Hurley
Overview
overview
10Static
static
3dcdc99a71a...3b.exe
windows7-x64
10dcdc99a71a...3b.exe
windows10-2004-x64
10$TEMP/Part...ri.dll
windows7-x64
10$TEMP/Part...ri.dll
windows10-2004-x64
10$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...ps.dll
windows7-x64
1$TEMP/what...ps.dll
windows10-2004-x64
1$TEMP/what...ui.dll
windows7-x64
1$TEMP/what...ui.dll
windows10-2004-x64
1$TEMP/what...er.dll
windows7-x64
1$TEMP/what...er.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$TEMP/PartiShikari.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$TEMP/PartiShikari.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/whatnot/failure/cgi-bin/33.opends60.dll
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
$TEMP/whatnot/failure/cgi-bin/33.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/whatnot/failure/cgi-bin/69.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/whatnot/failure/cgi-bin/69.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$TEMP/whatnot/failure/cgi-bin/79.opends60.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$TEMP/whatnot/failure/cgi-bin/79.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$TEMP/whatnot/failure/cgi-bin/edbgps.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$TEMP/whatnot/failure/cgi-bin/edbgps.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$TEMP/whatnot/failure/cgi-bin/hxvzui.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$TEMP/whatnot/failure/cgi-bin/hxvzui.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll
Resource
win10v2004-20240226-en
General
-
Target
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b
-
Size
721KB
-
MD5
ed8504a7a6f3377d677b97526a376e81
-
SHA1
86a0376de9b9ee12f86ed24091bc151ebae7d147
-
SHA256
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b
-
SHA512
624bd34a11ebc86976bfd36385c79cf1730f81ce16f1c4fbf8076e226056219deb132e629297729b415c3721114425ae12f3da8ff34a1e60827d0588e7b74397
-
SSDEEP
12288:/anyMm4/gn9Otfj8QwCHPInVyTnT6+lyZsIhqV4mfSoi1f5N/yCjcbvsqUpR:5Mh+aNwSPInVyFlONhq2mKD3/yCjYpuR
Malware Config
Signatures
-
Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
Processes:
resource dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b unpack001/$TEMP/PartiShikari.dll unpack001/$TEMP/whatnot/failure/cgi-bin/edbgps.dll unpack001/$TEMP/whatnot/failure/cgi-bin/hxvzui.dll unpack001/$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll -
NSIS installer 2 IoCs
Processes:
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b.exe windows:4 windows x86 arch:x86
7c2c71dfce9a27650634dc8b1ca03bf0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEnvironmentVariableA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
Sleep
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
SetFileAttributesA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileTime
GetFileAttributesA
SetCurrentDirectoryA
MoveFileA
GetFullPathNameA
GetShortPathNameA
SearchPathA
CloseHandle
lstrcmpiA
GlobalUnlock
GetDiskFreeSpaceA
lstrcmpA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
GetPrivateProfileStringA
WritePrivateProfileStringA
MulDiv
MultiByteToWideChar
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
GetSystemMenu
SetClassLongA
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
LoadImageA
CreateDialogParamA
SetTimer
SetWindowTextA
SetForegroundWindow
ShowWindow
SetWindowLongA
SendMessageTimeoutA
FindWindowExA
IsWindow
AppendMenuA
TrackPopupMenu
CreatePopupMenu
DrawTextA
EndPaint
DestroyWindow
wsprintfA
PostQuitMessage
gdi32
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ord17
ImageList_Destroy
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$TEMP/Capercaillie
-
$TEMP/PartiShikari.dll.dll windows:5 windows x86 arch:x86
70deecc9256d7731ff47ae8164d66943
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
RegFlushKey
InitializeAcl
EqualSid
RegRestoreKeyA
RegEnumKeyExW
gdi32
ExcludeClipRect
EnumFontFamiliesExW
ws2_32
gethostbyaddr
socket
kernel32
SetLastError
GetProfileIntA
GetProcAddress
GetModuleHandleA
SetSystemTime
OpenEventW
CreateNamedPipeA
WriteFileEx
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize
Exports
Exports
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$TEMP/whatnot/failure/cgi-bin/33.opends60.dll
-
$TEMP/whatnot/failure/cgi-bin/69.opends60.dll
-
$TEMP/whatnot/failure/cgi-bin/79.opends60.dll
-
$TEMP/whatnot/failure/cgi-bin/Aspnetregsql.exe.xml
-
$TEMP/whatnot/failure/cgi-bin/blank-hddvd.xml.xml
-
$TEMP/whatnot/failure/cgi-bin/edbgps.dll.dll regsvr32 windows:5 windows x86 arch:x86
757d4c6094c99e0cf4b7172e7fbdfc2a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
edbgps.pdb
Imports
kernel32
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent
msvcr80
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
_malloc_crt
_encoded_null
free
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__dllonexit
__clean_type_info_names_internal
_unlock
_encode_pointer
oleaut32
BSTR_UserSize
BSTR_UserUnmarshal
BSTR_UserFree
BSTR_UserMarshal
rpcrt4
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
CStdStubBuffer_QueryInterface
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
NdrOleFree
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
NdrOleAllocate
CStdStubBuffer_DebugServerQueryInterface
NdrDllUnregisterProxy
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$TEMP/whatnot/failure/cgi-bin/hxvzui.dll.dll windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$TEMP/whatnot/failure/cgi-bin/hyphen-de.md5sums
-
$TEMP/whatnot/failure/cgi-bin/org.gnome.Software.Plugin.Odrs.metainfo.xml.xml
-
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll.dll windows:5 windows x86 arch:x86
67a93297e14b927bc8a7a8f49c55bfe1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
f:\clr\bin\i386\bbt\sbs_diasymreader.pdb
Imports
msvcr70
_adjust_fdiv
_initterm
_onexit
_except_handler3
__dllonexit
malloc
free
kernel32
DisableThreadLibraryCalls
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ