Behavioral task
behavioral1
Sample
365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08.exe
Resource
win10v2004-20240412-en
General
-
Target
365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08
-
Size
30KB
-
MD5
2ad2c7b5700f4246447b90f07ec5359b
-
SHA1
e9bf283f6dba0c0707a748fbd4a7c6f0c330f7d7
-
SHA256
365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08
-
SHA512
625090c4b634c6d95b08bc8965d7445307c242ca9d6fb9e17cf402e82de317c33b21a3a894ec9ff12fbffa2c4fd17d7647c5db3414b81c6f48f565dd2257214c
-
SSDEEP
768:j4Fd5REMkNoYKNen9OztmVWj9n52yoJImwJcaP:+1EMkNoxMgYVen0yoif
Malware Config
Extracted
systembc
gmstar23.xyz:4044
scgsdstat14tp.xyz:4044
Signatures
-
Systembc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08
Files
-
365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08.exe windows:4 windows x86 arch:x86
17dde48adb7c1f90e4bfb6b6679669b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetWindowTextA
CreateWindowExA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
wsprintfA
GetMessageA
kernel32
WaitForSingleObject
WriteFile
VirtualAlloc
VirtualFree
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
RemoveDirectoryA
SystemTimeToFileTime
SetFilePointer
Sleep
SetEvent
advapi32
CryptAcquireContextA
CryptExportKey
CryptImportKey
CryptReleaseContext
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
CryptDestroyKey
wsock32
htons
inet_addr
inet_ntoa
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
connect
closesocket
WSAStartup
WSACleanup
shell32
CommandLineToArgvW
ShellExecuteA
ws2_32
freeaddrinfo
WSAIoctl
getaddrinfo
ole32
CoUninitialize
CoInitialize
CoCreateInstance
secur32
InitSecurityInterfaceA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExA
GetUserNameExW
InitializeSecurityContextA
QueryContextAttributesA
crypt32
CryptStringToBinaryA
CryptDecodeObject
psapi
GetModuleFileNameExA
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 670B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ