Static task
static1
Behavioral task
behavioral1
Sample
InstallSrv.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
InstallSrv.exe
Resource
win10v2004-20231222-en
General
-
Target
InstallSrv.exe
-
Size
650KB
-
MD5
8bbf3ecf48c79c584390f6a83a0b828d
-
SHA1
30a018a46b9c610435de05ce8d93aa1ec0252d61
-
SHA256
b183a395846a2a30c8bf78b4e9dd69643c22d019e8389885412dc59ece904ec8
-
SHA512
84d6cbea31a14fc0cf9d38476bb5705aa8269c3b0f221544eeb62c5118feb2208d63359f04067154553bd63e77a4b7f62ecaf6d2b3c2e5e5f32ae692958d22d4
-
SSDEEP
6144:STnWh4NGZiq4T8DEd+8PHuGwM1lfyR81PL+3uK9XGjR8SbE0:S7W7oq41d+8PHpnzK3uJjiC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource InstallSrv.exe
Files
-
InstallSrv.exe.exe windows:6 windows x64 arch:x64
2899dd806f8d0b66d784dab1f305a913
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
CreatePipe
Sleep
ExitProcess
OpenThread
SuspendThread
ResumeThread
CreateProcessW
GetThreadContext
SetThreadContext
OpenProcess
VirtualAlloc
VirtualFree
VirtualAllocEx
WriteProcessMemory
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
WinExec
lstrlenA
VerifyVersionInfoW
CloseHandle
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Thread32First
Thread32Next
CreateThread
WriteConsoleW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetFileSizeEx
SetConsoleCtrlHandler
GetProcessHeap
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
OutputDebugStringW
WriteFile
DeleteFileA
CreateFileW
CreateFileA
MultiByteToWideChar
VerSetConditionMask
IsValidLocale
GetLocaleInfoW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
RtlUnwind
FindNextFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
GetCurrentThread
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
user32
CloseWindow
CreateWindowExW
LoadStringW
GetMessageW
TranslateMessage
PostQuitMessage
ShowWindow
DefWindowProcW
RegisterClassExW
LoadCursorW
LoadAcceleratorsW
LoadIconW
TranslateAcceleratorW
FindWindowW
UpdateWindow
DispatchMessageW
advapi32
RegQueryValueExA
RegOpenKeyExW
RegCreateKeyExA
RegCloseKey
GetUserNameA
RegSetValueExA
shell32
ord680
SHGetSpecialFolderPathA
SHGetFolderPathA
ole32
CoInitialize
CoCreateInstance
CoUninitialize
ws2_32
connect
htons
inet_addr
recv
send
socket
WSAStartup
Sections
.text Size: 464KB - Virtual size: 464KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 133KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 373B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
memcpy_ Size: 1024B - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 1024B - Virtual size: 863B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ