AsComDtSvc.rar
- SHA256 28dc274e4f75b88e22a58a0672e4abaf15f9660f939dbd49a8db443a7e8891a6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ATKEX.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
ATKEX.dll
Resource
win10-20240214-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
ATKEX.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
ATKEX.dll
Resource
win11-20240214-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
TraceIndexer.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
TraceIndexer.exe
Resource
win10-20240214-en
windows10-1703-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
TraceIndexer.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target AsComDtSvc.rar
- Size 42.2MB
- Sample240218-tm77mace34
- SHA256 28dc274e4f75b88e22a58a0672e4abaf15f9660f939dbd49a8db443a7e8891a6
- MD5 27c54ebca327e21912d2c8ddf2d4c932
- SHA1 e8b2fefce84d8915d1df27d211f0906b2a2551aa
- SHA512 4f39ffc94c5f1a896717f569ad7e2382decdd11d75f8fc114df905e38bc91f9eb4aaecfe977006c0118fc1f25ede55fcaaac33e8bb01b31d595cdc15788bb376
- SSDEEP 786432:Pfea9IU6TwogytbsVcfGf6VHvz/fv0vL0PUBRpydEwUBZYQkXiDys7rE:PfeaqU6EvknPW9Nubs7g
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ATKEX.dll
File Explorer
-
AsComDtSvc.rar.rar 42.2MB
-
ATKEX.dat132KB
-
ATKEX.dll.dll 53KB
-
NvSmart.hlp92KB
-
NvSmart.x64404.4MB
-
TraceIndexer.exe.exe 457KB
-
kdump64.hlp229KB
-
wps.hlp19KB
ATKEX.dat
- SHA256 31a63f7813c3436fec5c5493e30356da12ea4729fb1757bff877fc1a63825361
- MD5 e83af8dd173892918a785d27e1aef2a5
- SHA1 d0ce65a13d43205b7a9c253b010fb2cea977a4b3
- SHA512 884cb0ddf17ce35e6f191ddd97905781da67b8c8b4d27a87f872564e7d419df8966eadf93df5928fdc87e09aaf1eea187b621858c5bd2f6d41fb99872762acd5
- SSDEEP 3072:vlMNNU8boJ0HXfmbfaICzG/DR6TBzUIqjRMumZlabj5yGB:vqyJ0HXObf+zG/DIT6J/qAbj57
- MD5 SHA1 SHA512 SSDEEP
ATKEX.dll
- IMPHASH de07b3e108b97d977b4e7a0cd1d16f12
- SHA256 9b0f2a4833461caabd4d44c53c31b719c80b7f44a92cff5c0fb01d83f7fa43cb
- MD5 ed5b3b3a04e3ccc8ddc41e0691c6af38
- SHA1 7ab5dc0750fa4d5953bf45b9de4b5261458b69fa
- SHA512 ae89fa6db3ba270e0ba1cae0d0457441500dfc78a50a40b7d3a2e3fae99529690e3aaa05c8821115a0a4e41197a4a650a2a8b25f92fbcb50eed7a639119cd8ad
- SSDEEP 768:G8HLbpnzrRiu5m+e8a0LrvGhvkkQCHyunDEDhcvS2nzmcSSSSw:G8rbpnzrdm+eiLjKvkKS4rJzTSSSSw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
11366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Fast需求\无毛果\v1.2\Controller_20201205\Shellcode-Enc\dllmain\Release\ATKEX.pdb
kernel32
CloseHandle
CreateFileW
GetFileSize
ReadFile
VirtualAlloc
VirtualFree
WriteFile
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
CreateThread
GetModuleFileNameW
lstrcpyW
VirtualProtect
DisableThreadLibraryCalls
GetModuleHandleA
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
go
go1
go2
go3
go4
Name
.text
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=70, id=170, productName=VS2010 build 30319, version=30319,
count=30, id=171, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=3, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
NvSmart.hlp
- SHA256 d705e51dad818145e1cd6f32ed88f2de8a4eb35f889842527b1f568e20f89238
- MD5 9133ba0752630e550c1119cfd7f5c547
- SHA1 01831a78ee917157f867f17ebaf6cfe1d300c76e
- SHA512 dd25ce548910866c6002e7a648e3e93ba4aaee6fdebbe56a474e6eadcc2c16acba3f336177212dadf7b75cd255a7b17b1a493c86f10d0066ed7bf3628d23ec32
- SSDEEP 1536:UHhi+8wcMqVMmLjEJ7P7R7L7Q67d7r7U7r7s7t7M7G7x7z7L7w797Q787Q7L777k:kmLjXm7x9mDmamQv
- MD5 SHA1 SHA512 SSDEEP
NvSmart.x64
- SHA256 d1dade064aec9b64eab9ff0bb4cd229919d8208a9eea74ae2c4f635412f81982
- MD5 cbb2cdf5f3b3286a4fbd8151720e97a6
- SHA1 d0ea94723fb776a1d53cffdd3d6068d398404f2d
- SHA512 902991f87ef55d5da8e920d663f9e36c95304d558823ee8dd9bc261ab4c5ac88ac48129e3d830eac000c5a81d18b3285b2f5610ac22533fd1de836480eb6ea32
- SSDEEP 49152:sSeqezWskYWskDWskAP1HFP1Hzit3/Y0s6tT3qXnueGijpXbsVwOUhcTbjFzWWTs:l
- MD5 SHA1 SHA512 SSDEEP
TraceIndexer.exe
- IMPHASH 73066627ef3b9a142d19d961d629ea1d
- SHA256 c81b31f8986cc40ff2d31c3bafd7abdf275826ccb5859eba8d927144e38bc7f3
- MD5 07321f91bad9653b4fa737e5c993de90
- SHA1 9b0e7f445739825816e970205fe92adf7d3e1fc8
- SHA512 c065581716ac8158f657c231a48a8eff2eb215a008ca1d76215a17313b99888d9d14ccb73782d810cedaf5e8acc671deca28a9e2875a5668a03ece0e2cd8f5b6
- SSDEEP 12288:RDodb27n+xNHL9mk39q8AwbtTtR9zi1mxrQYAA0jkYu6h82hE2ha:2d27nQNHL9mk39q8AwJRxrJEjk/MBhnU
- MD5 SHA1 SHA512 SSDEEP
Digest
33:38:33:1f:6c:49:b5:b3:fc:b5:be:70:04:5f:93:c5:1d:68:de:df:ef:11:7a:d5:70:f8:ab:fe:51:7e:27:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
May 16, 2022
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0b:be:02:c8:83:8f:bf:02:ab:56:ed:ab:b1:e3:4c:19
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2021 - Oct 22, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Minor OS version
0
Major OS version
6
Entry point
167097
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Jenkins\workspace\atkexComSvc\Release\atkexComSvc.pdb
atkex
ord3
ord2
winmm
timeGetTime
kernel32
WriteFile
CloseHandle
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionEx
SetEvent
WaitForSingleObject
GetModuleHandleW
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
DeleteFileA
SetFileAttributesA
ReleaseMutex
CreateMutexW
CreateEventW
OpenEventW
LoadLibraryA
SetDllDirectoryW
GetCommandLineW
DeleteFileW
CreateThread
GetCurrentThreadId
lstrcpyW
GetCurrentProcess
GetCurrentThread
GetSystemInfo
GetNativeSystemInfo
SetThreadAffinityMask
SetThreadPriority
SuspendThread
ResumeThread
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateFileW
CreateFileA
WritePrivateProfileStringW
WritePrivateProfileStringA
GetPrivateProfileStringW
GetPrivateProfileStringA
GetPrivateProfileIntW
GetModuleFileNameA
GetModuleHandleA
OutputDebugStringW
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameW
FreeLibrary
GetTickCount
LoadLibraryW
GetProcAddress
Sleep
GetCommandLineA
GetCPInfo
FlushFileBuffers
WriteConsoleW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
HeapReAlloc
HeapSize
GetFileType
HeapAlloc
HeapFree
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
SetLastError
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
user32
wsprintfW
MessageBoxA
CharNextW
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharUpperW
MessageBoxW
advapi32
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegDeleteValueW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
ole32
CoRevokeClassObject
CoInitializeSecurity
CoReleaseServerProcess
CoAddRefServerProcess
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoResumeClassObjects
StringFromGUID2
CoRegisterClassObject
oleaut32
SysAllocString
SysFreeString
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantCopy
VariantClear
VariantInit
SysStringLen
SafeArrayAccessData
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
SafeArrayUnaccessData
shlwapi
PathFileExistsW
Name
.text
Size
253KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=26213,
count=146, id=261, version=26213,
count=18, id=260, version=26706,
count=22, id=259, version=26706,
count=53, id=261, version=26706,
count=22, id=260, version=26213,
count=16, id=257, version=26213,
count=3, id=257, version=27048,
count=219, id=1, productName=Unmarked objects,
count=3, id=260, version=27048,
count=31, id=261, version=27048,
count=1, id=255, version=27048,
count=1, id=151,
count=1, id=258, version=27048,
kdump64.hlp
- SHA256 611b5dee3e1274affd8364cb5697797df04b133d3bc1ab2a388a057b8de2e8c6
- MD5 6c39514f76bba0c65a10648ad1c227b0
- SHA1 647587497ae9162e3a537a8d9a1a34bf2f9c6893
- SHA512 5601caae64bae939685ee9b644aebd0db04cbc7d22be8063d7f2886a07dd967727ba3493585a1811fa8771ccab94180fa3de674bb729086d933b5887038b4d8c
- SSDEEP 6144:lZjDIz1rirklkee92t26uE9VHfkHl/qv0DVHfkHl/qv0XVB9g7f:Ak
- MD5 SHA1 SHA512 SSDEEP
wps.hlp
- SHA256 9bee1427ee9289d24061622fcfc5f070d8597145c5d55fa9228b2aa86b5b5d7e
- MD5 b60c613c9051811b9ae7fb6838d9b42e
- SHA1 32c7f29aac46121105010ab5a108525cb3d3c903
- SHA512 62159a5645005ec672cac2d6f6a02c363ed1f904e6bb44cd053e894e04febec98377a2b3e7000df7e8886549ae6bfef22e664ed29603a28448d9db781de2bf90
- SSDEEP 384:B9ElVHwH23ePnfCO9T2bcUru/Oxd3zd3Wd3id3fd0g8gig/mD:BB2rT3p3E3Q310g8gig/mD
- MD5 SHA1 SHA512 SSDEEP