Behavioral task
behavioral1
Sample
MicrosoftHost.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
MicrosoftHost.exe
Resource
win10v2004-20230915-en
General
-
Target
MicrosoftHost.exe
-
Size
2.4MB
-
MD5
513769789c28c134d2aea8ff70565340
-
SHA1
b8c564d66a789c933e92df9933b01f941769307d
-
SHA256
ec353335e8c9bd2c21746aeaffc3f7dd4c5db3c35524161f0e1b059d7b185fa0
-
SHA512
f02a2b344813254902ba23004d583a54f7969e64feddeb5f3e80aa75ccdd07ccd49e6cab0c28ae8c02247cdab1aa52ed90b76d5e626665883a7ae6191cad10a2
-
SSDEEP
49152:qOVk9IUoMhNopMLMuV7ERRaueWh+lpKtXDllwN/jWwqzyM6B:qok9OpMLMuV7EtV+lYGNLCzyxB
Malware Config
Signatures
Files
-
MicrosoftHost.exe.exe windows:6 windows x64
554a1b7b70761f663d2ea8cf51390df0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
ntohs
WSASetLastError
WSAStartup
select
WSARecvFrom
bind
WSAIoctl
closesocket
WSASend
shutdown
listen
WSASocketW
getpeername
getsockname
socket
WSARecv
getsockopt
ioctlsocket
setsockopt
FreeAddrInfoW
GetAddrInfoW
gethostname
htonl
WSAGetLastError
htons
psapi
GetProcessMemoryInfo
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
kernel32
GetCommandLineA
GetCommandLineW
ExitThread
GetModuleHandleExW
RaiseException
RtlPcToFileHeader
SetConsoleTitleA
GetStdHandle
SetConsoleMode
GetConsoleMode
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
CloseHandle
FreeConsole
GetConsoleWindow
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
DeviceIoControl
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
AddVectoredExceptionHandler
GetFileType
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
WaitForSingleObject
DuplicateHandle
PostQueuedCompletionStatus
QueueUserWorkItem
Sleep
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
SetEvent
ReadConsoleW
ResetEvent
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
CreateEventA
CreateDirectoryW
ReadFile
GetFileInformationByHandleEx
FindFirstFileW
GetFileSizeEx
SetLastError
FindNextFileW
WriteFile
GetDiskFreeSpaceW
RemoveDirectoryW
GetFinalPathNameByHandleW
SetFileTime
ReOpenFile
CreateHardLinkW
FindClose
GetFileAttributesW
UnmapViewOfFile
GetFileInformationByHandle
FlushViewOfFile
GetSystemInfo
SetFilePointerEx
CreateFileMappingA
MoveFileExW
CopyFileW
CreateSymbolicLinkW
SetStdHandle
MapViewOfFile
FlushFileBuffers
GetLongPathNameW
GetShortPathNameW
GetCurrentDirectoryW
ReadDirectoryChangesW
CreateIoCompletionPort
VerifyVersionInfoA
EnterCriticalSection
SetEnvironmentVariableW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
GetTempPathW
GetVersionExW
FreeEnvironmentStringsW
FileTimeToSystemTime
QueryPerformanceFrequency
SetCurrentDirectoryW
VerSetConditionMask
GetCurrentProcessId
GlobalMemoryStatusEx
QueryPerformanceCounter
GetEnvironmentStringsW
SetConsoleCtrlHandler
CancelIo
SetHandleInformation
RtlUnwind
FreeLibrary
FormatMessageA
LoadLibraryExW
SetErrorMode
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
DeleteCriticalSection
ConnectNamedPipe
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
SleepConditionVariableCS
TryEnterCriticalSection
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
ResumeThread
TlsAlloc
GetNativeSystemInfo
TlsGetValue
TlsFree
CreateSemaphoreA
GetModuleHandleA
LoadLibraryA
DebugBreak
GetStartupInfoW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
RtlUnwindEx
LoadLibraryW
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
FreeLibraryAndExitThread
GetThreadTimes
GetConsoleCP
GetFileAttributesExW
SetFileAttributesW
ExitProcess
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
HeapReAlloc
HeapFree
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapSize
GetFullPathNameW
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
GetSystemTimeAsFileTime
SetFileCompletionNotificationModes
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
GetTickCount
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
GetLocaleInfoW
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
user32
MapVirtualKeyW
DispatchMessageA
GetMessageA
ShowWindow
GetSystemMetrics
TranslateMessage
shell32
SHGetSpecialFolderPathA
advapi32
GetUserNameW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 304KB - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 257KB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_SHA3_25 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 47KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ