Static task
static1
Behavioral task
behavioral1
Sample
roguepriv.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
roguepriv.exe
Resource
win10v2004-20231215-en
General
-
Target
roguepriv.exe
-
Size
996KB
-
MD5
f74bb67423c69cc100008d96ccbbb1d6
-
SHA1
917ecd4c352680affecee7567fe4925ff7487989
-
SHA256
b6700204ac1dfa23be199ba6f2cefbc303b4f42ab9e4f23dffc2d8d7a7668015
-
SHA512
b657614586ec34ca0a8722b450c3456c8785587e641eef49d7d6c514760287436afb33684e7198335c67786da3b193ff8261178cb05661ae52a6a95583d20ba5
-
SSDEEP
24576:iO7oomHKeU2DVT0GHmlwdEdOwUcmeniczA:i/omHKevNOzUcPni
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource roguepriv.exe
Files
-
roguepriv.exe.exe windows:6 windows x64 arch:x64
c2bacfb1ddb6f86b31e7ace3e735ffd1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9Ex
dwmapi
DwmExtendFrameIntoClientArea
kernel32
GetConsoleWindow
SetConsoleTitleA
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetEnvironmentVariableA
SetConsoleWindowInfo
WaitForSingleObjectEx
CreateFileW
DebugBreak
GetLastError
SetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
Process32First
GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetStdHandle
Beep
CloseHandle
Sleep
CreateThread
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
SetConsoleScreenBufferSize
LoadLibraryA
lstrcmpiA
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcess
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
QueryFullProcessImageNameW
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
GetSystemDirectoryA
FreeLibrary
VerifyVersionInfoA
MultiByteToWideChar
Process32Next
WideCharToMultiByte
GetTickCount
MoveFileExA
CreateToolhelp32Snapshot
GlobalUnlock
GlobalAlloc
user32
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
LoadCursorA
TranslateMessage
MessageBoxA
DispatchMessageA
PeekMessageA
DefWindowProcA
PostQuitMessage
RegisterClassA
UnregisterClassA
CreateWindowExA
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
MoveWindow
SetWindowPos
SetWindowDisplayAffinity
GetAsyncKeyState
mouse_event
GetSystemMetrics
UpdateWindow
GetForegroundWindow
GetWindowRect
GetWindowLongA
SetWindowLongA
GetWindowLongPtrA
SetWindowLongPtrA
FindWindowA
GetWindow
GetKeyState
ReleaseCapture
SetCapture
GetCapture
GetClientRect
GetActiveWindow
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
gdi32
GetStockObject
shell32
ShellExecuteA
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?setf@ios_base@std@@QEAAHHH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@D@std@@QEBA_NFD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord30
ord200
ord27
ord301
ord26
ord79
ord41
ord143
ord217
ord46
ord211
ord32
ord22
ord45
ord60
ord33
ord50
ord35
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFindCertificateInStore
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
ws2_32
ntohs
getsockopt
getsockname
getpeername
connect
WSAGetLastError
setsockopt
send
socket
WSASetLastError
WSAIoctl
recv
closesocket
htons
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
recvfrom
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
ntohl
gethostname
sendto
bind
rpcrt4
UuidCreate
RpcStringFreeA
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__current_exception
__current_exception_context
memcpy
__std_terminate
memmove
strstr
strrchr
__std_exception_copy
memset
strchr
__std_exception_destroy
memcmp
__C_specific_handler
_CxxThrowException
memchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
__sys_nerr
terminate
_cexit
_seh_filter_exe
_getpid
strerror
_set_app_type
_configure_narrow_argv
system
exit
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_crt_atexit
_c_exit
__p___argv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_errno
_resetstkoflw
_beginthreadex
api-ms-win-crt-heap-l1-1-0
realloc
calloc
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-string-l1-1-0
isprint
wcscpy
strncmp
strcmp
strncpy
tolower
strpbrk
strcspn
strspn
isupper
_strdup
isalnum
api-ms-win-crt-stdio-l1-1-0
fclose
_open
_close
_write
_read
fflush
__p__commode
_set_fmode
fread
fseek
ftell
_lseeki64
fwrite
__stdio_common_vfprintf
feof
fputs
fopen
fputc
_popen
_pclose
fgets
_wfopen
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vsscanf
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-math-l1-1-0
sqrtf
ceilf
floorf
atan2f
sinf
cosf
pow
powf
sqrt
asin
atan2
fabs
_dclass
tanf
__setusermatherr
fmodf
api-ms-win-crt-convert-l1-1-0
atof
strtoll
strtol
atoi
strtod
strtoul
strtoull
api-ms-win-crt-filesystem-l1-1-0
_stat64
_unlink
remove
_access
_fstat64
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
advapi32
ConvertSidToStringSidA
CryptEncrypt
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
OpenProcessToken
SetSecurityInfo
CopySid
Sections
.text Size: 716KB - Virtual size: 715KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 145KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 97KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ