Behavioral task
behavioral1
Sample
WNetWatcher.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
WNetWatcher.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10v2004-20231222-en
General
-
Target
WNetWatcher.exe
-
Size
418KB
-
MD5
90c52d534a5232d1b7bb7204c2ea3e60
-
SHA1
7a5b655e6c801706850eafa7a7609af737f6b292
-
SHA256
5673be224ff53e4b8768c08c699ce8b004a8f2972efc704713e5b93c2b44e687
-
SHA512
fdb15cd21405b420f140b7f77a0ba3bf8a66a549d5a1908654bda82beb161d6a2f8a43cae3b2bdcb118abcece045d15cfe48324e5bb7314fe2534fb4614cb118
-
SSDEEP
12288:littkxDezF3gIcOlHd3Ti+VkTDdR0TMUnV/+:lihcm9Ti+kfUV/+
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule static1/unpack001/out.upx Nirsoft -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource WNetWatcher.exe unpack001/out.upx
Files
-
WNetWatcher.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 784KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 402KB - Virtual size: 404KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ