Static task
static1
Behavioral task
behavioral1
Sample
Dialupass.chm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Dialupass.chm
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Dialupass.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Dialupass.exe
Resource
win10v2004-20240508-en
General
-
Target
dialupass.zip
-
Size
49KB
-
MD5
7c867c6b4fce0eb6b06190f333ff1086
-
SHA1
377ca5f766fb4a878466e9c6f6270502bf7bf2b7
-
SHA256
a79c79fa0ef5d6e95424ecc92af8c6c2719f4a8275fe7825dffb071bec2b1305
-
SHA512
d36637c68deae92b20bd007c19e5abfd690d68cb0901690eda0fcd8e93b699ac0d383c80abf65e9c5f2ea798d7a2dca1a78050a6f5f6da3ee00a5c45b77df261
-
SSDEEP
768:kbTCl8dtR7ht3/cNxl0byS7baVfCoWDdmvMe8St66VpckiHOmGa4b16XR/PF:DEht3/kabyKMBamkhDkiX9BHF
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule static1/unpack001/Dialupass.exe Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Dialupass.exe
Files
-
dialupass.zip.zip
Password: nsdlps3861@
-
Dialupass.chm.chm
-
Dialupass.exe.exe windows:4 windows x86 arch:x86
Password: nsdlps3861@
f622e3194077ba7d6db912c85cb8d55a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
__p__fmode
_onexit
__dllonexit
_wcslwr
_purecall
_itow
wcstoul
_memicmp
wcsrchr
malloc
__set_app_type
_controlfp
_except_handler3
_c_exit
free
modf
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcsnicmp
_wtoi
memcmp
wcschr
memcpy
strlen
abs
_wcsicmp
wcslen
wcscmp
log
wcscpy
memset
wcscat
_snwprintf
wcsncat
comctl32
ImageList_SetImageCount
ImageList_ReplaceIcon
ord17
ImageList_Create
ImageList_AddMasked
CreateToolbarEx
CreateStatusWindowW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
rasapi32
RasSetCredentialsW
kernel32
ReadProcessMemory
GetCurrentProcess
ExitProcess
GetCurrentProcessId
DeleteFileW
SetErrorMode
GetPrivateProfileStringW
EnumResourceNamesW
GetPrivateProfileIntW
WritePrivateProfileStringW
GlobalUnlock
GlobalAlloc
lstrlenW
OpenProcess
EnumResourceTypesW
GetModuleHandleA
GetStartupInfoW
WideCharToMultiByte
CreateFileW
GetModuleFileNameW
lstrcpyW
WriteFile
LoadLibraryW
GetProcAddress
FreeLibrary
GetFileSize
CloseHandle
MultiByteToWideChar
FindResourceW
GetTempPathW
LoadResource
LoadLibraryExW
GetLastError
FindNextFileW
SizeofResource
FormatMessageW
FindClose
GlobalLock
GetVersionExW
GetWindowsDirectoryW
GetFileAttributesW
GetTempFileNameW
GetModuleHandleW
LocalFree
LockResource
FindFirstFileW
ReadFile
user32
PostQuitMessage
GetMessageW
TrackPopupMenu
RegisterWindowMessageW
DispatchMessageW
DrawTextExW
TranslateMessage
IsDialogMessageW
SetWindowPos
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
LoadStringW
EndDialog
EndPaint
GetDlgItem
InvalidateRect
GetWindow
SetDlgItemInt
DrawFrameControl
BeginPaint
SetWindowTextW
GetClientRect
UpdateWindow
SetDlgItemTextW
GetDlgItemTextW
GetSystemMetrics
DeferWindowPos
CreateWindowExW
GetWindowRect
GetDlgItemInt
SetMenu
GetWindowPlacement
LoadAcceleratorsW
PostMessageW
DefWindowProcW
TranslateAcceleratorW
SendMessageW
SetWindowPlacement
RegisterClassW
MessageBoxW
LoadImageW
LoadIconW
SetWindowLongW
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
OpenClipboard
GetMenuStringW
CloseClipboard
MoveWindow
GetMenuItemCount
CheckMenuItem
GetCursorPos
GetSysColor
GetSubMenu
GetMenu
SetClipboardData
EnableWindow
MapWindowPoints
GetDC
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
GetParent
DestroyMenu
DialogBoxParamW
CreateDialogParamW
DestroyWindow
EnumChildWindows
SendDlgItemMessageW
gdi32
DeleteObject
GetStockObject
GetTextExtentPoint32W
SetBkColor
SelectObject
GetDeviceCaps
SetTextColor
CreateFontIndirectW
SetBkMode
comdlg32
FindTextW
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
shell32
SHGetPathFromIDListW
SHGetMalloc
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
ole32
CoUninitialize
CoInitialize
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
readme.txt