Extended Key Usages
ExtKeyUsageCodeSigning
Behavioral task
behavioral1
Sample
ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb.exe
Resource
win10-20240404-en
Target
ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb
Size
297KB
MD5
163ef500479b61b5104a0e8a19088c03
SHA1
a96e6201c8f3cbbc4de6662ae1f2c7c5a01ab39a
SHA256
ca646da23b56221e964caa3f5091747f6f409f8a260a06a4e5f773895973a7eb
SHA512
79f1fcc173c2acf1dd754a515479746e327bb1d7a85b080dbe8fc7d2e8909bf352570efbb0b97e5d2f3812da1f12905fbfb0465110b6537795144606896456c2
SSDEEP
3072:zar2xXibKcf5K67+k02XbFbosspwUUgcdgU6GSzP/ot1PYUlBQU7l4vRv179XXlY:Nibl7+k02XZb9UZU6bzP8yb9XViberXO
Processes:
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
easinvoker.pdb
TraceMessage
RegGetValueW
OpenProcessToken
OpenThreadToken
GetTokenInformation
MakeAbsoluteSD
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
GetLengthSid
CopySid
CreateWellKnownSid
GetSecurityDescriptorDacl
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueW
PrivilegeCheck
CheckTokenMembership
RegSetValueExW
EventUnregister
EventRegister
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
TerminateProcess
LocalAlloc
FreeLibrary
LoadLibraryExW
GetProcAddress
CreateFileW
GetSystemWindowsDirectoryW
HeapAlloc
HeapFree
GetProcessHeap
GetComputerNameExW
LocalFree
CloseHandle
CreateEventW
GetLastError
GetCurrentThread
SetEvent
WaitForSingleObject
GetCurrentProcess
GetVersionExW
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_vsnwprintf
_XcptFilter
_amsg_exit
_wcsnicmp
_wcsicmp
memcpy
_purecall
_wtoi
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
memset
RtlSubAuthorityCountSid
NtOpenProcessToken
RtlCopySid
RtlLengthSid
RtlGetNtProductType
RtlInitUnicodeString
RtlSubAuthoritySid
RtlInitializeSid
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlEqualSid
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtDuplicateToken
NtQueryInformationToken
NtQuerySystemInformation
NtGetCachedSigningLevel
RtlInitializeResource
NtOpenThreadToken
NtClose
CoReleaseServerProcess
CoInitializeSecurity
CoTaskMemFree
CoTaskMemAlloc
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
CoInitializeEx
CoUninitialize
CoAddRefServerProcess
SystemParametersInfoW
UpdatePerUserSystemParameters
RpcBindingCreateW
RpcBindingBind
I_RpcExceptionFilter
RpcSsDestroyClientContext
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
NdrClientCall3
I_RpcMapWin32Status
SamFreeMemory
SamConnect
SamOpenDomain
SamCloseHandle
SamQuerySecurityObject
SamQueryInformationUser
SamOpenUser
SamQueryInformationDomain
WinBioGetLogonSetting
WinBioGetEnabledSetting
WinBioRemoveAllCredentials
WinBioGetDomainLogonSetting
NetUserGetInfo
NetApiBufferFree
AuthzFreeContext
AuthzAccessCheck
AuthzAddSidsToContext
AuthzInitializeContextFromSid
AuthzInitializeResourceManager
AuthzFreeResourceManager
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ