622ea140fe5be44110db445ed139647c1ee9d4e48b71cd4e3303ca96969c2438

Sharing

Copy URL Twitter E-mail

General

Target

622ea140fe5be44110db445ed139647c1ee9d4e48b71cd4e3303ca96969c2438
Size

344KB
MD5

1dfdc7199f7a5a0270b86b813d6b3ba8
SHA1

8c8e7bb5588d844d7ed32bb6fbb84209375b8a51
SHA256

622ea140fe5be44110db445ed139647c1ee9d4e48b71cd4e3303ca96969c2438
SHA512

20a57001646e81b92e6b3e3ec7faf4f6635adfd58f3b1708497fe78f3dd41d4b6b3cc403edc19ac5e46525b9aa6445c961f521115417a31432a76c8662487f6e
SSDEEP

6144:dWJN6HK+Hfb3fJej1JlyZNTP3lCEmj9RnpacB20bVnQjZlE09:dWTKQJoNTvlC1j95gcB20pn+d

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination manipulating RDP / Terminal Services 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
622ea140fe5be44110db445ed139647c1ee9d4e48b71cd4e3303ca96969c2438

Files

622ea140fe5be44110db445ed139647c1ee9d4e48b71cd4e3303ca96969c2438
.exe windows:4 windows x86 arch:x86

f9848f7e2ffc1217ececdfc5ef5ff74e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
lstrcmpiA
SetFileAttributesA
SetErrorMode
OpenEventA
GetSystemInfo
GlobalMemoryStatus
LoadLibraryW
FreeLibrary
WaitForMultipleObjects
TerminateProcess
DisconnectNamedPipe
GetTickCount
GlobalSize
GlobalLock
GlobalUnlock
GlobalFree
GetProcessHeap
HeapAlloc
HeapFree
GetLocalTime
GetSystemDirectoryA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
SetLastError
GetModuleFileNameA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
lstrcpyA
CancelIo
InterlockedExchange
ResetEvent
LoadLibraryA
GetProcAddress
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
Sleep
CreateThread
ResumeThread
CreateEventA
SetEvent
WaitForSingleObject
GetProfileStringA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
GetExitCodeProcess
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
TerminateThread
CloseHandle
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
GetTimeZoneInformation
GetACP
HeapSize
HeapReAlloc
GetCommandLineA
GetStartupInfoA
GetCurrentThread
GlobalDeleteAtom
GlobalAlloc
LoadResource
FindResourceA
LockResource
GetModuleHandleA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVersion
InterlockedIncrement
InterlockedDecrement
MulDiv
lstrcpynA
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
TlsGetValue
GlobalFlags
WritePrivateProfileStringA
GetProcessVersion
SizeofResource
GetThreadLocale
GetCPInfo
GetOEMCP
DuplicateHandle
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFullPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
FormatMessageA
RtlUnwind
RaiseException
ExitProcess
ExitThread

user32

CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
SetActiveWindow
EndDialog
SetWindowContextHelpId
GetWindow
SetWindowPos
MapDialogRect
GetWindowRect
GetWindowPlacement
IntersectRect
OffsetRect
RegisterWindowMessageA
SetWindowLongA
SetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
GetDlgCtrlID
GetWindowTextLengthA
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
IsChild
GetTopWindow
GetWindowLongA
SetCursor
CopyRect
ScreenToClient
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
SendDlgItemMessageA
UpdateWindow
LoadIconA
EnableMenuItem
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
LoadStringA
DestroyMenu
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetClassNameA
PtInRect
GetSysColorBrush
CopyAcceleratorTableA
GetNextDlgGroupItem
MessageBeep
InvalidateRect
CharUpperA
InflateRect
RegisterClipboardFormatA
UnregisterClassA
PostThreadMessageA
IsWindowUnicode
DefDlgProcA
DrawFocusRect
ExcludeUpdateRgn
ShowCaret
HideCaret
GetActiveWindow
CallNextHookEx
ValidateRect
DispatchMessageA
TranslateMessage
GetMessageA
wsprintfA
CharNextA
MessageBoxA
GetWindowTextA
EnumWindows
GetForegroundWindow
GetAsyncKeyState
GetNextDlgTabItem
GetFocus
PeekMessageA
SetWindowsHookExA
GetParent
PostQuitMessage
GetLastActivePopup
IsWindowEnabled
IsWindow
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
GetCursorInfo
GetCursorPos
SetRect
GetDesktopWindow
GetDC
ReleaseDC
SystemParametersInfoA
DestroyCursor
LoadCursorA
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursorPos
WindowFromPoint
SetCapture
mouse_event
MapVirtualKeyA
GetClientRect
IsIconic
DrawIcon
GetSystemMetrics
SendMessageA
GetSystemMenu
AppendMenuA
EnableWindow
GetKeyState

gdi32

SetMapMode
SetBkMode
GetStockObject
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
SetViewportOrgEx
CreateBitmap
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreateCompatibleDC
GetClipBox
OffsetViewportOrgEx
CreateDIBitmap
GetTextExtentPointA
PatBlt
GetMapMode
LPtoDP
DPtoLP
GetBkColor
GetTextColor
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateSolidBrush
GetWindowExtEx
GetViewportExtEx
GetDeviceCaps
IntersectClipRect
DeleteObject
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
CreateDIBSection

msvfw32

ICSeqCompressFrame
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSeqCompressFrameStart

advapi32

OpenEventLogA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
IsValidSid
LookupAccountNameA
LsaFreeMemory
RegCloseKey
RegQueryValueA
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
GetTokenInformation
LookupAccountSidA
RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
RegDeleteValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
ClearEventLogA
CloseEventLog
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegOpenKeyA

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA

shlwapi

SHDeleteKeyA

winmm

waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutUnprepareHeader
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveOutWrite
waveOutClose
waveInStart
waveInAddBuffer
waveInPrepareHeader

ws2_32

WSAGetLastError
ioctlsocket
gethostname
recvfrom
sendto
listen
accept
getpeername
bind
getsockname
ntohs
inet_addr
__WSAFDIsSet
send
closesocket
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
inet_ntoa
select
recv
WSAStartup

comctl32

ord17

oledlg

ord8

olepro32

ord253

wininet

InternetGetConnectedState

psapi

GetModuleFileNameExA

wtsapi32

WTSQuerySessionInformationA
WTSFreeMemory

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

comdlg32

GetFileTitleA

ole32

CoRevokeClassObject
CoRegisterMessageFilter
OleFlushClipboard
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard

oleaut32

SysAllocStringByteLen
SysAllocString
VariantChangeType
VariantCopy
VariantTimeToSystemTime
VariantClear
SysAllocStringLen
SysFreeString
SysStringLen

Exports

Exports

Feer

Sections

.text
Size: 252KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9848f7e2ffc1217ececdfc5ef5ff74e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

msvfw32

advapi32

shell32

shlwapi

winmm

ws2_32

comctl32

oledlg

olepro32

wininet

psapi

wtsapi32

winspool.drv

comdlg32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 252KB - Virtual size: 251KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 28KB - Virtual size: 47KB

.rsrc Size: 12KB - Virtual size: 10KB

.text
Size: 252KB - Virtual size: 251KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 28KB - Virtual size: 47KB

.rsrc
Size: 12KB - Virtual size: 10KB