OPENSSL_Applink
Behavioral task
behavioral1
Sample
dump_quantum.exe
Resource
win10v2004-20240226-en
General
-
Target
dump_quantum.exe
-
Size
54.0MB
-
MD5
0a8a6df958cc3f11410183b7b02ca85f
-
SHA1
7023a470b15d125d7034b49b357a9d47297bb62d
-
SHA256
46523269d366e760f649dbda52f8ba498308c9e056cb86236a3a8afea8a504c1
-
SHA512
c0752418aa119fb35f227771e609cf5d0db5e9acee04a3324e38257bf50b1d233975df623411f64bbd4521c40cd1c7977edfc05fbcbd59d583f7b8d617cce3a1
-
SSDEEP
786432:TxVD9CI+3gDxV6HGqaLrF+/k0dVr6uc1oKjvgn7ybWGlEpo:Txap8Vpq8+76cmgn7me
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dump_quantum.exe
Files
-
dump_quantum.exe.exe windows:6 windows x64 arch:x64
acd8313aef2fef593e718e00e64678f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
InitiateShutdownW
RegDeleteValueA
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetUserNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
SetNamedSecurityInfoW
SetEntriesInAclW
StartServiceA
OpenServiceA
OpenSCManagerW
ControlService
CloseServiceHandle
RegDeleteTreeW
RegSetKeySecurity
RegEnumValueW
RegDeleteValueW
FreeSid
AllocateAndInitializeSid
RegDeleteKeyA
RegCreateKeyA
RegCreateKeyExW
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey
comctl32
InitCommonControls
gdi32
DeleteObject
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SetTextColor
SetBkMode
GetStockObject
CreateFontA
SelectObject
iphlpapi
GetIfEntry2
FreeMibTable
GetIfTable2Ex
kernel32
SetConsoleTitleA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesW
RemoveDirectoryA
SetFileAttributesA
GetTempPathA
SetLastError
GetExitCodeProcess
GetModuleFileNameA
LocalFree
DeviceIoControl
GetPhysicallyInstalledSystemMemory
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableW
GetFileType
WriteFile
ConvertFiberToThread
AttachConsole
GlobalAlloc
GetSystemTimeAsFileTime
RtlVirtualUnwind
FreeLibrary
LoadLibraryW
TerminateProcess
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeSListHead
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GetFileAttributesExW
InitOnceComplete
InitOnceBeginInitialize
FormatMessageA
SetConsoleTextAttribute
FreeConsole
GetStdHandle
AllocConsole
VirtualProtect
GetThreadId
TerminateThread
CreateThread
GetCurrentProcessId
CreateMutexW
CheckRemoteDebuggerPresent
IsDebuggerPresent
GlobalFree
GlobalLock
ConvertThreadToFiber
GlobalUnlock
GetModuleFileNameW
ExitProcess
Sleep
GetDriveTypeA
CreateFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
VirtualQuery
GetSystemInfo
OpenProcess
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetStartupInfoW
CreateRemoteThread
GetCurrentProcess
GetProcessHeap
HeapAlloc
GetLastError
GetSystemDirectoryA
CreateProcessA
WaitForSingleObject
CloseHandle
GetFileAttributesA
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
msvcp140
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?id@?$numpunct@D@std@@2V0locale@2@A
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Mtx_init_in_situ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
_Cnd_wait
_Cnd_broadcast
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
_Strcoll
_Strxfrm
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_C_str@?$_Yarn@D@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1?$codecvt@DDU_Mbstatet@@@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
??0?$_Yarn@D@std@@QEAA@XZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
??4?$_Iosb@H@std@@QEAAAEAV01@$$QEAV01@@Z
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
?_Random_device@std@@YAIXZ
?uncaught_exceptions@std@@YAHXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
shell32
ShellExecuteW
shlwapi
PathFindFileNameW
user32
GetNextDlgTabItem
OpenClipboard
CloseClipboard
SetClipboardData
CheckDlgButton
EmptyClipboard
ShowWindow
CreateWindowExW
MessageBoxW
RegisterClassExW
GetProcessWindowStation
GetWindowThreadProcessId
EnumWindows
GetWindowTextW
ReleaseDC
GetSystemMetrics
LoadIconW
LoadCursorW
GetParent
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
UpdateWindow
IsDlgButtonChecked
PostQuitMessage
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
CreateWindowExA
SendMessageA
GetUserObjectInformationW
SetFocus
vcruntime140
strchr
memchr
__C_specific_handler
wcsstr
memset
strstr
__current_exception
__current_exception_context
strrchr
_purecall
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memcmp
memcpy
vcruntime140_1
__CxxFrameHandler4
ws2_32
closesocket
WSAGetLastError
connect
recv
WSASetLastError
FreeAddrInfoW
getaddrinfo
send
socket
WSACleanup
WSAStartup
ucrtbase
strtoul
atoi
strtol
getenv
_unlock_file
_lock_file
_stat64i32
malloc
_callnewh
realloc
free
calloc
_set_new_mode
_configthreadlocale
localeconv
___lc_codepage_func
__setusermatherr
_dsign
_dsign
_fdsign
_fdclass
_dclass
ceilf
_dclass
_initterm
_invalid_parameter_noinfo_noreturn
abort
_get_narrow_winmain_command_line
raise
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
signal
_c_exit
_register_thread_local_exe_atexit_callback
_Exit
exit
strerror_s
_initterm_e
_errno
fflush
fclose
fgetc
fgetpos
fputc
_flushall
_get_stream_buffer_pointers
freopen_s
fsetpos
__stdio_common_vsprintf
_sopen_dispatch
__p__commode
__stdio_common_vsscanf
_fseeki64
fwrite
_wfopen
_write
_setmode
fputs
_read
_lseek
ungetc
_close
__stdio_common_vfprintf
ftell
fseek
fopen
_fileno
fgets
ferror
feof
clearerr
__acrt_iob_func
setvbuf
__stdio_common_vswprintf
__stdio_common_vsprintf_s
fread
_getcwd
_set_fmode
wcscpy_s
toupper
strncpy
strspn
strcspn
strcmp
isspace
strncmp
strcpy_s
_strnicmp
isalpha
_stricmp
islower
isupper
isdigit
towupper
_gmtime64_s
_time64
_mktime64
rand
qsort
srand
bcrypt
BCryptGenRandom
gdiplus
GdiplusStartup
GdipAlloc
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdipFree
ntdll
RtlCaptureContext
RtlCompareMemory
NtClose
NtQueryInformationProcess
NtQuerySystemInformation
RtlInitUnicodeString
RtlLookupFunctionEntry
combase
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoCreateGuid
urlmon
URLDownloadToFileA
Exports
Exports
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 691KB - Virtual size: 708KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 73KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 196KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 196KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 32.8MB - Virtual size: 32.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 18.1MB - Virtual size: 18.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.SCY Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE