CreateCompatibleDC
SelectObject
SetStretchBltMode
SetBrushOrgEx
StretchBlt
user32
LoadStringW
MessageBoxW
FindWindowW
SendMessageW
WaitMessage
PeekMessageW
LoadCursorFromFileW
LoadCursorW
RegisterClassW
CreateWindowExW
GetSystemMetrics
UnregisterClassW
ShowWindow
RegisterHotKey
UpdateWindow
PostThreadMessageW
GetMessageW
DispatchMessageW
GetClientRect
SetTimer
InvalidateRect
SetWindowPos
BeginPaint
EndPaint
UnregisterHotKey
KillTimer
DestroyWindow
PostQuitMessage
DefWindowProcW
LoadImageW
DrawTextW
msvcrt
memcpy
_wcsnicmp
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
__CxxFrameHandler
wcschr
wcsstr
_vsnwprintf
wcsrchr
memset
?terminate@@YAXXZ
_CxxThrowException
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtSetInformationFile
RtlNtStatusToDosError
RtlFreeHeap
RtlAllocateHeap
comctl32
ord17
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
wdscore
WdsFreeData
WdsInitializeDataUInt32
WdsSetBlackboardValue
WdsCreateBlackboard
WdsGetBlackboardValue
WdsTerminate
WdsInitialize
WdsDestroyBlackboard
WdsSetupLogMessageW
CurrentIP
ConstructPartialMsgVW
unbcl
??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z
??1Object@UnBCL@@UEAA@XZ
??0Object@UnBCL@@QEAA@XZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ
?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z
?FormatV@String@UnBCL@@SAPEAV12@PEBGPEAD@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z
??3Object@UnBCL@@SAXPEAX@Z
??2Object@UnBCL@@SAPEAX_K@Z
?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z
?Exists@Directory@UnBCL@@SAHPEBVString@2@@Z
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ
?set_HResult@Exception@UnBCL@@MEAAXJ@Z
?get_HResult@Exception@UnBCL@@UEBAJXZ
?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ
?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z
?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_CString@String@UnBCL@@QEBAPEBGXZ
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ
??1String@UnBCL@@UEAA@XZ
??0String@UnBCL@@QEAA@PEBG@Z
?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z
?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ
?Clone@Object@UnBCL@@UEBAPEAV12@XZ
?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z
?GetObjectID@Object@UnBCL@@UEBAIXZ
?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ
?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ
?GetHashCode@Object@UnBCL@@UEBAHXZ
?Equals@Object@UnBCL@@UEBAHPEBV12@@Z
??1ArgumentNullException@UnBCL@@UEAA@XZ
?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ
?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z
?ToString@String@UnBCL@@UEBAPEAV12@XZ
?GetHashCode@String@UnBCL@@UEBAHXZ
?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z
??0ArgumentException@UnBCL@@QEAA@PEBG@Z
??1ArgumentException@UnBCL@@UEAA@XZ
?get_IsEmpty@String@UnBCL@@QEBAHXZ
?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAPEAVString@2@XZ
?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ
?DecRef@Object@UnBCL@@QEAAHXZ
?AddRef@Object@UnBCL@@QEAAXXZ
?Compare@String@UnBCL@@SAHPEBG0H@Z
?Format@String@UnBCL@@SAPEAV12@PEBGZZ
??0Win32Exception@UnBCL@@QEAA@KPEBG@Z
??1Win32Exception@UnBCL@@UEAA@XZ
??0?$Array@E@UnBCL@@QEAA@HH@Z
??_D?$Array@E@UnBCL@@QEAAXXZ
?GetBuffer@?$Array@E@UnBCL@@UEAAPEAEH@Z
?CreateDir@Directory@UnBCL@@SAPEAVDirectoryInfo@2@PEBVString@2@@Z
?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z
Sections
.text Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ