Static task
static1
Behavioral task
behavioral1
Sample
Client.exe
Resource
win10v2004-20231020-en
General
-
Target
Client.exe
-
Size
42KB
-
MD5
b67f08a942c0b50b771f6f93163f4caf
-
SHA1
89766a46b32532243426e10901df4493be703151
-
SHA256
9fee0413da354c16405b23f738e734e725b34fba81230174c1ec5d7841cec511
-
SHA512
5f93a2a394ca43af4a8d2b0e8f1832588212a64eb192d3747dc2102fea6ba98b769567a4e2bf40130e457218ca6a265aade09fdbc9ae65d5edba7c2d3e503538
-
SSDEEP
768:44OuWmGV7H9WYMCNpW7VMYGoXXInpUyUjd0jUPt9cZV3ShcYs6csl:IuWmchZxuDXInpUyU+YV923ShZs3s
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule sample disable_win_def -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client.exe
Files
-
Client.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ