ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
19cac6a487cbf9cbae8284b81392098ab726adc58bef45e7bccb0f88c4c1da55.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
19cac6a487cbf9cbae8284b81392098ab726adc58bef45e7bccb0f88c4c1da55.dll
Resource
win10v2004-20240412-en
General
-
Target
19cac6a487cbf9cbae8284b81392098ab726adc58bef45e7bccb0f88c4c1da55
-
Size
397KB
-
MD5
6fc49534ae2b16dfbdddfa2e596b9cd2
-
SHA1
5c375216361ecae0609a43aa39a9d10c73f14a43
-
SHA256
19cac6a487cbf9cbae8284b81392098ab726adc58bef45e7bccb0f88c4c1da55
-
SHA512
5d3ef5b91a95e717e5d5398c7ea4f81deb4b941e44dfae9fb2287da2adf923bec6ba2cd41b98b2e5f6edf953f161f34d51d6a3a0a1e1b5c0aedc429d6b0ad127
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaT:174g2LDeiPDImOkx2LIaT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19cac6a487cbf9cbae8284b81392098ab726adc58bef45e7bccb0f88c4c1da55
Files
-
19cac6a487cbf9cbae8284b81392098ab726adc58bef45e7bccb0f88c4c1da55.dll windows:5 windows x86 arch:x86
6bcb031e96cdbf084ab7885e29898b0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
VirtualQuery
LoadLibraryW
GetSystemDirectoryW
SetCurrentDirectoryW
ProcessIdToSessionId
CreateProcessW
TerminateProcess
LoadLibraryA
GetVersionExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
QueryPerformanceCounter
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
TlsSetValue
WriteConsoleW
CreateThread
Sleep
ExitProcess
GetModuleFileNameW
SetUnhandledExceptionFilter
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetProcAddress
GetCurrentProcessId
OpenProcess
MultiByteToWideChar
WriteFile
GetTickCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
HeapCreate
RtlUnwind
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
LCMapStringA
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
SetLastError
InterlockedIncrement
GetModuleHandleW
GetCurrentProcess
OpenMutexW
GetLastError
CloseHandle
CreateMutexW
ReadFile
SetFilePointer
GetSystemInfo
GetModuleHandleA
VirtualFree
TerminateThread
VirtualAlloc
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetProcessId
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
GlobalAlloc
GlobalFree
CreateFileA
UnhandledExceptionFilter
IsDebuggerPresent
TlsFree
user32
GetThreadDesktop
GetWindowThreadProcessId
FindWindowExW
FindWindowW
wsprintfW
OpenDesktopW
SetThreadDesktop
advapi32
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
SetServiceStatus
RegisterServiceCtrlHandlerW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
CreateProcessAsUserW
shlwapi
PathFileExistsW
StrCmpIW
wininet
InternetOpenW
InternetSetOptionW
InternetOpenUrlW
HttpSendRequestW
InternetQueryOptionW
InternetSetOptionA
HttpOpenRequestW
InternetConnectW
InternetCloseHandle
InternetReadFile
psapi
GetModuleFileNameExW
ws2_32
WSAStartup
socket
setsockopt
htons
inet_addr
sendto
recvfrom
closesocket
inet_ntoa
htonl
ntohl
ntohs
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
dnsapi
DnsFree
DnsQuery_W
iphlpapi
SendARP
GetIpNetTable
GetAdaptersInfo
Exports
Exports
Sections
.text Size: 165KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ