Static task
static1
Behavioral task
behavioral1
Sample
n.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
n.exe
Resource
win10v2004-20230831-en
General
-
Target
n.exe
-
Size
136KB
-
MD5
f5d167fbe6757368ff28d19109716bac
-
SHA1
18cda53f558c4d937b1c00e438cc60b75f8797c9
-
SHA256
cf1f3965d0274001df9e6c31afb991e6d1e3e6b502cef2f7cac990e9d8bbcd6c
-
SHA512
1ababb2b8b9af4fb7eb8062cfd5bfe260e1a0d194723f58bb4ba4a64dc8beb6a671f8b887220a7932168cf7fd24d157b0de8231c49f7e014bd96a16646f96f28
-
SSDEEP
3072:M2cpLWz52qI8aoXjyqytxViMvQiz/46iH6+WH5:M2OLQ5i8auyqelvQC/4lH6+WH5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource n.exe
Files
-
n.exe.exe windows x86
a18cc44c58fab76b4bd89e11b9743e7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_vsnwprintf_s
wcstod
putchar
_ftol2
_ftol2_sse
wcstok
_local_unwind4
_wcsdup
wcspbrk
memcpy
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_wcsicmp
_cexit
_exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_snwprintf_s
_vsnwprintf
wcscspn
iswctype
memmove
srand
rand
wcsrchr
calloc
_wcsrev
realloc
malloc
free
_ultow
swprintf_s
wcsncat_s
wcsstr
wcschr
exit
setlocale
_setmode
_iob
_fileno
_wcsnicmp
sprintf_s
wcsspn
qsort
wcscpy_s
wcsncmp
wcscat_s
_wcslwr
wcsncpy_s
_wcsupr
_XcptFilter
memset
ntdll
RtlInitString
NlsMbOemCodePageTag
RtlxOemStringToUnicodeSize
NtQuerySystemTime
RtlTimeToSecondsSince1970
RtlLengthSid
RtlOemStringToUnicodeString
RtlInitUnicodeString
RtlInitAnsiString
RtlGetNtProductType
RtlCompareMemory
RtlQueryTimeZoneInformation
RtlTimeFieldsToTime
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
RtlNtStatusToDosError
RtlAllocateHeap
NtOpenProcessToken
NtClose
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSubAuthorityCountSid
RtlCopySid
samcli
NetGroupAddUser
NetGroupGetInfo
NetUserEnum
NetUserGetGroups
NetUserGetInfo
NetUserSetInfo
NetUserModalsSet
NetGroupEnum
NetGroupGetUsers
NetGroupSetInfo
NetGroupDel
NetGroupDelUser
NetGroupAdd
NetUserModalsGet
NetUserAdd
NetUserDel
netutils
NetApiBufferFree
NetpwNameValidate
NetapipBufferAllocate
NetpwListTraverse
NetpwNameCompare
NetpwListCanonicalize
NetpwPathType
NetpwNameCanonicalize
NetApiBufferAllocate
NetApiBufferReallocate
dsrole
DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
GetSystemDirectoryW
SetSystemTime
GetSystemTimeAsFileTime
SetLocalTime
GetComputerNameExW
srvcli
NetFileGetInfo
NetFileClose
NetSessionEnum
NetShareGetInfo
NetShareEnum
NetFileEnum
NetSessionGetInfo
NetShareDel
NetShareSetInfo
NetShareAdd
NetShareCheck
NetShareDelSticky
NetServerStatisticsGet
NetRemoteTOD
NetSessionDel
NetConnectionEnum
NetServerTransportEnum
NetServerSetInfo
NetServerGetInfo
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-localization-l1-2-1
SetThreadUILanguage
FormatMessageW
GetUserDefaultLCID
GetCPInfo
api-ms-win-core-string-l1-1-0
CompareStringW
WideCharToMultiByte
api-ms-win-core-processenvironment-l1-2-0
GetCommandLineW
GetStdHandle
api-ms-win-core-console-l1-1-0
GetConsoleMode
WriteConsoleW
ReadConsoleW
SetConsoleMode
GetConsoleOutputCP
api-ms-win-core-errorhandling-l1-1-1
SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
api-ms-win-core-heap-l1-2-0
HeapSetInformation
wkscli
NetWkstaUserGetInfo
NetWkstaGetInfo
NetUseEnum
NetWkstaTransportEnum
NetWkstaStatisticsGet
NetUseDel
api-ms-win-security-base-l1-2-0
GetSidSubAuthority
GetAce
CopySid
EqualSid
GetSidLengthRequired
GetLengthSid
AddAccessAllowedAce
CreateWellKnownSid
GetSidSubAuthorityCount
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
api-ms-win-core-file-l1-2-1
GetFileType
GetDriveTypeW
WriteFile
api-ms-win-core-datetime-l1-1-1
GetDateFormatW
GetTimeFormatW
logoncli
DsGetDcNameW
api-ms-win-service-management-l1-1-0
StartServiceW
OpenServiceW
CloseServiceHandle
OpenSCManagerW
api-ms-win-service-core-l1-1-1
EnumDependentServicesW
EnumServicesStatusExW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
GetModuleHandleA
api-ms-win-core-processthreads-l1-1-2
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-console-l2-1-0
PeekConsoleInputW
api-ms-win-core-kernel32-legacy-l1-1-1
LoadLibraryW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalAlloc
LocalFree
LocalAlloc
GlobalFree
api-ms-win-core-privateprofile-l1-1-1
GetProfileStringW
api-ms-win-security-activedirectoryclient-l1-1-0
DsUnBindW
DsCrackNamesW
DsFreeNameResultW
DsBindWithSpnExW
browcli
NetServerEnum
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
api-ms-win-core-string-obsolete-l1-1-0
lstrlenW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
DelayLoadFailureHook
Sections
.text Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ