E:\work\ooooooops\181\knock_v1.1.8\knock\bin64\knock.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
random.dll
Resource
win10v2004-20240802-en
General
-
Target
random.dll.exe
-
Size
155KB
-
MD5
7a799f4f9aa63745a75b901a392aff29
-
SHA1
b9983463f637191ba12c2270ac52a547676a7037
-
SHA256
f4d2c9470b322af29b9188a3a590cbe85bacb9cc8fcd7c2e94d82271ded3f659
-
SHA512
e9eeb340dd620256d543ab43d08ccc23b555afa332c744c629fd8f40760f20a24e234955fc8d2e78a150f09028ca7a11650e0da157fff64833f13ce89a208c23
-
SSDEEP
3072:0lCt2jrijQEjnMUWzsjhVPbuGHUluQj6vkZD4vP5iZWyLr:QCIrijNMv6XPbr0kuNr
Malware Config
Signatures
-
resource yara_rule sample Warmcookie -
Warmcookie family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource random.dll.exe
Files
-
random.dll.exe.dll regsvr32 windows:6 windows x64 arch:x64
4e07c2fd62376d20191892e1e1215fcd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetLastError
SetLastError
ExpandEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileW
DeleteFileW
GetVolumeInformationW
ReadFile
RemoveDirectoryW
SetFilePointer
WriteFile
SetHandleInformation
CreatePipe
PeekNamedPipe
WaitForSingleObject
CreateMutexW
CreateThread
TerminateProcess
CreateProcessW
GlobalMemoryStatusEx
GetTickCount
GetComputerNameExW
GetModuleFileNameW
GetComputerNameW
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
GetTempFileNameW
GetTempPathW
GetSystemDirectoryW
LocalFree
Sleep
CloseHandle
LoadLibraryW
GetProcAddress
GetModuleHandleW
OpenMutexW
RaiseException
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
SetStdHandle
GetSystemInfo
advapi32
SystemFunction036
GetUserNameW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
shell32
SHGetFolderPathW
ole32
CoTaskMemFree
ws2_32
gethostbyname
inet_ntoa
gethostname
WSAStartup
WSACleanup
Exports
Exports
DllGetClassObject
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Start
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ