Overview
overview
10Static
static
3ScreamSploit X.exe
windows11-21h2-x64
10$TEMP/Airline
windows11-21h2-x64
1$TEMP/Antigua
windows11-21h2-x64
1$TEMP/Antivirus
windows11-21h2-x64
1$TEMP/Asin
windows11-21h2-x64
1$TEMP/Bare
windows11-21h2-x64
1$TEMP/Bee
windows11-21h2-x64
1$TEMP/Content
windows11-21h2-x64
1$TEMP/Coordinator
windows11-21h2-x64
1$TEMP/Definitions
windows11-21h2-x64
1$TEMP/Determines
windows11-21h2-x64
1$TEMP/Digital
windows11-21h2-x64
1$TEMP/Dim
windows11-21h2-x64
1$TEMP/Documents
windows11-21h2-x64
1$TEMP/Efficient
windows11-21h2-x64
1$TEMP/Exhibits
windows11-21h2-x64
1$TEMP/Fellow
windows11-21h2-x64
1$TEMP/Fiction
windows11-21h2-x64
1$TEMP/Geometry
windows11-21h2-x64
1$TEMP/Gifts
windows11-21h2-x64
1$TEMP/Guard
windows11-21h2-x64
1$TEMP/Income
windows11-21h2-x64
1$TEMP/Matched
windows11-21h2-x64
1$TEMP/Metallica
windows11-21h2-x64
1$TEMP/Mighty
windows11-21h2-x64
1$TEMP/Nhl
windows11-21h2-x64
1$TEMP/Pet
windows11-21h2-x64
1$TEMP/Picnic
windows11-21h2-x64
1$TEMP/Ps
windows11-21h2-x64
1$TEMP/Reliability
windows11-21h2-x64
1$TEMP/Sci
windows11-21h2-x64
1$TEMP/See
windows11-21h2-x64
1Static task
static1
Behavioral task
behavioral1
Sample
ScreamSploit X.exe
Resource
win11-20240709-en
Behavioral task
behavioral2
Sample
$TEMP/Airline
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
$TEMP/Antigua
Resource
win11-20240709-en
Behavioral task
behavioral4
Sample
$TEMP/Antivirus
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
$TEMP/Asin
Resource
win11-20240709-en
Behavioral task
behavioral6
Sample
$TEMP/Bare
Resource
win11-20240709-en
Behavioral task
behavioral7
Sample
$TEMP/Bee
Resource
win11-20240709-en
Behavioral task
behavioral8
Sample
$TEMP/Content
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
$TEMP/Coordinator
Resource
win11-20240709-en
Behavioral task
behavioral10
Sample
$TEMP/Definitions
Resource
win11-20240709-en
Behavioral task
behavioral11
Sample
$TEMP/Determines
Resource
win11-20240709-en
Behavioral task
behavioral12
Sample
$TEMP/Digital
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
$TEMP/Dim
Resource
win11-20240709-en
Behavioral task
behavioral14
Sample
$TEMP/Documents
Resource
win11-20240709-en
Behavioral task
behavioral15
Sample
$TEMP/Efficient
Resource
win11-20240709-en
Behavioral task
behavioral16
Sample
$TEMP/Exhibits
Resource
win11-20240709-en
Behavioral task
behavioral17
Sample
$TEMP/Fellow
Resource
win11-20240709-en
Behavioral task
behavioral18
Sample
$TEMP/Fiction
Resource
win11-20240709-en
Behavioral task
behavioral19
Sample
$TEMP/Geometry
Resource
win11-20240709-en
Behavioral task
behavioral20
Sample
$TEMP/Gifts
Resource
win11-20240709-en
Behavioral task
behavioral21
Sample
$TEMP/Guard
Resource
win11-20240709-en
Behavioral task
behavioral22
Sample
$TEMP/Income
Resource
win11-20240709-en
Behavioral task
behavioral23
Sample
$TEMP/Matched
Resource
win11-20240709-en
Behavioral task
behavioral24
Sample
$TEMP/Metallica
Resource
win11-20240709-en
Behavioral task
behavioral25
Sample
$TEMP/Mighty
Resource
win11-20240709-en
Behavioral task
behavioral26
Sample
$TEMP/Nhl
Resource
win11-20240709-en
Behavioral task
behavioral27
Sample
$TEMP/Pet
Resource
win11-20240709-en
Behavioral task
behavioral28
Sample
$TEMP/Picnic
Resource
win11-20240709-en
Behavioral task
behavioral29
Sample
$TEMP/Ps
Resource
win11-20240709-en
Behavioral task
behavioral30
Sample
$TEMP/Reliability
Resource
win11-20240709-en
Behavioral task
behavioral31
Sample
$TEMP/Sci
Resource
win11-20240709-en
Behavioral task
behavioral32
Sample
$TEMP/See
Resource
win11-20240709-en
General
-
Target
ScreamSploit X.exe
-
Size
250.0MB
-
MD5
b24b26ad34fbf9defbef7e7df1cea33b
-
SHA1
ac99a2921b0a82a8a75055f00a965a9f56cbaba5
-
SHA256
d7d2c066d2bded83a43b25111bcd2cae2226aa39ed67a0aab9a4c60b66fdb952
-
SHA512
9dfda7db10a2755bddd68beecd30b439707415a4cae0df4e7ea81b6db247ce0a19671962500e85e34193db176ecc42afb77e3ae8481db5e1a8134736b3096908
-
SSDEEP
24576:kjPYQlc12qkyS80bPBUM7f1B0H2aKbro2cn0RIdyHQ13cw7:yYQlu2qa9PBUM7f1weoDwQy8Mi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ScreamSploit X.exe
Files
-
ScreamSploit X.exe.exe windows:5 windows x86 arch:x86
be41bf7b8cc010b614bd36bbca606973
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW
user32
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 458KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 516KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$TEMP/Airline
-
$TEMP/Antigua
-
$TEMP/Antivirus
-
$TEMP/Asin
-
$TEMP/Bare
-
$TEMP/Bee
-
$TEMP/Content
-
$TEMP/Coordinator
-
$TEMP/Definitions
-
$TEMP/Determines
-
$TEMP/Digital
-
$TEMP/Dim
-
$TEMP/Documents
-
$TEMP/Efficient
-
$TEMP/Exhibits
-
$TEMP/Fellow
-
$TEMP/Fiction
-
$TEMP/Geometry
-
$TEMP/Gifts
-
$TEMP/Guard
-
$TEMP/Income
-
$TEMP/Matched
-
$TEMP/Metallica
-
$TEMP/Mighty
-
$TEMP/Nhl
-
$TEMP/Pet
-
$TEMP/Picnic
-
$TEMP/Ps
-
$TEMP/Reliability
-
$TEMP/Sci
-
$TEMP/See
-
$TEMP/Slave
-
$TEMP/Ti
-
$TEMP/Video
-
$TEMP/Watch
-
$TEMP/Witnesses