Uemlxaw.zip
- SHA256 4a009d7516245a7af1dbc74beacd149316212a8cbd045132e7f95118bfafcece
Overview
overview
10Static
static
3Narsil.exe
windows7-x64
10Narsil.exe
windows10-1703-x64
10Narsil.exe
windows10-2004-x64
10Narsil.exe
windows11-21h2-x64
SurrogateS...vc.exe
windows7-x64
10SurrogateS...vc.exe
windows10-1703-x64
10SurrogateS...vc.exe
windows10-2004-x64
10SurrogateS...vc.exe
windows11-21h2-x64
10winserverupd.exe
windows7-x64
10winserverupd.exe
windows10-1703-x64
10winserverupd.exe
windows10-2004-x64
10winserverupd.exe
windows11-21h2-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Narsil.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
Narsil.exe
Resource
win10-20240221-en
windows10-1703-x64
6 signatures
300 seconds
Behavioral task
behavioral3
Sample
Narsil.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
21 signatures
300 seconds
Behavioral task
behavioral4
Sample
Narsil.exe
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
SurrogateServerIntoSvc.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral6
Sample
SurrogateServerIntoSvc.exe
Resource
win10-20240221-en
windows10-1703-x64
10 signatures
300 seconds
Behavioral task
behavioral7
Sample
SurrogateServerIntoSvc.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
300 seconds
Behavioral task
behavioral8
Sample
SurrogateServerIntoSvc.exe
Resource
win11-20240221-en
windows11-21h2-x64
10 signatures
300 seconds
Behavioral task
behavioral9
Sample
winserverupd.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral10
Sample
winserverupd.exe
Resource
win10-20240221-en
windows10-1703-x64
9 signatures
300 seconds
Behavioral task
behavioral11
Sample
winserverupd.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
300 seconds
General
- Target Uemlxaw.zip
- Size 4.9MB
- Sample240318-slmnvscc5w
- SHA256 4a009d7516245a7af1dbc74beacd149316212a8cbd045132e7f95118bfafcece
- MD5 0f09286d0564589399c7b59fa150ec51
- SHA1 3c675f2710f3fb7b4793de2a10ed76c2646ffd82
- SHA512 17e85425b3dfc1be7d20cd7d187345db74e5004fb380d60b6e60b743ce648f7e912bae5a9d17c6144a360572e96011983b955ca12ce617cfff124808eea1ef9c
- SSDEEP 98304:9uEr9EEDARts9w9IT+Lgd3zYYjtB+kB4fLSgeZW9gNvjz:4EhWRtsS4/+YjC6427M9kvP
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Narsil.exe unpack001/SurrogateServerIntoSvc.exe unpack001/winserverupd.exe
File Explorer
-
Uemlxaw.zip.zip 4.9MB
-
Narsil.exe.exe 146.9MB
-
SurrogateServerIntoSvc.exe.exe 147.8MB
-
winserverupd.exe.exe 91KB
Narsil.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 33e28ac931d8477eb8d20603b7b8d8cd55a4356ef106d24b02fa3a36be0ee087
- MD5 a3e747b0e917fe4e066eb1c40729c97a
- SHA1 05d0cab40ea39437451b4f7a1058bbc34f9c0aa8
- SHA512 762dd71cbce06cafff547c3f4a9be0d51899797eaa676b00556778fb27f25649890cacc3efe1af7b3d36a259917185e2509e125444d5552935e2f5a8b873029e
- SSDEEP 49152:pKS9lXHCklzCAMKtoCKt0KKEtDiDJibri0Bp1D:oUXHCIWAMIoBWjCDeL0Bp1D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3376046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SurrogateServerIntoSvc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 df18a66e0d7dac7371e4371005a83e4735f5e22377b28f00bb0f41a3feee92a5
- MD5 498289ebcaf79eb8c4d1b32fda603ccc
- SHA1 5ba78056884ab0e19a81da9b95c8e1e7e8e7d2f6
- SHA512 492585cb98fd1608b9a30f82e7bf5480e4b483ea586375425ce39d805df2674cb81cf91d966ce0565c6b82479f88051398651e0191201f293f3e548f7e1051a7
- SSDEEP 49152:ndm9asqLK/r8ZOwN/Eqy8QDWGCYhYp/81SArFv29qh1z4S:n4whZOwNaDeR/uSyt29qDz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3313758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
winserverupd.exe
- IMPHASH 5877688b4859ffd051f6be3b8e0cd533
- SHA256 c06da1d7ce6843074ae3a964dc8aa862151f2196c0e15964d3d9959a44ba89f8
- MD5 607acc5a6b670bd144bf3897cda6b233
- SHA1 24a2fc93216adb3543ee555473b2f61f333384d2
- SHA512 75bd3c2fe2a6b96586e0e1ecf5d282d55f71fb9891961ca1dd6c6be90eaa9a196fd62c8343abfdb039e384895a593f2a01c725451c580980f238c40d764b4643
- SSDEEP 1536:r7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfLx4fmSxL2MO2:nq6+ouCpk2mpcWJ0r+QNTBfLyfmSBR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
free
_wcsicmp
wcslen
wcscpy
wcscmp
memcpy
tolower
wcscat
malloc
kernel32
GetModuleHandleW
HeapCreate
GetStdHandle
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
GetExitCodeProcess
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetNativeSystemInfo
GetShortPathNameW
GetWindowsDirectoryW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
Sleep
GetProcAddress
GetVersionExW
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
DuplicateHandle
RegisterWaitForSingleObject
user32
CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
DestroyWindow
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
EnableWindow
GetSystemMetrics
CreateWindowExW
SetWindowLongW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
shell32
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
winmm
timeBeginPeriod
ole32
CoInitialize
CoTaskMemFree
shlwapi
PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
Name
.code
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ