GetModuleManagerList
Static task
static1
Behavioral task
behavioral1
Sample
riktrcreader.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
riktrcreader.exe
Resource
win10v2004-20231023-en
General
-
Target
riktrcreader.exe
-
Size
605KB
-
MD5
c93f8b6baa4f9b51b524fb69f9db46ec
-
SHA1
04e2a603e1476e20154412f83c13bb955026ec9f
-
SHA256
5c29477c6d5706654d6b9029bc8041b35c6109fcf2ef6b4d275e5730a79c8856
-
SHA512
1882d8845ec3daa53c33934026b147e459fd6c95d8ae23e1b280c0937e591ce7e883e93170fdaacac552d7ffb4d9da705bb117b05ac6d34bf4698018af7d3bfa
-
SSDEEP
12288:H4q9fRD+fb7NSfMbVtxzxapRecb7PCVVJwOdFg6PZzb/XGX:faX4eSrcVJXdFjZXGX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource riktrcreader.exe
Files
-
riktrcreader.exe.exe windows:5 windows x86
952b4b52bb105cbc8113a8f1b2d93dfd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SystemTimeToFileTime
CreateDirectoryW
RemoveDirectoryW
FindFirstFileW
FindClose
FindNextFileW
GetCurrentThreadId
GetThreadPriority
SetThreadPriority
LoadLibraryA
FreeLibrary
GetProcAddress
CreateMutexW
ReleaseMutex
CreateEventW
SetEvent
GetTickCount
ResetEvent
ResumeThread
CreateThread
ExitThread
TerminateThread
GetExitCodeThread
SuspendThread
SetLocalTime
DuplicateHandle
GetCurrentThread
Sleep
CopyFileW
MultiByteToWideChar
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetFileInformationByHandle
SetFileTime
CreateFileW
SetFilePointer
ReadFile
WriteFile
LocalFileTimeToFileTime
DeviceIoControl
WaitForMultipleObjectsEx
LoadLibraryW
CreateSemaphoreA
FileTimeToSystemTime
LocalAlloc
GetModuleHandleW
MoveFileW
DeleteFileW
SetEndOfFile
GetCurrentProcessId
FindNextFileA
DeleteFileA
FindFirstFileA
GetLongPathNameW
GetTempPathW
CancelIo
SleepEx
WaitForSingleObjectEx
QueueUserAPC
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
OpenMutexW
OpenEventW
ReadDirectoryChangesW
lstrlenW
OutputDebugStringW
QueryPerformanceFrequency
QueryPerformanceCounter
UnmapViewOfFile
InterlockedExchangeAdd
DebugBreak
FlushFileBuffers
FileTimeToLocalFileTime
InterlockedExchange
WaitForSingleObject
InterlockedDecrement
ReleaseSemaphore
InterlockedIncrement
Beep
SetCurrentDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
CloseHandle
CreateSemaphoreW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCommandLineW
InitializeCriticalSection
GetModuleFileNameW
GetThreadTimes
GetCurrentProcess
GetLastError
GetSystemTime
GetLocalTime
LocalFree
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetModuleHandleA
GetProcessHeap
SetStdHandle
VirtualAlloc
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
HeapSize
GetSystemTimeAsFileTime
WideCharToMultiByte
GetStartupInfoW
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
RaiseException
RtlUnwind
LockFile
UnlockFile
GetFileType
CreateFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
VirtualQuery
user32
UpdateWindow
MessageBoxW
CreateWindowExW
ShowWindow
LoadIconW
RegisterClassExW
TranslateMessage
UnhookWindowsHookEx
DefWindowProcW
CallNextHookEx
BeginPaint
LoadCursorW
PostQuitMessage
GetMessageW
EndPaint
ExitWindowsEx
DispatchMessageW
SetWindowsHookExW
advapi32
AddAccessAllowedAce
SetEntriesInAclW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
GetLengthSid
FreeSid
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
shlwapi
PathFindFileNameW
ws2_32
WSAGetLastError
WSAStartup
WSACleanup
gethostbyname
send
socket
closesocket
shutdown
recv
select
getpeername
getsockname
getsockopt
recvfrom
sendto
setsockopt
__WSAFDIsSet
listen
bind
accept
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: 493KB - Virtual size: 493KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 950KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ