qplmHIbCwELta
Static task
static1
Behavioral task
behavioral1
Sample
X/PreSignInSettingsConfig.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
X/PreSignInSettingsConfig.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
X/start.bat
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
X/start.bat
Resource
win10v2004-20230703-en
General
-
Target
0f39ee00fe5589e319da32141f8fc95884b11d7cdcbe26c6d1b4ec064d575eb2
-
Size
189KB
-
MD5
522bda8e7d36e5955f9a5ed804806696
-
SHA1
9a1680be6ff32b56369854c68c94a97760c0e7a0
-
SHA256
0f39ee00fe5589e319da32141f8fc95884b11d7cdcbe26c6d1b4ec064d575eb2
-
SHA512
5640aa1731d234d396a6674606b3ff26a4415f2e8e309ca8eb9a74b9fb3a29220b9d382d162224c17aa7c3636155574056c385a951c1564bc3f8fe04305ce41a
-
SSDEEP
3072:IMz63BbBu5h0GHRWJFk8f6+i0bvM3MU+8oDoANc1vZVgy6xT3XsPNvJrHDsj+wc4:D6xbBu5q4WJ+A65UvM3MUWXNcrV+Hs1I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/X/PreSignInSettingsConfig.dll
Files
-
0f39ee00fe5589e319da32141f8fc95884b11d7cdcbe26c6d1b4ec064d575eb2.zip
-
X/PreSignInSettingsConfig.dll.dll windows x64
8de43240f537d36bba6d52e1fce100d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
Thread32First
OpenThread
SuspendThread
CloseHandle
Thread32Next
ResumeThread
GetProcessHeap
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
SleepEx
GetCurrentThread
GetModuleHandleA
LoadLibraryA
WriteConsoleW
HeapWalk
lstrcmpiW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetLastError
SetLastError
VirtualProtect
VirtualFree
VirtualQuery
FreeLibrary
GetProcAddress
LoadLibraryExA
LoadLibraryExW
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtectEx
VirtualQueryEx
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
OutputDebugStringW
CreateFileW
RtlUnwind
advapi32
RegGetValueA
Exports
Exports
Sections
.text Size: 360KB - Virtual size: 359KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
X/start.bat