SerEnum.pdb
Static task
static1
Behavioral task
behavioral1
Sample
serenum.sys
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
serenum.sys
Resource
win10v2004-20240802-en
General
-
Target
98d3c9af54f5047ffcbd786008ac366126f84f6c535eb7479293ba6a37ef57b5N
-
Size
8KB
-
MD5
8a882ebf5b91af60e0745eaf4c0c9550
-
SHA1
4c750753197fddcaede8079e5df66f40e01177bb
-
SHA256
98d3c9af54f5047ffcbd786008ac366126f84f6c535eb7479293ba6a37ef57b5
-
SHA512
8711563e3f0c5e7358f6655c3827918e5285996cf8abd36bb8bb4dd6021ad6b2af08007e2de6ea28b77821d1fe52bd7c789090e35e75299dd011075f8e1e477e
-
SSDEEP
192:VNi6YqOcFtT0tbf0R+g8cFTxJ4QI3ucWjjQtyq8zogE8Zgv8UL3WGhu:VNP7tTQbsR+gbFcOjQ0z+vZ3Wj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/serenum.sys
Files
-
98d3c9af54f5047ffcbd786008ac366126f84f6c535eb7479293ba6a37ef57b5N.cab
-
serenum.sys.sys windows:5 windows x86 arch:x86
37e7fe8ddbadf04100501dd3f56fec5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoDeleteDevice
IoDetachDevice
IoRegisterDeviceInterface
KeInitializeSpinLock
KeInitializeSemaphore
KeInitializeEvent
IoAttachDeviceToDeviceStack
IoCreateDevice
IoFreeIrp
IoAllocateIrp
RtlFreeUnicodeString
ObfReferenceObject
ExFreePoolWithTag
RtlQueryRegistryValues
ExAllocatePoolWithTag
KeWaitForSingleObject
IofCallDriver
IofCompleteRequest
ZwSetValueKey
RtlAppendUnicodeToString
RtlInitUnicodeString
KeSetTimer
KeSetEvent
ZwQueryValueKey
ObfDereferenceObject
IoSetDeviceInterfaceState
KeClearEvent
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
KeInitializeTimer
RtlEqualUnicodeString
KeReleaseSemaphore
PsTerminateSystemThread
IoQueueWorkItem
IoInvalidateDeviceRelations
KeSetPriorityThread
KeGetCurrentThread
ObReferenceObjectByHandle
PsCreateSystemThread
IoAllocateWorkItem
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
NlsMbCodePageTag
RtlInitAnsiString
_stricmp
PoStartNextPowerIrp
PoSetPowerState
PoCallDriver
KeTickCount
KeBugCheckEx
IoOpenDeviceRegistryKey
IoFreeWorkItem
ZwClose
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESENM Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ