Static task
static1
Behavioral task
behavioral1
Sample
2024-09-11_2f13024513a1a64d29da82d70e9b370e_ctb-locker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-11_2f13024513a1a64d29da82d70e9b370e_ctb-locker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-11_2f13024513a1a64d29da82d70e9b370e_ctb-locker
-
Size
30KB
-
MD5
2f13024513a1a64d29da82d70e9b370e
-
SHA1
37d149d28b82f36b3709d449bbfc1c28f29475e3
-
SHA256
6d37b6c0e0af6d87533444890fb48cbc8d3580f7ce31555046fc7125fff6263d
-
SHA512
b38cdb0e5e90bcf22e0879f445876e5ef4ec3802b7934dc406c8602471985c13056d71f0d3a86cdc320fd6998e25c2a3603eae2ca7b03115d455780072540405
-
SSDEEP
384:MKe/H84setrFWXVWQl7zBilcsYBIKxqM5fBGSRwQjhloGNSvEBOj8uB:he04so85NQTmp5fBGS/jIGwvEBs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-11_2f13024513a1a64d29da82d70e9b370e_ctb-locker
Files
-
2024-09-11_2f13024513a1a64d29da82d70e9b370e_ctb-locker.exe windows:5 windows x86 arch:x86
032237d350f6b8b702a00f2e14c713ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
nddeapi
NDdeShareGetInfoA
NDdeShareDelA
NDdeShareAddA
NDdeShareEnumA
wtsapi32
WTSVirtualChannelWrite
WTSWaitSystemEvent
WTSVirtualChannelClose
WTSQuerySessionInformationA
WTSSendMessageA
WTSVirtualChannelPurgeInput
WTSEnumerateServersA
WTSFreeMemory
WTSVirtualChannelQuery
WTSUnRegisterSessionNotification
WTSEnumerateProcessesA
kernel32
CreateNamedPipeA
ReadConsoleA
GetProcessHeap
GetProcAddress
GetGeoInfoA
GetStringTypeA
GetProcessId
FormatMessageA
GetConsoleTitleA
SetFilePointer
GetPrivateProfileStructW
WaitForSingleObject
GetFullPathNameA
DeviceIoControl
GetCurrentProcess
FindResourceA
SetCurrentDirectoryW
GetDateFormatA
HeapValidate
ReadFile
GetModuleHandleA
GetTickCount
GetBinaryTypeA
certcli
CACloseCertType
CAEnumFirstCA
CADeleteCA
CAEnumNextCA
shlwapi
UrlIsOpaqueA
UrlEscapeA
UrlHashA
PathCompactPathA
UrlCreateFromPathA
PathCombineA
UrlCombineA
PathCommonPrefixA
UrlGetPartA
UrlIsA
UrlUnescapeA
UrlGetLocationA
UrlCompareA
UrlIsNoHistoryW
advapi32
IsValidSecurityDescriptor
RegDeleteKeyA
InitializeSid
RegOpenKeyExA
IsValidSid
RegEnumKeyA
IsValidAcl
RegSaveKeyA
ControlService
IsTextUnicode
RegFlushKey
CreateServiceA
msimg32
AlphaBlend
GradientFill
modemui
drvCommConfigDialogA
InvokeControlPanel
drvSetDefaultCommConfigA
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ