Behavioral task
behavioral1
Sample
073981492bea30da3f6af8ffebba5aa066a09e159eba1f932df1f1b1b6d083c6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
073981492bea30da3f6af8ffebba5aa066a09e159eba1f932df1f1b1b6d083c6.exe
Resource
win10v2004-20231215-en
Errors
General
-
Target
073981492bea30da3f6af8ffebba5aa066a09e159eba1f932df1f1b1b6d083c6
-
Size
971KB
-
MD5
1c4d1e992e1328d90b494c97c847e436
-
SHA1
808c43cf56b457d488d47a51652b55cbba236dbb
-
SHA256
073981492bea30da3f6af8ffebba5aa066a09e159eba1f932df1f1b1b6d083c6
-
SHA512
ff395c649e121df18f02049504e40f6446bf3a534483004952b874c85f256c8b7159f0182bc5a4a829b23d5b437f6adcdf3c6ef35c6e0f82e34dd13b889bec69
-
SSDEEP
24576:UFCeR/s0PWjESh0K/4UGz72So29Ps9cbGG/:deR5PcN/45z7p9PgYGG/
Malware Config
Signatures
-
Legion downloader 1 IoCs
Detected Legion downloader HTTP request code and PowerShell execution.
resource yara_rule sample legion_downloader -
Legion family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 073981492bea30da3f6af8ffebba5aa066a09e159eba1f932df1f1b1b6d083c6
Files
-
073981492bea30da3f6af8ffebba5aa066a09e159eba1f932df1f1b1b6d083c6.exe windows:6 windows x86 arch:x86
5b379723b248cee3f83d019a55c73410
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
CreateToolhelp32Snapshot
Sleep
Process32Next
CloseHandle
ExitProcess
GetProcessHeap
lstrcmpiA
CreateProcessA
GetCurrentDirectoryA
LoadLibraryA
GetProcAddress
CreateFileW
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
VirtualProtect
Process32First
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapFree
HeapAlloc
GetFileType
LCMapStringW
WriteConsoleW
user32
LoadIconA
EndPaint
UpdateWindow
PostQuitMessage
BeginPaint
LoadCursorA
DestroyWindow
CreateWindowExW
EndDialog
DialogBoxParamA
RegisterClassExW
LoadStringW
ShowWindow
GetKeyboardLayout
DefWindowProcA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
ShellExecuteA
shlwapi
StrStrIA
wininet
InternetOpenW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetReadFile
HttpOpenRequestW
Sections
.text Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ