Static task
static1
Behavioral task
behavioral1
Sample
2024-01-21_b1514418a3e8404365f9cad2fde402e1_lorenz.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-21_b1514418a3e8404365f9cad2fde402e1_lorenz.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-21_b1514418a3e8404365f9cad2fde402e1_lorenz
-
Size
1.7MB
-
MD5
b1514418a3e8404365f9cad2fde402e1
-
SHA1
c4d5a50d8994c1ccd057c9b55cb636544d1c565a
-
SHA256
fe20f3de83a7597a5f7e314f0a3c6940b77441f48b061910e5a38c3d463f5bfd
-
SHA512
26a53f7ff4c0e4e72f3d3e88942b2437acaa5f13dd8e0f67334fe383d211631655229566c085c4f6acf0fc38cc7328eb0a39898679f778c39a967b0fcfe05a3c
-
SSDEEP
24576:IfwrGID2rJO7LYlRrZtZAGtJF4Aq9UjfBBcPF58xo:YwrRElhZL5DbBB4f8xo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-21_b1514418a3e8404365f9cad2fde402e1_lorenz
Files
-
2024-01-21_b1514418a3e8404365f9cad2fde402e1_lorenz.exe windows:5 windows x86 arch:x86
bbd010668e3412e62a07e288c355502c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceA
lstrlenA
FindClose
CreateMutexA
GetVolumeInformationA
GetModuleHandleA
HeapSize
GetVersion
MultiByteToWideChar
Sleep
GetTempPathA
CopyFileA
GetLastError
OpenMutexA
GetFileAttributesA
CreateFileA
LoadLibraryA
LockResource
DeleteFileA
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
SetFileAttributesA
GetLogicalDriveStringsA
DecodePointer
HeapDestroy
GetProcAddress
GetFileSize
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
UpdateResourceA
CreateProcessA
CreateDirectoryA
EndUpdateResourceA
GetComputerNameA
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
GetVersionExA
DeleteFileW
LeaveCriticalSection
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
FindNextFileA
GetDriveTypeA
TerminateProcess
InterlockedDecrement
WriteFile
EnterCriticalSection
SetLastError
HeapFree
FindFirstFileA
BeginUpdateResourceA
VirtualFree
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
FindFirstFileExA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
GetCurrentDirectoryW
MoveFileExW
HeapQueryInformation
SetEnvironmentVariableA
GetConsoleCP
SizeofResource
GetModuleFileNameA
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadConsoleW
GetConsoleMode
GetACP
GetSystemInfo
ReadFile
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
TryEnterCriticalSection
DuplicateHandle
GetCurrentThread
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
GetModuleFileNameW
RtlUnwind
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
WriteConsoleW
GetCommandLineA
GetCommandLineW
user32
GetDC
GetDesktopWindow
wsprintfA
ReleaseDC
GetSystemMetrics
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
GetObjectA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SystemFunction036
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ole32
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoInitialize
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
shlwapi
PathFindExtensionA
PathFindExtensionW
gdiplus
GdiplusStartup
GdipCloneImage
GdiplusShutdown
GdipGetImageEncoders
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
wininet
InternetConnectA
InternetCloseHandle
HttpSendRequestA
InternetReadFile
HttpOpenRequestA
InternetCheckConnectionA
InternetOpenA
urlmon
URLDownloadToFileA
ObtainUserAgentString
iphlpapi
GetAdaptersInfo
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 261KB - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ