DotNetRuntimeDebugHeader
Static task
static1
Behavioral task
behavioral1
Sample
mainbot.exe
Resource
win10v2004-20240226-en
General
-
Target
mainbot.exe
-
Size
10.3MB
-
MD5
2d9d6924fcdb44d6de3798bbd27c9d26
-
SHA1
a80ebc25daefad8d7257a0481f533d221b6af998
-
SHA256
6984cf4fce9732a3369b627d5eb89c5303add15679fdccb0fb11c6ea48c3bc80
-
SHA512
e900334832630b1eb5ccc822d90db898844d2fe1cc46b07ceb248a04339dd17386fe404d7cc28f9e07604c9cf7f0cda455d64ceeb3685297a965d7d50c4c4550
-
SSDEEP
98304:Oo/tNl5lp+RTTpqenc5ZYlPI3bWBmn3P4MOG0MWr4K:PlNl5L+RTtqenc5ZePI3bWE+G0b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mainbot.exe
Files
-
mainbot.exe.exe windows:6 windows x64 arch:x64
f03562731fbf98110d7c8a05ae6b5d4c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
LookupPrivilegeValueW
RevertToSelf
OpenThreadToken
OpenProcessToken
SetThreadToken
AdjustTokenPrivileges
DuplicateTokenEx
GetSecurityDescriptorLength
RegCreateKeyExW
RegSetValueExW
GetTokenInformation
ConvertStringSidToSidW
CreateWellKnownSid
GetWindowsAccountDomainSid
ImpersonateLoggedOnUser
CheckTokenMembership
EventWrite
EventRegister
EventEnabled
bcrypt
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptCreateHash
BCryptDestroyKey
BCryptDestroyHash
BCryptEncrypt
BCryptDecrypt
BCryptImportKey
BCryptExportKey
BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptGenRandom
BCryptCloseAlgorithmProvider
crypt32
CryptDecodeObject
CertVerifyTimeValidity
CertSetCertificateContextProperty
CertSerializeCertificateStoreElement
CertSaveStore
CertFreeCertificateChainEngine
CertCloseStore
PFXImportCertStore
PFXExportCertStore
CryptFindOIDInfo
CryptQueryObject
CryptMsgGetParam
CryptMsgClose
CryptImportPublicKeyInfoEx2
CertOpenStore
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertControlStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertGetNameStringW
CertGetValidUsages
CertNameToStrW
CryptFormatObject
iphlpapi
GetNetworkParams
GetPerAdapterInfo
GetAdaptersAddresses
if_nametoindex
kernel32
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsProcessorFeaturePresent
SetLastError
LoadLibraryExW
GetLastError
QueryPerformanceCounter
GetTickCount64
CancelIoEx
GetCPInfoExW
GetConsoleMode
GetFileType
ReadFile
ReadConsoleW
WriteFile
WriteConsoleW
GetConsoleOutputCP
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
CloseThreadpoolIo
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetCalendarInfoEx
CompareStringOrdinal
CompareStringEx
FindNLSStringEx
GetLocaleInfoEx
ResolveLocaleName
GetUserPreferredUILanguages
FindStringOrdinal
GetCurrentProcessorNumber
GetCurrentProcess
GetCurrentThread
WaitForSingleObject
Sleep
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
QueryPerformanceFrequency
GetFullPathNameW
GetLongPathNameW
GetCPInfo
LocalAlloc
GetProcAddress
RaiseFailFastException
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
LocaleNameToLCID
LCMapStringEx
EnumTimeFormatsEx
EnumCalendarInfoExEx
CreateFileW
DeleteFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetOverlappedResult
GetSystemDirectoryW
QueryUnbiasedInterruptTime
SetFileInformationByHandle
SetFilePointerEx
SetThreadErrorMode
CreateThread
ResumeThread
DuplicateHandle
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
CloseHandle
SetEvent
ResetEvent
CreateEventExW
GetEnvironmentVariableW
FormatMessageW
GetExitCodeProcess
CreateProcessW
TerminateProcess
OpenProcess
K32EnumProcesses
GetProcessId
CreatePipe
GetConsoleCP
FlushProcessWriteBuffers
GetCurrentThreadId
WaitForSingleObjectEx
VirtualQuery
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
GetEnvironmentVariableA
EncodePointer
DecodePointer
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
GetProcessHeap
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ncrypt
NCryptFinalizeKey
NCryptCreatePersistedKey
NCryptDeleteKey
NCryptOpenKey
NCryptOpenStorageProvider
NCryptGetProperty
NCryptVerifySignature
NCryptFreeObject
NCryptImportKey
NCryptSetProperty
ole32
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoGetApartmentType
CoCreateGuid
CoWaitForMultipleHandles
CoTaskMemFree
user32
LoadStringW
ws2_32
shutdown
setsockopt
send
WSAConnect
recv
listen
ioctlsocket
WSASend
WSARecv
select
bind
closesocket
GetNameInfoW
GetAddrInfoW
FreeAddrInfoW
WSASocketW
GetAddrInfoExW
WSAStartup
WSACleanup
FreeAddrInfoExW
WSAEventSelect
WSAIoctl
accept
getsockopt
getpeername
getsockname
WSAGetOverlappedResult
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
log2
__setusermatherr
ceil
cos
floor
pow
sin
tan
modf
api-ms-win-crt-string-l1-1-0
_stricmp
strncpy_s
_wcsicmp
strcmp
wcsncmp
strcpy_s
api-ms-win-crt-runtime-l1-1-0
_set_app_type
abort
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
terminate
_initialize_onexit_table
_register_onexit_function
exit
_crt_atexit
_register_thread_local_exe_atexit_callback
_initterm
_c_exit
_cexit
__p___wargv
__p___argc
_initterm_e
_exit
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsscanf
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: 802KB - Virtual size: 802KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.managed Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 393KB - Virtual size: 499KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 344KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 198KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ