FW1CreateFactory
_FW1CreateFactory@8
Behavioral task
behavioral1
Sample
uwp.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
uwp.dll
Resource
win10v2004-20241007-en
Target
uwp.dll
Size
4.2MB
MD5
b0f566fc20de341e2848a489f69a4e48
SHA1
7a81ab4c68ddeb1e0a83c37e17286ae53e29c334
SHA256
5223f453b44be5d13f5f249f1f23b020b75c7e237c23712d97813c430015afc6
SHA512
4ba8394bede49de1dd1ad98afa59e0546b5118cf6b75dcf2cc83f00fde88bda0d659944c3324d19960d935d9e29e69f8b9b08fa5d5db7f71506e13471bbcb75f
SSDEEP
49152:LikvPpFjV8b8bhnNcZXGDQc6jg8mHdnYvLyv5ttr24Y4AxYWAF7yWGxmR/qSDQey:0ZXGU7k8Ol5/24PqNmOQ
resource | yara_rule |
---|---|
sample | redtigerv122 |
sample | redtigerv22 |
sample | redtiger_stealer_detection |
sample | redtiger_stealer_detection_v2 |
sample | staticSred |
sample | staticred |
sample | redtiger_stealer_detection_v1 |
Detects behavior indicative of Luna Grabber malware
resource | yara_rule |
---|---|
sample | LunaGrabber |
Checks for missing Authenticode signature.
resource |
---|
uwp.dll |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RemoveDirectoryW
WriteFile
GetTempPathW
CloseHandle
GetCurrentProcess
GetCurrentProcessId
VirtualAlloc
VirtualFree
GetModuleHandleA
GetModuleHandleW
lstrcpyW
lstrcatW
K32EnumProcessModules
K32GetModuleFileNameExW
VirtualAllocEx
VirtualProtectEx
WriteProcessMemory
LoadLibraryA
LocalAlloc
LocalFree
GetSystemTimeAsFileTime
OutputDebugStringW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesW
SetEvent
WaitForSingleObjectEx
CreateEventW
FormatMessageW
GetProcessHeaps
HeapLock
HeapUnlock
HeapWalk
GetConsoleWindow
SetPriorityClass
GetConsoleMode
FindClose
FindFirstFileA
FindNextFileA
InitializeSListHead
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
ResetEvent
InitializeCriticalSectionAndSpinCount
TerminateProcess
ReadFile
DeleteFileW
CreateFileW
QueryPerformanceFrequency
FreeLibrary
LoadLibraryW
GetProcAddress
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
lstrlenA
VirtualProtect
Sleep
QueryPerformanceCounter
VirtualQuery
GlobalFree
GlobalLock
CreateDirectoryW
GlobalUnlock
GlobalAlloc
SetThreadPriority
GetSystemInfo
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
GetWindowLongW
GetClientRect
SetCursorPos
GetKeyState
GetCursorPos
ClientToScreen
ScreenToClient
LoadCursorW
GetWindowTextA
GetWindowTextLengthA
GetWindowThreadProcessId
ShowWindow
SetCursor
GetClipboardData
SetRect
IsChild
OpenClipboard
FillRect
GetMonitorInfoW
MonitorFromWindow
FindWindowA
CloseClipboard
SetClipboardData
EmptyClipboard
DefWindowProcW
CallWindowProcW
GetWindowRect
SetWindowLongW
GetCurrentObject
CreateSolidBrush
GetObjectW
DeleteObject
CheckTokenMembership
GetSidSubAuthority
FreeSid
GetUserNameW
GetCurrentHwProfileW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
AllocateAndInitializeSid
DuplicateToken
CreateWellKnownSid
GetTokenInformation
_Query_perf_frequency
_Query_perf_counter
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Xtime_get_ticks
??Bid@locale@std@@QAEIXZ
D3DCompile
D3D11CreateDeviceAndSwapChain
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
ord2
ord4
URLOpenBlockingStreamA
gethostname
WSAIoctl
__WSAFDIsSet
setsockopt
listen
select
shutdown
closesocket
sendto
recvfrom
inet_ntoa
getsockopt
getsockname
ioctlsocket
bind
ntohs
htonl
getaddrinfo
WSACleanup
WSAStartup
gethostbyname
gethostbyaddr
socket
send
recv
inet_addr
accept
connect
htons
__std_type_info_destroy_list
_except_handler4_common
__current_exception_context
__current_exception
strrchr
_except_handler3
strchr
strstr
_purecall
memset
memchr
memmove
memcpy
memcmp
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
terminate
_beginthreadex
abort
strerror
_invalid_parameter_noinfo_noreturn
signal
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_initterm_e
_register_onexit_function
_initterm
_execute_onexit_table
_crt_atexit
exit
_errno
_cexit
perror
iscntrl
isgraph
ispunct
isxdigit
isdigit
_strdup
islower
isupper
isalpha
tolower
_wcsicmp
isalnum
strncpy
strcspn
strncat
strcat_s
strnlen
toupper
isspace
strncmp
_strnicmp
_stricmp
strpbrk
_strtoui64
atol
strtoull
mbstowcs
strtod
atoi
atof
strtoul
_libm_sse2_tan_precise
_libm_sse2_pow_precise
_CIatan2
_libm_sse2_sqrt_precise
_libm_sse2_log_precise
_libm_sse2_log10_precise
_libm_sse2_exp_precise
_libm_sse2_sin_precise
_libm_sse2_atan_precise
_libm_sse2_asin_precise
_libm_sse2_cos_precise
_CItanh
_CIsinh
_CIcosh
round
log2
_dsign
_CIfmod
frexp
modf
ldexp
floor
_fdopen
ceil
_libm_sse2_acos_precise
fputc
feof
fclose
__stdio_common_vsprintf_s
__stdio_common_vswprintf
fopen
fgets
fread
fseek
ftell
getchar
fwrite
ferror
_wfopen
setvbuf
_ftelli64
_fseeki64
__acrt_iob_func
__stdio_common_vsprintf
_setmode
fflush
_fileno
_get_osfhandle
_isatty
__stdio_common_vsscanf
_open
__stdio_common_vfprintf
malloc
calloc
free
_callnewh
realloc
qsort
rand
_stat64
_chmod
_findclose
_wstat32
remove
_unlink
_mkdir
_findnext64i32
_findfirst64i32
_utime64
strftime
_mkgmtime64
__daylight
clock
_time64
_tzset
_difftime64
_localtime64_s
__timezone
_gmtime64_s
_localtime64
getenv
FW1CreateFactory
_FW1CreateFactory@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ