C:\Users\quandale\Desktop\brainsense\build\Ethic.pdb
Static task
static1
Behavioral task
behavioral1
Sample
brainsense.exe
Resource
win11-20240221-en
General
-
Target
brainsense.exe
-
Size
2.0MB
-
MD5
a38d2cd45857238391bdbe34b1a9729c
-
SHA1
f87a12b7bcdf981909408b91ee25521604ca451f
-
SHA256
f2c3dd28530a832dc3091a735311e258b02c304e5ed8d3e5ac9e09bbcd562716
-
SHA512
ac0c91c12a63a376d6d6f93e744269341c71cdba07ecf337cecc04d3e95e1c3bab16190bdcc576b7bde34b116604e80fc0805277b43ea8fab4314499494fe218
-
SSDEEP
49152:wIqRZxAFaCBUuGSWiGTO5Bqgwgk+V8uD:cZ/OUuGSzjq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource brainsense.exe
Files
-
brainsense.exe.exe windows:6 windows x64 arch:x64
819ef2bb6adcdeb85db772c311f8bbb5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChain
CertOpenStore
wldap32
ord217
ord211
ord60
ord45
ord46
ord143
ord50
ord41
ord22
ord26
ord301
ord27
ord32
ord33
ord35
ord79
ord30
ord200
kernel32
Sleep
GetConsoleWindow
VirtualFree
VirtualAlloc
Process32First
CreateToolhelp32Snapshot
Process32Next
lstrcmpiA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
VerSetConditionMask
QueryPerformanceCounter
GetCommandLineW
ContinueDebugEvent
WaitForDebugEvent
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
CreateProcessW
GetStartupInfoW
GetSystemInfo
CreateFileMappingW
CloseHandle
DeviceIoControl
QueryFullProcessImageNameW
SetLastError
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
IsDebuggerPresent
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
SetConsoleTitleA
FormatMessageA
FreeLibrary
GetProcAddress
GetLastError
MapViewOfFile
DebugBreak
CreateFileW
LoadLibraryExA
GetModuleFileNameA
LoadLibraryW
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
SleepConditionVariableSRW
WakeAllConditionVariable
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileInformationByHandleEx
AreFileApisANSI
GetTempPathW
GetCurrentProcessId
GetThreadContext
GetSystemDirectoryA
CreateThread
GetCurrentThread
CreateFileA
OpenProcess
GetModuleHandleA
UnmapViewOfFile
ResumeThread
TerminateProcess
GetCurrentProcess
VirtualProtect
SetFileInformationByHandle
GetModuleHandleW
user32
UnregisterClassA
PostQuitMessage
TranslateMessage
SetLayeredWindowAttributes
CreateWindowExA
DefWindowProcA
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
ShowWindow
ScreenToClient
GetAsyncKeyState
PeekMessageA
FindWindowA
GetCursorPos
RegisterClassExA
UpdateWindow
GetKeyState
LoadCursorA
MonitorFromWindow
GetCapture
SendInput
GetWindowRect
SetWindowPos
GetSystemMetrics
SetWindowLongA
GetForegroundWindow
LoadIconA
MoveWindow
GetMonitorInfoA
SetWindowDisplayAffinity
DestroyWindow
ClientToScreen
TrackMouseEvent
SetCapture
SetCursor
GetClientRect
SetProcessDPIAware
ReleaseCapture
SetCursorPos
DispatchMessageA
MessageBoxW
GetClassNameA
MessageBoxA
GetWindowTextA
GetWindowThreadProcessId
GetWindowLongA
EnumWindows
gdi32
CreateSolidBrush
advapi32
CryptGetHashParam
RegQueryValueExA
RegCloseKey
OpenProcessToken
RegSetValueExA
RegDeleteKeyA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyA
GetUserNameW
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
RegOpenKeyExA
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
shell32
ShellExecuteA
SHGetFolderPathW
msvcp140
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Xtime_get_ticks
?setf@ios_base@std@@QEAAHHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1_Locinfo@std@@QEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
_Query_perf_frequency
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
?_Xout_of_range@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
_Thrd_detach
?id@?$ctype@D@std@@2V0locale@2@A
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
NtQuerySystemInformation
dbghelp
ImageNtHeader
ImageRvaToVa
ImageDirectoryEntryToData
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleFileNameExW
EnumProcessModules
EnumProcesses
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
strchr
longjmp
strrchr
__C_specific_handler
wcsstr
_CxxThrowException
_purecall
memcmp
memmove
memcpy
memset
__current_exception
__current_exception_context
__intrinsic_setjmp
__std_terminate
__std_exception_copy
memchr
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_errno
strerror
abort
_initialize_narrow_environment
_configure_narrow_argv
system
terminate
_beginthreadex
_crt_atexit
perror
_invalid_parameter_noinfo
__sys_nerr
_resetstkoflw
_getpid
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
_recalloc
realloc
_set_new_mode
malloc
free
api-ms-win-crt-math-l1-1-0
sin
pow
log10
log
_dclass
fmodf
sqrtf
sinf
floor
exp
cosf
cos
ceilf
ceil
atan2
asin
acosf
fmod
frexp
_dsign
sqrt
acos
llround
ldexp
tan
__setusermatherr
api-ms-win-crt-string-l1-1-0
strcmp
isblank
strnlen
strpbrk
strcspn
strtok_s
wcscpy_s
isspace
isgraph
isupper
isalpha
iscntrl
isxdigit
ispunct
islower
strcoll
tolower
isdigit
strspn
strncpy
isalnum
toupper
_stricmp
strncmp
_strdup
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
fputs
freopen
ferror
fopen
__acrt_iob_func
fflush
fclose
getc
__stdio_common_vsscanf
_wfopen
__stdio_common_vfprintf
feof
fseek
ftell
fread
_read
_lseeki64
_get_stream_buffer_pointers
fsetpos
fgetpos
fgetc
fwrite
fgets
fputc
_write
clearerr
_pclose
tmpfile
setvbuf
_open
_popen
ungetc
_ftelli64
tmpnam
_close
_fseeki64
__stdio_common_vsprintf
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
setlocale
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_mktime64
_difftime64
strftime
_localtime64
_gmtime64
_time64
clock
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-convert-l1-1-0
strtod
strtoul
strtol
atoi
strtoull
atof
strtoll
api-ms-win-crt-filesystem-l1-1-0
_stat64
_access
rename
_unlink
remove
_unlock_file
_lock_file
_fstat64
api-ms-win-crt-utility-l1-1-0
qsort
rand
ws2_32
WSASetLastError
socket
WSAIoctl
setsockopt
WSAStartup
WSACleanup
accept
htonl
sendto
listen
ioctlsocket
htons
gethostname
closesocket
recv
__WSAFDIsSet
send
ntohl
ntohs
WSAGetLastError
getsockopt
getsockname
select
freeaddrinfo
bind
connect
getpeername
getaddrinfo
recvfrom
normaliz
IdnToAscii
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 269KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 441KB - Virtual size: 450KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ