mgrdpK4Z[.]7z | Triage

Resubmissions

28/08/2024, 22:55

240828-2wbh1s1bjb 8

28/08/2024, 22:53

240828-2vffksserj 3

28/08/2024, 22:40

240828-2llk8szflg 3

Sharing

Copy URL

Twitter E-mail

General

Target

mgrdpK4Z.7z
Size

610KB
MD5

e02b14a97e8cd68428dfd25b2ac94480
SHA1

23cbc639492a85d152d709ee1d60078f0fcc2445
SHA256

f4f55411bf4350b3bdaeb5261a4b3218a5f8629484734b33d09357b5ced734d2
SHA512

4bef052ba00224074ecac17b884850813299936008dd11dd5893da7c24b0df08ef35ac06095d1c384a29d496d657a0e9587961c2df835398848e829a3fd68e80
SSDEEP

12288:SRD/+g3xmUi6mafbToo6ppDVNdsron0djR8j8f96Ulcr872vlUwovrz8RKnMg9Xt:SRP3YUiKffQyH84L0U5zzYKnl98O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/northedldr.exe

Files

mgrdpK4Z.7z
.7z
northedldr.exe
.exe windows:6 windows x64 arch:x64

983eb7d01c76e818cb327b536b2567ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

getaddrinfo
send
recv
WSASetLastError
WSAStartup
WSARecvFrom
WSARecv
socket
freeaddrinfo
connect
htons
WSASocketW
WSAIoctl
select
ioctlsocket
WSAGetLastError
setsockopt
getsockopt
closesocket
htonl
inet_pton
ntohl
shutdown

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtMapViewOfSection
NtUnmapViewOfSection
NtClose
NtCreateSection
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind

dwmapi

DwmExtendFrameIntoClientArea

kernel32

FreeLibrary
QueryPerformanceCounter
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetSystemFirmwareTable
VirtualProtect
VirtualFree
VirtualAlloc
lstrcpyA
CloseHandle
GetLastError
SetErrorMode
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetHandleInformation
CreateEventA
QueueUserWorkItem
DebugBreak
LocalFree
FormatMessageA
GetFileType
GetConsoleMode
DuplicateHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WakeAllConditionVariable
SetEvent
ReleaseSemaphore
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreA
CancelIoEx
CancelIo
SwitchToThread
RegisterWaitForSingleObject
UnregisterWait
CreateFileA
CreateFileW
FlushFileBuffers
ReadFile
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
CancelSynchronousIo
GetCurrentProcessId
GetNamedPipeHandleStateA
ResetEvent
Sleep
GetNumberOfConsoleInputEvents
ReadConsoleInputW
ReadConsoleW
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
WriteConsoleInputW
SetConsoleCtrlHandler
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
GetProcAddress
LCMapStringW
FindClose
FindNextFileW
GetFileSizeEx
SetFilePointerEx
SetLastError
GetSystemInfo
GetSystemTimeAsFileTime
GetLongPathNameW
ReadDirectoryChangesW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryExA
GetStdHandle
GetStartupInfoW
MoveFileExA
ExitThread
CreateThread
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
RaiseException
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetExitCodeThread
WaitForSingleObjectEx
AreFileApisANSI
FindFirstFileExW
GetLocaleInfoEx
InitializeSListHead
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
SetStdHandle
GetConsoleOutputCP
ExitProcess
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
GetModuleHandleA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
DeleteFileW
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
GetLocaleInfoW
GetProcessHeap
SetEndOfFile
FreeLibraryAndExitThread
FlsGetValue
FlsSetValue
FlsFree

user32

SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetMessageExtraInfo
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
UpdateWindow
PostQuitMessage
PeekMessageA
TranslateMessage
DefWindowProcA
MessageBoxA
ShowWindow
RegisterClassExW
GetWindowRect
UnregisterClassW
MapVirtualKeyW
GetMessageA
DefWindowProcW
DispatchMessageA
GetCursorPos
DestroyWindow
SetWindowPos
PostMessageA
CreateWindowExW
GetSystemMetrics

shell32

ShellExecuteA

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow

bcrypt

BCryptGenRandom

Sections

.text
Size: 945KB - Virtual size: 944KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 371KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

983eb7d01c76e818cb327b536b2567ec

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

d3d9

d3dx9_43

ntdll

dwmapi

kernel32

user32

shell32

imm32

bcrypt

Sections

.text Size: 945KB - Virtual size: 944KB

.rdata Size: 371KB - Virtual size: 371KB

.data Size: 11KB - Virtual size: 2.6MB

.pdata Size: 38KB - Virtual size: 37KB

_RDATA Size: 9KB - Virtual size: 8KB

.rsrc Size: 127KB - Virtual size: 126KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 945KB - Virtual size: 944KB

.rdata
Size: 371KB - Virtual size: 371KB

.data
Size: 11KB - Virtual size: 2.6MB

.pdata
Size: 38KB - Virtual size: 37KB

_RDATA
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 127KB - Virtual size: 126KB

.reloc
Size: 6KB - Virtual size: 6KB