Behavioral task
behavioral1
Sample
d69665f56ddef7ad4e71971f06432e59f1510a7194386e5f0e8926aea7b88e00.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d69665f56ddef7ad4e71971f06432e59f1510a7194386e5f0e8926aea7b88e00.exe
Resource
win10v2004-20240226-en
General
-
Target
d69665f56ddef7ad4e71971f06432e59f1510a7194386e5f0e8926aea7b88e00
-
Size
37KB
-
MD5
7c05da2e4612fca213430b6c93e76b06
-
SHA1
fdeb96bc3d4ab32ef826e7e53f4fe1c72e580379
-
SHA256
d69665f56ddef7ad4e71971f06432e59f1510a7194386e5f0e8926aea7b88e00
-
SHA512
053d1a0b5ebab8b4afc26af20d533947bbc1c6de24c3ab0735f9bffcda3e05a2aef18b3f136102bbd2b5637b5f02b27906e0a092067e29d7943cdfb449fe8f27
-
SSDEEP
768:9kQ2SkG1EqihRWlG4ya6kcqCHfv3uWvzPMinhgaXj7:9jo9kc3einhgaXv
Malware Config
Signatures
-
Industroyer IEC-104 Module 1 IoCs
Contains strings related to Industroyer module used to communicate with power transmission grids over IEC-104 protocol.
Processes:
resource yara_rule sample win_industroyer_w3 -
Industroyer family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d69665f56ddef7ad4e71971f06432e59f1510a7194386e5f0e8926aea7b88e00
Files
-
d69665f56ddef7ad4e71971f06432e59f1510a7194386e5f0e8926aea7b88e00.exe windows:5 windows x86 arch:x86
2cf6ff919d8af9170b36d01b351744f3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
SetWaitableTimer
EnterCriticalSection
CreateWaitableTimerW
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
GetExitCodeThread
TerminateThread
CloseHandle
CreateThread
DeleteCriticalSection
CompareFileTime
WaitForMultipleObjectsEx
OpenEventW
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
InterlockedCompareExchange
CreateFileW
Sleep
GetCommandLineW
LocalFree
ExitProcess
MoveFileA
Process32First
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
GetLastError
Process32Next
ws2_32
WSAStartup
select
send
__WSAFDIsSet
WSACleanup
inet_addr
socket
connect
recv
htons
ioctlsocket
setsockopt
WSAGetLastError
closesocket
shell32
CommandLineToArgvW
oleaut32
VarDateFromStr
VariantTimeToSystemTime
shlwapi
wvnsprintfA
StrToIntA
wnsprintfW
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 101B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 820B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ