Static task
static1
Behavioral task
behavioral1
Sample
21984ee2647e007ea8df951f2a86ddb1be0344616bcc691390b32a059f4f0b79.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
21984ee2647e007ea8df951f2a86ddb1be0344616bcc691390b32a059f4f0b79.exe
Resource
win10v2004-20231127-en
General
-
Target
21984ee2647e007ea8df951f2a86ddb1be0344616bcc691390b32a059f4f0b79
-
Size
666KB
-
MD5
be820f48d7cc7875fe56a00e2d1625d2
-
SHA1
813618073f671704e10e4fe1397cfe7522f4270a
-
SHA256
21984ee2647e007ea8df951f2a86ddb1be0344616bcc691390b32a059f4f0b79
-
SHA512
51c442fc68c54eb4c80b7ffe17e5618e0c5de9ad4245817535cbaea2bc8ae3bdeebb1bccc70f2e4b1af4cdf4f37dba34e69d4f756917eb2b7d774cbfa76bb8b4
-
SSDEEP
12288:wNMq9C83GKyTZvC8zwyzIhSMXlAfXLvB:G9p3KTZvDzwyzIhSMXl6XbB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21984ee2647e007ea8df951f2a86ddb1be0344616bcc691390b32a059f4f0b79
Files
-
21984ee2647e007ea8df951f2a86ddb1be0344616bcc691390b32a059f4f0b79.exe windows:6 windows x64 arch:x64
c1fb588822892e6da17a8a01f537a3ff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wtsapi32
WTSEnumerateProcessesW
WTSQueryUserToken
WTSFreeMemory
userenv
GetAppContainerFolderPath
CreateAppContainerProfile
DestroyEnvironmentBlock
DeleteAppContainerProfile
CreateEnvironmentBlock
kernel32
GetProcessHeap
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetModuleHandleW
HeapFree
SetLastError
SleepEx
GetTickCount64
GetStringTypeW
HeapAlloc
LocalFree
CreateProcessW
GetCurrentProcess
SetConsoleCtrlHandler
OpenProcess
GetProcessId
GetExitCodeProcess
GetCurrentProcessId
WaitForSingleObject
GetLastError
CloseHandle
GetFileAttributesW
GetCurrentDirectoryW
IsValidCodePage
GetACP
GetOEMCP
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleOutputCP
HeapSize
HeapReAlloc
GetProcAddress
GetFileType
ReadConsoleW
LCMapStringW
GetEnvironmentVariableW
GetFullPathNameW
CreateFileW
GetFinalPathNameByHandleW
DeviceIoControl
GetModuleFileNameW
DeleteFileW
ReadFile
WriteFile
MoveFileExW
GetFileInformationByHandleEx
SetFilePointerEx
ExpandEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FormatMessageW
MultiByteToWideChar
GetStdHandle
RtlUnwind
GetConsoleMode
SetConsoleMode
WriteConsoleW
FormatMessageA
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetStdHandle
GetCPInfo
GetCommandLineA
GetCommandLineW
CompareStringW
advapi32
StartServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
LookupPrivilegeValueW
GetTokenInformation
AdjustTokenPrivileges
SetThreadToken
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
ConvertSidToStringSidW
IsWellKnownSid
CreateWellKnownSid
CopySid
ConvertStringSidToSidW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
OpenProcessToken
CreateProcessAsUserW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
shell32
ShellExecuteExW
ole32
CoInitialize
CoTaskMemFree
CoUninitialize
Sections
.text Size: 335KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 247KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ