Main
Behavioral task
behavioral1
Sample
dca564f509a3aa5a7f748f67607c6854.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
dca564f509a3aa5a7f748f67607c6854.dll
Resource
win10v2004-20231215-en
General
-
Target
dca564f509a3aa5a7f748f67607c6854
-
Size
48KB
-
MD5
dca564f509a3aa5a7f748f67607c6854
-
SHA1
2392b9b77dc5716a3b5977b558b3edbbda99f715
-
SHA256
b8eb9d67513a1202a469b706ca34fcb509f17bbf51894e210fb5a073ba34c21c
-
SHA512
527ed0f875be78ee0cbd545d1e3c88a78a445a2bfe87bcc5026b4455256537c046505db8f9be4bb6b71b0b20069872d4b021ba01b9ba335064d02485bdf3a06a
-
SSDEEP
768:BR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMIEV:8aAoHoc2x7bZoYBAcQlwJdMo
Malware Config
Signatures
-
RunningRat payload 1 IoCs
resource yara_rule sample family_runningrat -
Runningrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dca564f509a3aa5a7f748f67607c6854
Files
-
dca564f509a3aa5a7f748f67607c6854.dll windows:4 windows x86 arch:x86
6a6702f5b47319e63a51e781cbc02006
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord5683
ord4129
ord825
ord800
ord823
ord537
msvcrt
_adjust_fdiv
malloc
_initterm
free
strstr
_except_handler3
__CxxFrameHandler
_access
srand
rand
_mkdir
kernel32
CloseHandle
CreateFileA
WriteFile
GetTickCount
GetLastError
GetFileAttributesA
lstrcpyA
DisableThreadLibraryCalls
ExpandEnvironmentStringsA
MoveFileExA
DeleteFileA
GetCommandLineA
LoadLibraryA
GetProcAddress
GetLocalTime
FreeLibrary
user32
wsprintfA
Exports
Exports
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 438B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ