Static task
static1
Behavioral task
behavioral1
Sample
lariauts.exe
Resource
win7-20231129-en
General
-
Target
lariauts.exe
-
Size
327KB
-
MD5
c64ff4d0ede44e5a69526144934810ac
-
SHA1
78f8e16f7b2d2cdc8b9294db60a1bc547f6907ce
-
SHA256
9f9fd9335efc46f3a6c248a18f3bfcb5122b413b24d8baaace064c96845a935d
-
SHA512
1c8636d4cd4b047cdbb58eaf0dd5b6d1fa1dd83368dc7114f3159d61785ae5eba32488f775e3f7c001b6d9623ede3ff8471743626e8a3f92e5953b33cb5ee0f7
-
SSDEEP
6144:2HHVLoziLeCO2zZ+YrNOlItJogIB5RN6gpj5BS/JvpX3:ukziLeT8Ziety5/N6gpj5BmJvZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource lariauts.exe
Files
-
lariauts.exe.exe windows:5 windows x86 arch:x86
99190d8cd877eac8f1ec8c4c753e3a41
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetComputerNameW
BackupSeek
GetModuleHandleW
GetProcessHeap
GetConsoleAliasesLengthA
GetWindowsDirectoryA
GetVolumePathNameW
GlobalFindAtomA
LoadLibraryW
GetConsoleMode
GetSystemWindowsDirectoryA
WriteConsoleW
CreateFileW
InterlockedExchange
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
SetComputerNameA
OpenMutexA
InterlockedIncrement
DnsHostnameToComputerNameA
CreateHardLinkW
AddAtomW
RemoveDirectoryW
BeginUpdateResourceA
GetCommMask
OpenJobObjectW
FindFirstVolumeMountPointA
FindFirstChangeNotificationA
OpenFileMappingW
GetStringTypeW
VirtualProtect
_lopen
GetVersionExA
EnumResourceLanguagesW
SuspendThread
lstrcpyA
DebugActiveProcess
LoadResource
LocalAlloc
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStartupInfoW
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
HeapAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
LCMapStringA
WideCharToMultiByte
LCMapStringW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
user32
CharLowerBuffA
gdi32
GetDeviceGammaRamp
advapi32
BackupEventLogA
Sections
.text Size: 286KB - Virtual size: 286KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ