Behavioral task
behavioral1
Sample
0a34a2c61c6f84f178cfd035f218d79e.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0a34a2c61c6f84f178cfd035f218d79e.exe
Resource
win10v2004-20230824-en
General
-
Target
0a34a2c61c6f84f178cfd035f218d79e.exe
-
Size
15KB
-
MD5
0a34a2c61c6f84f178cfd035f218d79e
-
SHA1
c9d3db5fe8df034ee40703202630694997361dec
-
SHA256
6b56f6f96b33d0acefd9488561ce4c0b4a1684daf5dde9cc81e56403871939c4
-
SHA512
db5aac16f29d8e8d6938934753e35ad45f76436a6e7eb385bd0b29019fbc3627f6b609722cb1368e3fcd7393383b0a7b0e73a783de21198f62e2fb37d39dbe06
-
SSDEEP
384:8/wK8VcHXC3pA/ZbdrJXNcQbvZWXhphZBZKICpo:se2XJBbxJXZchph5/CS
Malware Config
Extracted
systembc
mxstat215dm.xyz:4044
mxstex725dm.xyz:4044
Signatures
-
Systembc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a34a2c61c6f84f178cfd035f218d79e.exe
Files
-
0a34a2c61c6f84f178cfd035f218d79e.exe.exe windows x86
3a0233c129f2514486a242d7d5874037
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassA
ShowWindow
TranslateMessage
UpdateWindow
wsprintfA
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
kernel32
WaitForSingleObject
WriteFile
SetFilePointer
VirtualFree
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
CreateThread
ExitProcess
FileTimeToSystemTime
GetCommandLineA
GetCurrentProcess
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
SetEvent
VirtualAlloc
Sleep
SystemTimeToFileTime
advapi32
RegOpenKeyExA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegSetValueExA
GetSidSubAuthority
RegDeleteValueA
RegCreateKeyExA
wsock32
closesocket
connect
inet_addr
inet_ntoa
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
htons
WSAStartup
ws2_32
freeaddrinfo
WSAIoctl
getaddrinfo
ole32
CoUninitialize
CoInitialize
CoCreateInstance
secur32
GetUserNameExA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExW
QueryContextAttributesA
InitializeSecurityContextA
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 370B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ