DCFS1_2023-10-25_23_02_59[.]858[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
DCFS1_2023-10-25_23_02_59.858.zip
Size 50KB
Sample231025-22b2qsgh43
SHA256 1d42c6c05868f655b0203ea61276cd3e799995d35972780b8bb8012125af015b
MD5 a1e353eb7cfd6a5c5826ddd3fbbfa60c
SHA1 d75c9f67a050b1ec070848e74e3e174d8625f242
SHA512 438abad2cb2af4357d63847e867f04df37a924243db2eb5b22bfb59aa074fdd02b0963ff83819b19d4b20712ebf571a65db37b31f2310c26b636b11da43b9dfe
SSDEEP 768:NMa0j/51nh0StDGIT2jz0daGJoh6jAD8hkQhSZFaYUxYV7I14A0H8pof8:NMa0jCStDXSjgEYoh6IGALAxg7I7+f8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/C/PerfLogs/8files/lsess/lsess.exe

File Explorer

DCFS1_2023-10-25_23_02_59.858.zip

.zip 50KB
C/PerfLogs/8files/lsess/lsess.exe

.exe 66KB
manifest.json

218B

DCFS1_2023-10-25_23_02_59.858.zip

SHA256 1d42c6c05868f655b0203ea61276cd3e799995d35972780b8bb8012125af015b
MD5 a1e353eb7cfd6a5c5826ddd3fbbfa60c
SHA1 d75c9f67a050b1ec070848e74e3e174d8625f242
SHA512 438abad2cb2af4357d63847e867f04df37a924243db2eb5b22bfb59aa074fdd02b0963ff83819b19d4b20712ebf571a65db37b31f2310c26b636b11da43b9dfe
SSDEEP 768:NMa0j/51nh0StDGIT2jz0daGJoh6jAD8hkQhSZFaYUxYV7I14A0H8pof8:NMa0jCStDXSjgEYoh6IGALAxg7I7+f8
MD5 SHA1 SHA512 SSDEEP

Password

P@tr1ot1!!

C/PerfLogs/8files/lsess/lsess.exe

IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
SHA256 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f
MD5 2c78f28a0f3dbd0f45f96f4aee72e8ee
SHA1 f10803cf1d160020e3f611e9f2dd8be93cb7d7ef
SHA512 8dbfe5d58448bb4f4ae236b2ccd1da0a737650ba650e5e96dfdc95f2b9a53508c9814d72bd6204507b76ae71351ba65e50a6db2dc4cc952dab681a9b2b1c2161
SSDEEP 1536:TNeRBl5PT/rx1mzwRMSTdLpJn8qEQBoimA0Q0GTE6VfE:TQRrmzwR5J1oiBH0CE+s
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Password

P@tr1ot1!!

Minor OS version

Major OS version

Entry point

12199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetEnumResourceW WNetUseConnectionW WNetOpenEnumW WNetCloseEnum

ws2_32

ioctlsocket getpeername ntohl select WSAGetLastError htons recv socket closesocket getsockopt WSAAddressToStringW htonl connect

iphlpapi

GetIpAddrTable

winhttp

WinHttpReceiveResponse WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSendRequest

kernel32

FindClose FindNextFileW SystemTimeToFileTime OpenProcess FindFirstFileW MoveFileW GetFileSizeEx SetFilePointerEx SetEndOfFile GetCurrentThreadId GetLocalTime ExitProcess SetFilePointer WaitForSingleObject GetComputerNameW SetEvent GetLogicalDrives GetTickCount Sleep CopyFileW GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar CreateEventW WaitForMultipleObjects CloseHandle SetFileAttributesW CreateThread InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection ResetEvent DeleteCriticalSection AllocConsole WriteFile WideCharToMultiByte WriteConsoleW GetStdHandle CreateMutexW CreateProcessW GetCurrentProcess SetHandleInformation HeapFree GetLocaleInfoW ReadProcessMemory TerminateProcess GetModuleFileNameW FlushFileBuffers OpenMutexW GetLastError GetProcAddress Process32FirstW GetExitCodeThread CreatePipe Process32NextW GetModuleHandleA CreateToolhelp32Snapshot ReleaseMutex GetVersion DeleteFileW GetCurrentProcessId GetVolumeInformationW ExpandEnvironmentStringsW HeapAlloc GetProcessHeap HeapReAlloc QueryPerformanceCounter

user32

GetWindowThreadProcessId GetShellWindow

advapi32

FreeSid LookupPrivilegeValueW OpenProcessToken GetTokenInformation EqualSid RegSetValueExW RegCloseKey AdjustTokenPrivileges RegOpenKeyExW LookupAccountSidW AllocateAndInitializeSid DuplicateTokenEx RegQueryValueExW

shell32

ShellExecuteExW

ole32

CoGetObject CoInitializeEx CoUninitialize