Behavioral task
behavioral1
Sample
d85206f6cc044ab26bb12ddef34d6fd0dcc6b590228f411a2b1521809a8be547.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d85206f6cc044ab26bb12ddef34d6fd0dcc6b590228f411a2b1521809a8be547.exe
Resource
win10v2004-20231215-en
General
-
Target
d85206f6cc044ab26bb12ddef34d6fd0dcc6b590228f411a2b1521809a8be547
-
Size
1.8MB
-
MD5
fef3c126b3ed260483b1f74a46072693
-
SHA1
a2b0de5eb4a3c0ff98118054d68a73ae724d485e
-
SHA256
d85206f6cc044ab26bb12ddef34d6fd0dcc6b590228f411a2b1521809a8be547
-
SHA512
fd6566dcff335d4182a9852313c9722cbb50178f962a46acb49a653aee6d34f6e992118d50e72b3cd3c11fad32225cc00b371a989f78285a9aa50caa6d5600c6
-
SSDEEP
49152:Q0U4B9VajTYz1wav7Pogv9YFKxuKXT5Xo1Z1R:lzKEZveKxBD5Yb1R
Malware Config
Signatures
-
R77 family
-
r77 rootkit payload 1 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule sample r77_payload -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d85206f6cc044ab26bb12ddef34d6fd0dcc6b590228f411a2b1521809a8be547
Files
-
d85206f6cc044ab26bb12ddef34d6fd0dcc6b590228f411a2b1521809a8be547.exe windows:6 windows x64 arch:x64
f66e2554369a55c42f71dba074224510
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcessId
LoadLibraryW
GetProcAddress
WaitNamedPipeW
GetLastError
CreateFileW
ReadFile
WriteFile
GetModuleHandleA
LoadLibraryA
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
LockResource
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
HeapAlloc
Sleep
HeapReAlloc
HeapSize
GetProcessHeap
GetTempPathW
GetFileAttributesW
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
IsWow64Process
GetTickCount64
SetLastError
ResumeThread
WaitForSingleObject
LocalFree
CreateDirectoryW
WriteConsoleW
SetStdHandle
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
HeapFree
CloseHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileW
FindFirstFileExW
FindClose
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
GetExitCodeThread
GetStringTypeW
EncodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
ExitThread
GetStdHandle
GetFileType
user32
MessageBoxW
MessageBoxA
advapi32
SetEntriesInAclW
ConvertStringSidToSidW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
shell32
SHGetFolderPathW
ole32
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
SysAllocString
mscoree
CorBindToRuntime
CLRCreateInstance
wininet
InternetOpenUrlA
InternetReadFile
InternetOpenA
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
winmm
PlaySoundW
Sections
.text Size: 727KB - Virtual size: 726KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 282KB - Virtual size: 282KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 822KB - Virtual size: 821KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ