Behavioral task
behavioral1
Sample
c1ed5523c6666e2032b1a6c41737c56cbbabf057971f0ad97ed07d1018c6824f.exe
Resource
win7-20231025-en
General
-
Target
c1ed5523c6666e2032b1a6c41737c56cbbabf057971f0ad97ed07d1018c6824f
-
Size
1.7MB
-
MD5
e5ff0ad05e640dad0fa880805ca7e1ba
-
SHA1
298103592c1387bb6c80a0eda2a52b9645e4b1b2
-
SHA256
c1ed5523c6666e2032b1a6c41737c56cbbabf057971f0ad97ed07d1018c6824f
-
SHA512
82f93eeff19766adc2a30f3a3136b0af48ba4a56d0f0c87039fe9ad2959c50a4b2329f6031bda50a315c31832e31418aaff98913e949c453f420639ff1739ccb
-
SSDEEP
49152:XPujn/TJQ1NLlSqrU5tUE1etEtLlWiTHfeiEA2RQ6zHvyRWMzTUuJ:XPcn/TJKSb5tN1etEtLlWiTHfeiEA2Rs
Malware Config
Signatures
Files
-
c1ed5523c6666e2032b1a6c41737c56cbbabf057971f0ad97ed07d1018c6824f.exe windows:6 windows x64
db469bb3aaf1156758357e3a6bb0f090
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAGetLastError
WSASetLastError
WSAStartup
select
WSARecvFrom
bind
WSAIoctl
closesocket
WSASend
shutdown
WSASocketW
socket
WSARecv
getsockopt
ioctlsocket
setsockopt
FreeAddrInfoW
GetAddrInfoW
htonl
htons
kernel32
SetStdHandle
ExitThread
GetCommandLineW
ExitProcess
GetModuleHandleExW
GetConsoleCP
GetDriveTypeW
GetCommandLineA
RaiseException
GetStdHandle
SetConsoleMode
GetConsoleMode
CreateMutexW
Sleep
GetLastError
CreateProcessW
MultiByteToWideChar
SetThreadAffinityMask
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
CloseHandle
FreeConsole
GetConsoleWindow
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
LocalFree
FlushInstructionCache
GetFileType
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
PostQueuedCompletionStatus
QueueUserWorkItem
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
EnterCriticalSection
GetModuleFileNameW
SetEnvironmentVariableW
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
FreeEnvironmentStringsW
FileTimeToSystemTime
QueryPerformanceFrequency
GetSystemInfo
GetCurrentDirectoryW
GetCurrentProcessId
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
CancelIo
SetHandleInformation
CreateEventA
CreateIoCompletionPort
SetFileCompletionNotificationModes
SetErrorMode
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
SleepConditionVariableCS
TryEnterCriticalSection
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
GetNativeSystemInfo
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
GetLongPathNameW
ReadDirectoryChangesW
ReadFile
SetNamedPipeHandleState
SetLastError
WriteFile
CreateNamedPipeW
RtlUnwind
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
FlushFileBuffers
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetModuleHandleA
LoadLibraryA
FormatMessageA
DebugBreak
GetFileSizeEx
FindNextFileW
FindClose
GetFileInformationByHandle
SetFilePointerEx
GetStartupInfoW
GetProcessAffinityMask
SetProcessAffinityMask
RtlPcToFileHeader
RtlUnwindEx
LoadLibraryW
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
HeapReAlloc
HeapFree
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapSize
GetFullPathNameW
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
PeekNamedPipe
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
GetTickCount
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
user32
GetMessageA
TranslateMessage
ShowWindow
GetSystemMetrics
DispatchMessageA
MapVirtualKeyW
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 218KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ