Behavioral task
behavioral1
Sample
f67746e5bff0fa6d9d578f3c81246ec8af9de4899a6e663daa570f4aa94edf43.exe
Resource
win7-20231020-en
General
-
Target
f67746e5bff0fa6d9d578f3c81246ec8af9de4899a6e663daa570f4aa94edf43
-
Size
1.8MB
-
MD5
eb4c372ee43fc2548d6843f3d02c9797
-
SHA1
fb0b142f8a6167f1be4701727b5e5e622b751bb4
-
SHA256
f67746e5bff0fa6d9d578f3c81246ec8af9de4899a6e663daa570f4aa94edf43
-
SHA512
f745531e7656eff40e7fad491e80ecf93288f10f1509a0239372ff0b47da7350bc1ff09a96377a4095d914e06f605a1dab807b25c5bf390b98ce8ee11d8a276f
-
SSDEEP
49152:XPujn/TJQ1NLlSqrU5tUE1etEtLlWiTHfeiEA2RQ6zHvyRWMzTb/AxoFIO2:XPcn/TJKSb5tN1etEtLlWiTHfeiEA2RJ
Malware Config
Signatures
Files
-
f67746e5bff0fa6d9d578f3c81246ec8af9de4899a6e663daa570f4aa94edf43.exe windows:6 windows x64
db469bb3aaf1156758357e3a6bb0f090
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAGetLastError
WSASetLastError
WSAStartup
select
WSARecvFrom
bind
WSAIoctl
closesocket
WSASend
shutdown
WSASocketW
socket
WSARecv
getsockopt
ioctlsocket
setsockopt
FreeAddrInfoW
GetAddrInfoW
htonl
htons
kernel32
SetStdHandle
ExitThread
GetCommandLineW
ExitProcess
GetModuleHandleExW
GetConsoleCP
GetDriveTypeW
GetCommandLineA
RaiseException
GetStdHandle
SetConsoleMode
GetConsoleMode
CreateMutexW
Sleep
GetLastError
CreateProcessW
MultiByteToWideChar
SetThreadAffinityMask
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
CloseHandle
FreeConsole
GetConsoleWindow
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
LocalFree
FlushInstructionCache
GetFileType
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
PostQueuedCompletionStatus
QueueUserWorkItem
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
EnterCriticalSection
GetModuleFileNameW
SetEnvironmentVariableW
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
FreeEnvironmentStringsW
FileTimeToSystemTime
QueryPerformanceFrequency
GetSystemInfo
GetCurrentDirectoryW
GetCurrentProcessId
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
CancelIo
SetHandleInformation
CreateEventA
CreateIoCompletionPort
SetFileCompletionNotificationModes
SetErrorMode
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
SleepConditionVariableCS
TryEnterCriticalSection
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
GetNativeSystemInfo
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
GetLongPathNameW
ReadDirectoryChangesW
ReadFile
SetNamedPipeHandleState
SetLastError
WriteFile
CreateNamedPipeW
RtlUnwind
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
FlushFileBuffers
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetModuleHandleA
LoadLibraryA
FormatMessageA
DebugBreak
GetFileSizeEx
FindNextFileW
FindClose
GetFileInformationByHandle
SetFilePointerEx
GetStartupInfoW
GetProcessAffinityMask
SetProcessAffinityMask
RtlPcToFileHeader
RtlUnwindEx
LoadLibraryW
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
HeapReAlloc
HeapFree
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapSize
GetFullPathNameW
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
PeekNamedPipe
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
GetTickCount
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
user32
GetMessageA
TranslateMessage
ShowWindow
GetSystemMetrics
DispatchMessageA
MapVirtualKeyW
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 218KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ