Behavioral task
behavioral1
Sample
Backdoor.Win32.Plite.exe
Resource
win7-20240220-en
General
-
Target
Backdoor.Win32.Plite.bhte-001ebed0cc678ade59c90d6937de0dd9cec8ed1b565d3bbc6385e7534b602f55
-
Size
486KB
-
MD5
0e206b5d0ef3f4430c393e0d6ed2006c
-
SHA1
2024ecc37b01aebd48d39de633a9953999c33046
-
SHA256
001ebed0cc678ade59c90d6937de0dd9cec8ed1b565d3bbc6385e7534b602f55
-
SHA512
21735a43b23ddf1cdd93a6bbedb3ad4b207837b8cd7c33f14669a4570222e1837802f5c4cdf473ca45d638ac92dfb74254be667b5ae06bdbf72efa7f446c1541
-
SSDEEP
6144:3yKfEd7FQGSmAWRViVxGwl+fQSVY/Z+I2VLfFX/L3WsuF9BRIMv9alQ1pEKuH86T:3o7CGWcQSyYI2VrFKH5RBv9AQ1pEDdKK
Malware Config
Extracted
urelas
218.54.31.226
218.54.31.165
218.54.31.166
Signatures
-
Urelas family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Backdoor.Win32.Plite.bhte-001ebed0cc678ade59c90d6937de0dd9cec8ed1b565d3bbc6385e7534b602f55
Files
-
Backdoor.Win32.Plite.bhte-001ebed0cc678ade59c90d6937de0dd9cec8ed1b565d3bbc6385e7534b602f55.exe windows:5 windows x86 arch:x86
c655066d0a2c4420aaa11c9556e7466c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
SetFileAttributesW
DeviceIoControl
FlushFileBuffers
SetFilePointer
ReadFile
GetFileSizeEx
SetLastError
LocalAlloc
LocalFree
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalLock
GlobalReAlloc
GlobalUnlock
GlobalHandle
GlobalAlloc
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
CreateFileW
GlobalFree
TlsFree
InterlockedDecrement
FreeLibrary
lstrlenW
FormatMessageW
GetCurrentThreadId
InterlockedIncrement
lstrcmpA
lstrlenA
GetVersionExA
lstrcmpW
LoadLibraryA
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GlobalFlags
SetEndOfFile
HeapAlloc
HeapFree
GetStartupInfoW
RtlUnwind
RaiseException
HeapReAlloc
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
VirtualAlloc
HeapCreate
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetProcessHeap
MultiByteToWideChar
LockResource
LoadResource
SizeofResource
FindResourceW
WriteFile
CreateFileA
GetModuleFileNameA
GetTempPathA
GetModuleHandleA
TerminateProcess
CreateThread
CreateEventW
DeleteFileW
GetSystemDirectoryW
GetTempPathW
OpenEventW
GetFileAttributesW
GetTickCount
ExitProcess
Sleep
GetModuleFileNameW
GetCurrentProcessId
GetCurrentProcess
CloseHandle
GetVersionExW
GetProcAddress
LoadLibraryW
GetModuleHandleW
DeleteCriticalSection
GetLastError
user32
SetWindowTextW
ClientToScreen
DestroyMenu
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetForegroundWindow
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
PostMessageW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetWindowTextW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
SetWindowsHookExW
CallNextHookEx
GetKeyState
PeekMessageW
ValidateRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowThreadProcessId
SendMessageW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
UnhookWindowsHookEx
LoadStringW
LoadAcceleratorsW
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
DialogBoxParamW
DestroyWindow
DefWindowProcW
BeginPaint
EndPaint
PostQuitMessage
EndDialog
wsprintfW
RegisterWindowMessageW
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
GetFocus
advapi32
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
shell32
ShellExecuteA
ShellExecuteW
ws2_32
gethostbyaddr
socket
gethostbyname
WSAStartup
htonl
WSAGetLastError
recv
send
closesocket
connect
htons
inet_addr
iphlpapi
GetAdaptersInfo
wtsapi32
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
oleacc
LresultFromObject
CreateStdAccessibleObject
gdi32
DeleteDC
GetStockObject
TextOutW
PtVisible
ScaleWindowExtEx
SetWindowExtEx
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
DeleteObject
ExtTextOutW
SaveDC
RestoreDC
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
RectVisible
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
SetMapMode
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
oleaut32
VariantClear
VariantChangeType
VariantInit
Sections
.text Size: 476KB - Virtual size: 500KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE