Static task
static1
Behavioral task
behavioral1
Sample
MCluster.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
MCluster.exe
Resource
win10-20231023-en
General
-
Target
MCluster.exe
-
Size
678KB
-
MD5
3ade61a87c1769fe52d3c739e225b960
-
SHA1
f6bc0f131ae67d5409894e54a885fcd17c262970
-
SHA256
ee00fe31c6120dbae806f36edadffd92f0483135e60e306665a25b1400cdfcc7
-
SHA512
8aafcee9c6a81938d28855dfda434068cbb41736ba31595b55aebf7a086b133990d61b07f687a6e3f452740da40a859015ef06c5f9b39bce88fb7fcfaab3b46e
-
SSDEEP
12288:t2a5mCNPv6iJVNHLuNljPpVv03pwiLhhmJhFuK7Fa:oa5mCN6UNHARVaxtp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource MCluster.exe
Files
-
MCluster.exe.exe windows:5 windows x64
c073c700054a007cb128da0acd46a717
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentDirectoryA
SetFileTime
WriteFile
GetFileAttributesA
CreateDirectoryA
LocalFileTimeToFileTime
lstrcpyA
WideCharToMultiByte
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetProcAddress
FreeLibrary
SetLastError
GetLastError
GetTickCount
SleepEx
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
GetModuleHandleA
WaitForSingleObject
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetModuleHandleW
ExitProcess
GetSystemTimeAsFileTime
HeapAlloc
GetCommandLineA
LCMapStringW
GetCPInfo
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCurrentProcessId
lstrlenA
FileTimeToLocalFileTime
GetFileInformationByHandle
FindClose
GetDriveTypeA
FindFirstFileExA
GetConsoleCP
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
TerminateProcess
GetCurrentProcess
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
InitializeCriticalSectionAndSpinCount
HeapSetInformation
GetVersion
HeapCreate
SetHandleCount
GetStartupInfoW
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
GetLocaleInfoW
GetModuleFileNameW
HeapSize
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
GetFullPathNameA
GetCurrentDirectoryW
WriteConsoleW
CreateFileW
GetTimeZoneInformation
CompareStringW
SetEnvironmentVariableA
GetDriveTypeW
SetEndOfFile
GetProcessHeap
lstrcatA
SystemTimeToFileTime
ReadFile
CloseHandle
CreateFileA
SetFilePointer
FreeConsole
FileTimeToSystemTime
DeleteFileA
user32
wsprintfA
shell32
ShellExecuteA
advapi32
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
CryptImportKey
CryptEncrypt
wldap32
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord41
ord26
ord50
ord60
ord143
ord211
ord22
ord46
ord30
ws2_32
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
WSAStartup
WSACleanup
WSAIoctl
setsockopt
getsockname
ntohs
bind
htons
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
gethostname
htonl
ntohl
send
recv
crypt32
CertFreeCertificateContext
Sections
.text Size: 434KB - Virtual size: 433KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ