ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
snmpstorsrv.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
snmpstorsrv.dll
Resource
win10v2004-20240226-en
General
-
Target
snmpstorsrv.7z
-
Size
127KB
-
MD5
849858514c41fb05f719f9b198bdff36
-
SHA1
6bf7f24fe95ff011a9623654ec69f16b4c05065e
-
SHA256
84c0b1a42c8f1c083147d43d263c5329728e9e3847f2f787d1f1e1fabab5b3a9
-
SHA512
6101bdef1486ac3fa5c412fcc6d88e2c33117b53898dbfa5de7c34fd8076944d90d5b6f9a814ce1ef5754902eccffbf5d1da74d148837a52d9fb60460a08df1c
-
SSDEEP
3072:Ito36B6KziE+2nNPj7MLh9LBs6weRer7UvTn0ZOQsxJ17Zb:IjAGhnN0LzLuAm7YT0iV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/snmpstorsrv.dll
Files
-
snmpstorsrv.7z.7z
Password: infected
-
snmpstorsrv.dll.dll windows:5 windows x64 arch:x64
17daeb851bbf944bf117cab241f2a664
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetWindowsDirectoryA
SetFileAttributesA
LocalFree
GetStartupInfoA
RemoveDirectoryA
CreateProcessA
GetFileTime
SetLastError
WaitForSingleObject
FreeConsole
CreateThread
OutputDebugStringW
TerminateThread
GetTickCount
InitializeCriticalSection
CreateDirectoryA
GetTempPathA
lstrcpyA
VirtualFree
VirtualAlloc
LoadLibraryA
IsBadReadPtr
GetProcAddress
GetModuleHandleExW
WriteProcessMemory
Wow64SetThreadContext
Wow64GetThreadContext
ExpandEnvironmentStringsA
ResumeThread
GetThreadContext
VirtualAllocEx
SetThreadContext
GetVersionExA
GetSystemInfo
Process32Next
LeaveCriticalSection
DeleteCriticalSection
VirtualProtect
SetEvent
CreateEventA
CancelIo
ResetEvent
SetErrorMode
GlobalMemoryStatusEx
GetModuleHandleW
SetEndOfFile
HeapSize
DeleteFileA
GetSystemDirectoryA
CreateFileA
GetLastError
Sleep
CreateToolhelp32Snapshot
OpenProcess
ReleaseMutex
LocalAlloc
CreateMutexA
FindClose
FindNextFileA
SetFileTime
TerminateProcess
WriteFile
FindFirstFileA
Process32First
ReadConsoleW
WriteConsoleW
SetStdHandle
CreateFileW
GetCommandLineW
GetCommandLineA
ReadFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
SetFilePointerEx
FlushFileBuffers
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetStdHandle
GetACP
GetConsoleMode
GetConsoleCP
ExitProcess
HeapFree
HeapReAlloc
HeapAlloc
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
GetFileSizeEx
EnterCriticalSection
FreeLibrary
RtlUnwindEx
WideCharToMultiByte
EncodePointer
DecodePointer
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlPcToFileHeader
RaiseException
advapi32
SystemFunction036
CryptImportKey
RegOpenKeyW
RegQueryValueExW
RegCreateKeyA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegSetValueExA
CryptVerifySignatureA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
oleaut32
VariantClear
ws2_32
accept
bind
__WSAFDIsSet
closesocket
select
send
socket
connect
recv
htonl
htons
setsockopt
gethostbyname
WSAStartup
inet_ntoa
getsockname
listen
WSAIoctl
gethostname
wininet
InternetCloseHandle
InternetOpenA
InternetSetOptionA
HttpOpenRequestA
HttpQueryInfoA
InternetReadFile
InternetConnectA
HttpSendRequestA
iphlpapi
GetAdaptersInfo
psapi
GetModuleFileNameExA
Exports
Exports
Sections
.text Size: 201KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ