Behavioral task
behavioral1
Sample
3588.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3588.exe
Resource
win10v2004-20230703-en
General
-
Target
3588.pcap
-
Size
100KB
-
MD5
72bdd110bfe620da5b2d8a64eaa9e840
-
SHA1
355cac483f66b9a15eb340f796ed9fbdd30b0bf9
-
SHA256
b5af21afb00513a30d718f8b818e766b092ef83fb172039feea8f26a27e38e74
-
SHA512
bb0b57745c634146c3bd30554fab789153b55175851301d90de48bad728e8535871ee32d2227ce0ee5b2c055879c8f90e9a3fc5d77e40342704cdc8c5e22ed23
-
SSDEEP
1536:76sMD3H8V3jsUnHLiREsTbDV/48OO4vh47483gO69+LEnG:76srVzJiRrTHVORe75Vw+L6
Malware Config
Extracted
brbbot
brb.3dtuts.by
Signatures
-
Brbbot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3588.pcap
Files
-
3588.pcap.exe windows x64
Password: infected
475b069fec5e5868caeb7d4d89236c89
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegFlushKey
RegCloseKey
CryptAcquireContextW
CryptDeriveKey
CryptReleaseContext
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
wininet
HttpSendRequestA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
ws2_32
gethostbyname
WSACleanup
WSAStartup
inet_ntoa
gethostname
kernel32
CreateFileW
HeapSize
WriteConsoleW
SetStdHandle
LoadLibraryW
GetStringTypeW
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
CreateFileA
FindResourceA
LoadResource
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
SizeofResource
GetLastError
LockResource
GetModuleHandleA
CloseHandle
GetComputerNameA
HeapReAlloc
MoveFileExA
WaitForSingleObject
SetEvent
GetModuleHandleW
GetSystemWow64DirectoryA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
CopyFileA
CreateEventW
GetModuleFileNameA
DeleteFileA
GetFileSize
ReadFile
WideCharToMultiByte
GetProcAddress
GetTempFileNameA
GetTempPathA
FlushFileBuffers
GetConsoleMode
GetCommandLineW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
ExitProcess
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
MultiByteToWideChar
SetFilePointer
GetConsoleCP
user32
GetDC
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ