Behavioral task
behavioral1
Sample
9e203592924a862245d59281f54d0358cf0d08a99ff46a8cd5b4897be4af3b19.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
9e203592924a862245d59281f54d0358cf0d08a99ff46a8cd5b4897be4af3b19.exe
Resource
win11-20240802-en
General
-
Target
9e203592924a862245d59281f54d0358cf0d08a99ff46a8cd5b4897be4af3b19
-
Size
5.5MB
-
MD5
4789293ae5075d0c069865875fe8beb5
-
SHA1
71c98d05b1a148953c1fa33f3e1a1a910c37f8bf
-
SHA256
9e203592924a862245d59281f54d0358cf0d08a99ff46a8cd5b4897be4af3b19
-
SHA512
c223d9388d3dd959b415b33d554eba5795c76b86c364a7b2ad6501810bd93cb0609ee6a6eaaa6f3ab1d0a9165e2acb168f9f1847c521e824ddb68a33e45576c4
-
SSDEEP
98304:DahQDGLmZiWkyuQxiCuFowEMtTPE330SLDAu9mlrfF5aV3un6cp8gC:5DGLRPE3ESgu9mZz3p8
Malware Config
Signatures
Files
-
9e203592924a862245d59281f54d0358cf0d08a99ff46a8cd5b4897be4af3b19.exe windows:6 windows x64 arch:x64
8e939ecec85fd11fdca3f53b01979deb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
ntohs
recv
send
WSASetLastError
htons
WSAGetLastError
select
WSARecvFrom
WSAIoctl
WSASend
gethostname
shutdown
WSASocketW
getpeername
WSARecv
FreeAddrInfoW
GetAddrInfoW
htonl
socket
setsockopt
listen
closesocket
bind
WSACleanup
WSAStartup
getsockopt
getsockname
ioctlsocket
psapi
GetProcessMemoryInfo
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore
kernel32
SetConsoleMode
GetConsoleMode
QueryPerformanceFrequency
QueryPerformanceCounter
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
GetConsoleWindow
GetSystemFirmwareTable
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetSystemPowerStatus
GetCurrentThread
GetProcAddress
GetModuleHandleW
GetTickCount
CloseHandle
FreeConsole
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
GetCurrentThreadId
AddVectoredExceptionHandler
DeviceIoControl
GetModuleFileNameW
CreateFileW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetFileType
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LoadLibraryW
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
PostQueuedCompletionStatus
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
DuplicateHandle
QueueUserWorkItem
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
WriteConsoleInputW
FillConsoleOutputAttribute
GetNumberOfConsoleInputEvents
SetConsoleCursorPosition
CreateDirectoryW
ReadFile
GetFileInformationByHandleEx
GetFileSizeEx
GetDiskFreeSpaceW
RemoveDirectoryW
GetFinalPathNameByHandleW
SetFileTime
DeleteTimerQueueTimer
CreateHardLinkW
SetConsoleTitleA
UnmapViewOfFile
GetFileInformationByHandle
FlushViewOfFile
GetSystemInfo
SetFilePointerEx
CreateFileMappingA
MoveFileExW
CopyFileW
CreateSymbolicLinkW
MapViewOfFile
FlushFileBuffers
SleepConditionVariableCS
TryEnterCriticalSection
ReleaseSemaphore
WakeConditionVariable
InitializeCriticalSection
InitializeConditionVariable
WaitForSingleObject
ResumeThread
SetEvent
GetNativeSystemInfo
CreateSemaphoreA
CreateEventA
SetConsoleCtrlHandler
Sleep
GetLongPathNameW
GetShortPathNameW
GetCurrentDirectoryW
ReadDirectoryChangesW
RtlUnwind
VerifyVersionInfoA
SetEnvironmentVariableW
GetTempPathW
GetVersionExW
FreeEnvironmentStringsW
FileTimeToSystemTime
SetCurrentDirectoryW
VerSetConditionMask
GlobalMemoryStatusEx
GetEnvironmentStringsW
CancelIo
SetHandleInformation
SetFileCompletionNotificationModes
FormatMessageA
LoadLibraryExW
SetErrorMode
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
DebugBreak
GetModuleHandleA
GetStartupInfoW
GetModuleFileNameA
GetVersionExA
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
GetComputerNameA
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ResetEvent
GetStringTypeW
GetLocaleInfoW
CompareStringW
GetStdHandle
WriteConsoleW
GetFileAttributesW
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
GetThreadTimes
FreeLibraryAndExitThread
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetStdHandle
GetCommandLineA
GetCommandLineW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
ExitProcess
GetConsoleCP
GetFileAttributesExW
SetFileAttributesW
ExitThread
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
GetFullPathNameW
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
ReOpenFile
CreateIoCompletionPort
CreateEventW
GetCPInfo
WaitForSingleObjectEx
GetExitCodeThread
EncodePointer
DecodePointer
user32
GetProcessWindowStation
ShowWindow
GetLastInputInfo
GetUserObjectInformationW
GetSystemMetrics
GetMessageA
MapVirtualKeyW
DispatchMessageA
TranslateMessage
MessageBoxW
shell32
SHGetSpecialFolderPathA
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
advapi32
GetUserNameW
CryptAcquireContextA
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
bcrypt
BCryptGenRandom
Sections
.text Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 70KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ