�@|�X4��o��Rp�)�� �C�����4n��<Y������/�M���3�{����d����aS<IUK�9A[���*��џ���Qz��į ��m.������6�r�#�{Oaù ��ɫ��X7���ECb�8v�A�[zjA��r;�Y���3�2�b6��4EL�2�3v��Ihz�/[H`Я�1$�Z�$�@�l�,Fl�%�߰YыJ�S��b%Ѓ��Z�0��kT�tr�yҜ-+�5���:�������줼���՝��吝������ʜ1������OUC���x.�'0�ʶ诲��v8;��Բ�R�uκ������^O}��6Q�B�[����8�A�[ߐ����V�Z <�?lA�r����=��<�qG�F`�bp|)5����[�ڛ��aM]Z�����Gh��>��?<�ԕsh]� (�U+��Ӷu ���|E)�G���ur��ćm���.e���7�2}Va���G�����4�T��/��Ǿ]�Ԟ�uc��]����"��"��E���RL�9�ƠN����L)� H�1�?a�k��<X�i�}o{X���ĿШ��aC��Yw��!2�R��k.�?����#����������T�Lm��� N� +��0�;���yn�u���q�s8�k�oIzK����Ωoi}�wΫ�S��ߛ �M����<Xm�ni۫&�$%\p?@�#[ɤ��Wp�1���<� ��8j㳁��v��m�$�"�,ڷZ�Puy&���*� ��� Ṵ̀k��fl&��Z ���ʋ5��mu�JEY�����E��]Iiz]z�Q��.œҮϐ��^�I$��o1y��W�����i�d�y����dȣu�<C�x��� �:S*�h�ͨ*� aA=�{�<���u�8YcyX�dpk���'��]�`ª3�?�sG�y�5�*K<�2~�7e/��R��6\��-nTЈW�d>i-�1�u8b��V��2�(������5r/�TG��/�u�N\#�w����H�?�ȉ��p��8��3ا!_��.� }h��̰�N��*{���[����X]���� �YPZ(����6�3O���՛P�!�6ƫ9�� �P������b%�oI�BB<�p-�.�Y͟�c�K{�wh��a���d|�P�)k�V5j��n� ���$W� �(ZvV��#�у�i�����6+xzk��P���d���iM��j�� �sV]=��}���~G��]c��`$��D�r�w�<���� �;VI#3P`K~��ʓ�(��+r�����v$8=U�Xڒ���͒<}S���A�F����b���4;�^�︖彭�_�����nӇ�Wag$��+~�`0 6��-z)2}1�u��r�-s���n�#3�Kocfjm]z2.}�ğ�a@;����>ͽ�PTx� ���6��s]�.w��S�:�»�+tm${(ZZ�*C N_���7^��(a�y �C���c�tfߌ[_�*W�Mp��"�}��v�� ʯ+"�]�Pxe��M>=�Nt��w���]���"ݾ9p۲�꤃��<�/�����<�ڜ�6>��J��K�df�(ٶ�dBd�¿�^*�h���d�JCz����-���������bz����4Y6���۟�0���ǪLr��ˎ���w`���:��(M3�a{�wƶ��Ͻup� r���9��e��QB��7�6���I:RE�v����˅�zwl��9�8s��m��CVH���"���߶b���g�BԼ�O���T��l" X�I�� ����/�Y��"5ꆬ#m�ٰ�z�Ҟ��ly��:h0�zY����u�e`�/�e���E[��2����R���v'�B���=D�/Yݗ]��G���3��B���4ǯ�\�+ �h�4ۤ��s⣠�i�&���e[�|U���I��cu������!;s�ýט�* ����j�-�����zK��'t�OL�35�5�AO,#4��Щ?v�Q���M ���xyb�?�I��n��V��lP C��)cu��!�����&Эޔ���[);��i�� I��lg�EK/��q�tg����Z3p�}����:���|ӳkb�jC�nq�i~#��K>i�dL�rб*�����A�e�2���͑6��f�=�2n#N5Fz��6�GT���^;��:����B�yM̖��+���� 熷�Gq�k���:.vF<CcS�X�,Ά��'0F'+'k�3�>+M�$��b�c��{�ݽ���㌏���]��W st�U!��Y�"��n������ ��?�48:�P��cmaH�w��ң����0�� ��/ ��cS��2��K~ByϮӲ8Q��<���'˗� �ط�T�f ��Q}si��[N%�.��k��G�`�BC �1m�Dq�s�Y 8JD��*�3;E27���8�4��rr���r�{��;ߐ�'��c�S� ?�7�㬡>�}�����^���)���o ÞM�ck���5��:}�e�$@�Dk��S��\.�N|*5��W0(�ŕڙh��V�E��j�$��Ʃ4G�QJ�m��4����r�hk$�O��F���$��!6�-֖���b���K���w'Okg���v/g�i]�h˄C^ ���<�RE�}���:�b�ؗ��9���!���~$�_��Ǩ�1yĝ����<e����M�����r�im�F�Y]6�W���K�E�f&��)�4(;���F�EKzy0��bQIv��Y��\V*�I���Ɂ���Tc�x�P��ϒ-K��(��/R�����#�.������f�&�������oY?ˉӘ�r��_V\�>���`s�������~���(.���2A�t�B�����-��Xs+�b���F�u�L�|�3�=�*H�VU����Y�v�����(����"�=U[Nj�p:����G��bkY*��Iٍ��8���_�`�}}��f�TYT9y�i����f�:qy�>�O�Ɵ�=��z,�l�m��%���r���~ ��P�z;G��6 �,E���L��
Static task
static1
Behavioral task
behavioral1
Sample
StandKnife.exe
Resource
win10v2004-20231020-en
General
-
Target
StandKnife.exe
-
Size
6.0MB
-
MD5
e86a4f3ba1b41fe8ec077e78262bf2ad
-
SHA1
c0126792f72add8fa4dd497461d13175084e4892
-
SHA256
9f9c9a6a4111a9fcbb37dedd67993dd7609e95a755293c508349a61bd17fbff1
-
SHA512
d8bab749eb4499c849d56a831a2e54b058ab4195fca30d1c54209ab4257c3e4ad4f4bfb20127b554797f11bef37b25c66ebc93462b9c9c9b02327cf9181789cd
-
SSDEEP
98304:emJl1lzCj6aXGGXfPrHO4dRYRaEgpxPUUT04B0sWZ6b7H4Nk1X93tFSimr5LU:emBqXGQ3ruaxVpgxhkINQ93tFa9LU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource StandKnife.exe
Files
-
StandKnife.exe.exe windows:6 windows x64 arch:x64
2ca19a6549ebad8a7ddaf859b45c837a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
CharUpperBuffW
advapi32
AllocateAndInitializeSid
shell32
ShellExecuteA
libcrypto-3-x64
ASN1_STRING_get0_data
libssl-3-x64
SSL_CTX_new
msvcp140
??0_Locinfo@std@@QEAA@PEBD@Z
ws2_32
getnameinfo
crypt32
CertEnumCertificatesInStore
iphlpapi
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-math-l1-1-0
ceilf
Exports
Exports
Sections
//////// Size: - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
//////// Size: - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
//////// Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
//////// Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
//////// Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
//////// Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
//////// Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
//////// Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ