SvcEntry_Seclogon
Static task
static1
Behavioral task
behavioral1
Sample
seclog.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
seclog.dll
Resource
win10v2004-20240802-en
General
-
Target
seclog.dll.exe
-
Size
329KB
-
MD5
9415ebad2f820d47c79271fe8c76f58d
-
SHA1
98397c3d645a4bfac3eafb7f574455f671878f5f
-
SHA256
3e25798da0232d9039e570fb34d4bdccf7f082fa38b486a097d954f5f3debab3
-
SHA512
fb48728ceddd6c1659cb1fe3174657e3416724b14ab584f0d2881dcbdf48edcc4b3f5bd04fa3fb028950381902fa128d99e75e537e333385b3c45b6239baf04c
-
SSDEEP
6144:teRLjiLhc3+4aBtT40pj2acZJcTSUJuMLxKIcloQUNX8X/5:ujiLwDaBtT4ej2aMJMKrloJS/5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource seclog.dll.exe
Files
-
seclog.dll.exe.dll windows:5 windows x64 arch:x64
87b0297c62b17c6a7c05259be295a332
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyW
lstrcatW
lstrlenA
lstrlenW
GetModuleFileNameW
CreateProcessW
GetStartupInfoW
GetDriveTypeW
GetSystemDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
GetVolumeInformationW
GetVersionExA
GetACP
GetOEMCP
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
lstrcpynW
Module32NextW
lstrcmpiW
FreeLibrary
GetProcAddress
LocalAlloc
LocalFree
CreateThread
SetFileTime
lstrcpynA
LoadLibraryW
GetModuleHandleW
GetTempFileNameW
MoveFileExW
GetTickCount
TerminateThread
lstrcpyA
CreateMutexW
OpenMutexW
SetEvent
WaitForSingleObject
CreateEventW
lstrcmpW
PeekNamedPipe
CreatePipe
GetNativeSystemInfo
CloseHandle
FindClose
SetFilePointer
ReadFile
WriteFile
GetFileSize
GetLogicalDrives
Sleep
GetLastError
TerminateProcess
GetCurrentProcess
Module32FirstW
OpenProcess
InitializeCriticalSection
QueryPerformanceFrequency
RaiseException
FlushFileBuffers
LCMapStringW
HeapSize
OutputDebugStringW
GetStringTypeW
WriteConsoleW
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
GetCPInfo
LoadLibraryExW
HeapAlloc
HeapReAlloc
SetStdHandle
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptGenRandom
SetServiceStatus
RegisterServiceCtrlHandlerW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
CryptReleaseContext
shell32
SHGetFileInfoW
ws2_32
shutdown
socket
htons
connect
closesocket
gethostname
gethostbyname
WSAGetLastError
WSAStartup
send
recv
setsockopt
inet_addr
shlwapi
StrToIntW
PathFindFileNameW
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathRenameExtensionW
Exports
Exports
Sections
.text Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ