Static task
static1
Behavioral task
behavioral1
Sample
TEF/Kryptex-XEL-Rigel.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
TEF/rigel.exe
Resource
win10v2004-20241007-en
General
-
Target
TEF.rar
-
Size
28.9MB
-
MD5
2be909cd7bfdba6e7ab50b8827aa476e
-
SHA1
82497ac9cba1d574d83bdc695787fc8e625a2b76
-
SHA256
c9b472cf689ace9d1f14aaf9a8ebf6ab137d75cfd2987bd612a20efd70bbb5fe
-
SHA512
c63dbe3ae729a597a2dd89accb7dee6bf3b3f11f5650fbde06513e7ca3545a0c2af973ba8f6ff2f904ebfb6cc1f6059d9b17093aa66d024badc4e9d4703951fb
-
SSDEEP
393216:jh2P8XaOjNol9YltqeuebMSMhceG2+OyDGyjwv+h6n9lwMwRF16m4btzk9To64e2:jhXaORictqedUdEsyN4lCTo6l6Aw/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TEF/rigel.exe
Files
-
TEF.rar.rar
-
TEF/Kryptex-XEL-Rigel.bat
-
TEF/rigel.exe.exe windows:6 windows x64 arch:x64
fd6dd92780a7c14810b795eeda099423
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
WaitForSingleObject
CreateThread
ExitThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreA
CreateWaitableTimerA
GetModuleHandleA
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDriveTypeW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleW
SetFileInformationByHandle
SetFileTime
DuplicateHandle
SetLastError
Sleep
GetSystemTime
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
MoveFileExW
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetStdHandle
GetCommandLineW
FindFirstFileW
GetProcessTimes
GetNativeSystemInfo
FormatMessageA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
CompareStringW
SearchPathW
TerminateProcess
GetExitCodeProcess
CreateProcessW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
EnterCriticalSection
CreateFileA
GetFileAttributesA
SetFilePointerEx
WriteFile
MapViewOfFileEx
CreateFileMappingA
GetTempPathA
GetTempFileNameA
GetTimeFormatW
GetLocaleInfoA
SetConsoleMode
RaiseException
GetCurrentThreadId
HeapCreate
HeapDestroy
SetStdHandle
GetEnvironmentVariableA
SetUnhandledExceptionFilter
RtlCaptureContext
InitializeCriticalSection
GetProcAddress
LoadLibraryW
SetConsoleCtrlHandler
VerifyVersionInfoW
VerSetConditionMask
GetModuleHandleW
IsDebuggerPresent
GetDateFormatW
GetCommandLineA
FreeLibraryAndExitThread
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetModuleHandleExW
SetThreadErrorMode
CreateNamedPipeW
LocalFree
DisconnectNamedPipe
ConnectNamedPipe
WaitNamedPipeW
FormatMessageW
RtlVirtualUnwind
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
FileTimeToSystemTime
GetCurrentThread
GetLastError
SetThreadPriority
GetCurrentProcess
GetConsoleMode
CloseHandle
LocalAlloc
GetACP
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
VirtualQuery
ReadFile
LoadLibraryExW
GetOEMCP
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
RegisterWaitForSingleObject
UnregisterWaitEx
PeekNamedPipe
HeapWalk
HeapValidate
SetEndOfFile
GetConsoleOutputCP
RtlUnwind
RtlUnwindEx
SetHandleInformation
GetCPInfo
GetStringTypeW
CreateIoCompletionPort
CancelIoEx
GetOverlappedResult
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
SetFileCompletionNotificationModes
SetConsoleCursorInfo
SetConsoleCursorPosition
WaitForMultipleObjects
CreateConsoleScreenBuffer
SetConsoleActiveScreenBuffer
CreateSemaphoreW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
WriteConsoleW
ReadConsoleInputW
GetNumberOfConsoleInputEvents
GetFileInformationByHandleEx
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
RtlLookupFunctionEntry
GetEnvironmentStringsW
SetEnvironmentVariableW
FreeLibrary
DecodePointer
WriteFileEx
SleepEx
WakeAllConditionVariable
WakeConditionVariable
HeapFree
EncodePointer
HeapReAlloc
ReleaseMutex
GetProcessHeap
HeapAlloc
DeleteFileW
RemoveDirectoryW
CreateEventW
LCMapStringEx
SleepConditionVariableCS
InitializeConditionVariable
ExitProcess
GetFullPathNameW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
ReadConsoleW
GetSystemTimeAsFileTime
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetExitCodeThread
InitializeCriticalSectionEx
InitializeSRWLock
OutputDebugStringW
IsValidCodePage
InitOnceExecuteOnce
RtlPcToFileHeader
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
GetCurrentProcessId
UnhandledExceptionFilter
ResetEvent
InitializeCriticalSectionAndSpinCount
SetEvent
HeapSize
psapi
GetModuleFileNameExW
EnumProcessModules
GetModuleInformation
ws2_32
WSASend
recv
shutdown
getsockopt
listen
ioctlsocket
connect
bind
WSASocketW
getsockname
accept
getpeername
recvfrom
WSACleanup
WSAStartup
sendto
setsockopt
WSAIoctl
WSAGetLastError
socket
freeaddrinfo
closesocket
getaddrinfo
send
advapi32
IsValidSid
SystemFunction036
CryptAcquireContextW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
AddAce
GetAce
InitializeAcl
GetAclInformation
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExW
InitializeSecurityDescriptor
RegCloseKey
FreeSid
SetSecurityDescriptorControl
GetSecurityDescriptorControl
CryptReleaseContext
CryptGenRandom
crypt32
CertVerifyTimeValidity
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
iphlpapi
GetIpForwardTable
GetAdaptersAddresses
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
user32
GetWindowThreadProcessId
GetForegroundWindow
GetKeyboardLayout
ToUnicodeEx
CharUpperW
bcrypt
BCryptGenRandom
ntdll
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
NtReadFile
NtWriteFile
Sections
.text Size: 34.7MB - Virtual size: 34.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30.2MB - Virtual size: 30.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 247KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ