Static task
static1
Behavioral task
behavioral1
Sample
bws-lstcs.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bws-lstcs.exe
Resource
win10v2004-20231215-en
General
-
Target
0e3d7821060a91827780f884ed96433a
-
Size
60KB
-
MD5
0e3d7821060a91827780f884ed96433a
-
SHA1
bc291c4c890a369f8dd7ffdb6a965a443a9c563d
-
SHA256
8dba2b512416bbba637221e18fbd71a2d8d8561f3fddb64fba8b375fde440678
-
SHA512
92a4a6fb5aaa4fe19088e1418f38ce4df5ff3e9a9e26b26ca70e4b3d48f76cce457a16f6464fccb9d5771316caf7da25ae01165142993a29b0e6cb4597e43fb7
-
SSDEEP
1536:26LHD8P+SoPnj9i4lsSzdz0BbpxMEzetWNrTIUUPPL:26H8GSoPnQ/SRwBbbetWNrm3L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bws-lstcs.exe
Files
-
0e3d7821060a91827780f884ed96433a.zip
-
BReWErS.nfo
-
bws-lstcs.exe.exe windows:4 windows x86 arch:x86
c4e415dc20169c8bc984bc9acaf759d7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
ExitProcess
GetWindowsDirectoryA
lstrcatA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
FindResourceA
LoadResource
LockResource
SizeofResource
CreateFileA
WriteFile
CloseHandle
OpenProcess
VirtualAllocEx
WriteProcessMemory
LoadLibraryA
GetProcAddress
CreateRemoteThread
user32
DialogBoxParamA
SetTimer
LoadBitmapA
SendDlgItemMessageA
EndDialog
FindWindowA
GetWindowThreadProcessId
GetDlgItem
SendMessageA
RegisterHotKey
ReleaseCapture
gdi32
CreateFontA
SetBkMode
SetTextColor
SetBkColor
CreateSolidBrush
GetStockObject
Sections
code Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 364KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
gameguru.nfo