Static task
static1
Behavioral task
behavioral1
Sample
RedGiantApplicationManager.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RedGiantApplicationManager.exe
Resource
win10v2004-20241007-en
General
-
Target
RedGiantApplicationManager.exe
-
Size
2.0MB
-
MD5
43783c857a5bcd2b543747adab40540a
-
SHA1
24284a586ece7f8f979fd369fee04a5e2acf53db
-
SHA256
969e103cc7d2eaa449c666b2d1f1b7568ab09811f068a225eb901b0445ba1778
-
SHA512
499f6bcc9920027297ebedb778dc895215fb73735f3f743d91c9221a70dbe75999d3472d8cbe3e3aedb8f02776892e29cc0a20059246de5ac9f0daa866627d9f
-
SSDEEP
24576:Sn39jItf8PeoyGXF6X57Q4IeepeIzJ7KSGOfEIOwBrAklqxTK93NZnCb/jjC2nUD:Sn3Zhka9EIxLOT+3jnG/3C2nfmJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RedGiantApplicationManager.exe
Files
-
RedGiantApplicationManager.exe.exe windows:6 windows x64 arch:x64
1b9858fab14608ccfa767611930551fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
crypt32
CryptBinaryToStringA
CryptDecodeObjectEx
CryptStringToBinaryA
CertFreeCertificateContext
CryptImportPublicKeyInfo
msvcp110
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_BADOFF@std@@3_JB
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
??0?$codecvt@_WDH@std@@QEAA@_K@Z
?_Getcat@?$codecvt@_WDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??_7codecvt_base@std@@6B@
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??_7?$codecvt@_WDH@std@@6B@
?in@?$codecvt@_WDH@std@@QEBAHAEAHPEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDH@std@@QEBAHAEAHPEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?endl@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@1@AEAV21@@Z
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z
?_Orphan_all@_Container_base0@std@@QEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UEAAXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?_Orphan_all@_Container_base12@std@@QEAAXXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?classic@locale@std@@SAAEBV12@XZ
??_7facet@locale@std@@6B@
??_7_Facet_base@std@@6B@
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
msvcr110
_access
_read
_write
_close
_open
__RTDynamicCast
__crtSetUnhandledExceptionFilter
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
_vsnprintf
_onexit
__C_specific_handler
__dllonexit
_calloc_crt
_unlock
_lock
fseek
ftell
ferror
_ftelli64
strtoul
_mktime64
__iob_func
_beginthreadex
strtol
??0exception@std@@QEAA@AEBQEBDH@Z
_localtime64_s
strftime
strncpy_s
towlower
_localtime64
atol
__CxxFrameHandler3
_CxxThrowException
_snprintf
exit
memcmp
memcpy
??8type_info@@QEBA_NAEBV0@@Z
??4exception@std@@QEAAAEAV01@AEBV01@@Z
??_V@YAXPEAX@Z
?terminate@@YAXXZ
strncpy
tolower
_getpid
_snwprintf
isspace
sprintf
_finite
localeconv
atoi
malloc
free
_vsnprintf_s
modf
isupper
_fstat64
_lseeki64
_mbspbrk
__sys_nerr
_strtoi64
strpbrk
strstr
_mbsnbcpy
_mbschr
_stat64
_errno
qsort
strrchr
strchr
sscanf
realloc
calloc
memset
strerror
_stricmp
_strdup
strncmp
??0exception@std@@QEAA@XZ
strtod
_time64
fclose
getenv
fwrite
memcpy_s
rand
clock
fread
_lock_file
setvbuf
_mkdir
fopen
fsetpos
fgetc
fflush
memchr
_fseeki64
fgetpos
ungetc
_unlock_file
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBQEBD@Z
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
??0bad_cast@std@@QEAA@AEBV01@@Z
??0bad_cast@std@@QEAA@PEBD@Z
??1bad_cast@std@@UEAA@XZ
fputc
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_purecall
memmove
_gmtime64
ceil
bcrypt
BCryptGetProperty
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDestroyKey
rpcrt4
RpcStringFreeW
UuidToStringW
RpcStringFreeA
UuidCreate
UuidToStringA
secur32
GetUserNameExA
kernel32
CreateWaitableTimerA
PeekNamedPipe
GetFileType
GetStdHandle
VerifyVersionInfoA
GetSystemDirectoryA
VerSetConditionMask
FormatMessageA
LocalFree
AreFileApisANSI
MoveFileExW
CopyFileW
GetModuleHandleA
GetTempPathW
RemoveDirectoryW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
DeleteFileW
CreateDirectoryW
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
FindClose
FindFirstFileA
FileTimeToDosDateTime
GetSystemInfo
GetVersionExW
GlobalMemoryStatusEx
FileTimeToSystemTime
FileTimeToLocalFileTime
WideCharToMultiByte
CreateWaitableTimerW
SleepEx
GetTickCount
GetSystemTimeAsFileTime
TlsGetValue
TlsSetValue
SetWaitableTimer
GetQueuedCompletionStatus
TerminateThread
SystemTimeToFileTime
InitializeCriticalSectionAndSpinCount
CreateIoCompletionPort
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
WaitForMultipleObjects
CreateNamedPipeW
CreateEventW
TlsFree
TlsAlloc
PostQueuedCompletionStatus
InitializeCriticalSectionEx
SetEvent
SetLastError
GetCurrentThreadId
CreateProcessW
GetModuleHandleW
GetModuleFileNameW
GetFileTime
CreateFileW
DeviceIoControl
SetFileAttributesW
GetFileAttributesW
CreateEventA
GetCurrentThread
GetThreadId
K32GetModuleFileNameExA
K32EnumProcessModules
K32EnumProcesses
OpenProcess
LoadLibraryExA
RaiseException
CreateMutexA
GetModuleFileNameA
GetCommandLineA
ExpandEnvironmentStringsA
SetDllDirectoryW
SleepConditionVariableCS
LoadLibraryA
FreeLibrary
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetCurrentProcessId
GetEnvironmentVariableA
GetExitCodeProcess
WaitForSingleObject
QueryPerformanceCounter
DeleteCriticalSection
SetCurrentDirectoryW
EnterCriticalSection
GetProcAddress
LeaveCriticalSection
GetFileAttributesA
LoadLibraryW
InitializeCriticalSection
CloseHandle
SetNamedPipeHandleState
GetLastError
ReadFile
Sleep
WriteFile
GetProcessHeap
HeapFree
WaitNamedPipeA
HeapAlloc
CreateFileA
MultiByteToWideChar
OpenEventA
ReleaseSemaphore
ResetEvent
GetTickCount64
QueueUserAPC
ResumeThread
WaitForSingleObjectEx
user32
PostMessageW
GetWindowPlacement
GetMessageW
ShowWindow
CreateWindowExW
RegisterWindowMessageW
RegisterClassExW
GetWindowLongPtrW
SetWindowLongPtrW
SetProcessDPIAware
DialogBoxParamW
LoadAcceleratorsW
LoadIconW
MessageBoxA
EndDialog
MessageBoxW
SendMessageW
DefWindowProcW
SetForegroundWindow
TranslateMessage
DispatchMessageW
PostThreadMessageW
advapi32
RegCreateKeyExA
CryptGetHashParam
CryptGenRandom
CryptAcquireContextA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeyValueA
RegCloseKey
GetTokenInformation
OpenProcessToken
GetUserNameA
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptReleaseContext
CryptVerifySignatureW
CryptAcquireContextW
RegOpenKeyExA
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
shell32
ShellExecuteA
SHGetFolderPathW
SHGetFolderPathA
ShellExecuteW
ShellExecuteExW
netapi32
NetWkstaGetInfo
NetApiBufferFree
ws2_32
sendto
accept
listen
ioctlsocket
gethostname
htonl
ntohl
WSACleanup
WSAStartup
recvfrom
inet_pton
WSAGetLastError
socket
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
getaddrinfo
freeaddrinfo
wldap32
ord45
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord143
ord46
ord211
ord60
ord50
ord41
ord22
Sections
.text Size: 1002KB - Virtual size: 1001KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 388KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shr Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 537KB - Virtual size: 536KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ