Overview
overview
10Static
static
30PENM3.zip
windows10-2004-x64
10PENM3.zip
windows10-ltsc 2021-x64
10PENM3.zip
windows11-21h2-x64
1Bootstrapper.exe
windows10-2004-x64
10Bootstrapper.exe
windows10-ltsc 2021-x64
10Bootstrapper.exe
windows11-21h2-x64
3README.txt
windows10-2004-x64
1README.txt
windows10-ltsc 2021-x64
1README.txt
windows11-21h2-x64
3Static task
static1
Behavioral task
behavioral1
Sample
0PENM3.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
0PENM3.zip
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral3
Sample
0PENM3.zip
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Bootstrapper.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Bootstrapper.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral6
Sample
Bootstrapper.exe
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
README.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
README.txt
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral9
Sample
README.txt
Resource
win11-20241007-en
General
-
Target
0PENM3.zip
-
Size
395KB
-
MD5
fb629efa3a1184aae2d334548a7ee618
-
SHA1
a973981a4ec954dd75db4b834d9be1d113bfd529
-
SHA256
27db561f7a41c969d70754f289166d07f0fab55b7f5395adfdc003ad9ca30966
-
SHA512
0ec47fc7976212b0cc1f19670f667693b94a938ac6cbc096a45503cb72f9b37bd1c84424c08bb2e211ad72091b2b81ae8de291cc7485245af3ef73484dfc1857
-
SSDEEP
6144:kidYohZStSB2YIL5e9omn1Zx/FxeB7IXmEEN7nXnp1jBuIeTIumOdZ8Pr+I7AN6O:HYPtACL541ZDwB7IXU5x6IumZ37Amze
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bootstrapper.exe
Files
-
0PENM3.zip.zip
Password: ryos
-
Bootstrapper.exe.exe windows:5 windows x86 arch:x86
Password: ryos
5942941c298654afc856f3a94fb00cae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SearchPathW
SetThreadContext
DeleteTimerQueueEx
DebugActiveProcessStop
CreateProcessW
SetWaitableTimer
GetConsoleAliasA
InterlockedDecrement
SetDefaultCommConfigW
SetComputerNameW
GetProcessPriorityBoost
GetModuleHandleW
GetCurrentThread
GetEnvironmentStrings
LoadLibraryW
GetVersionExW
GetTimeFormatW
GetAtomNameW
GetVolumePathNameA
GetStartupInfoW
RaiseException
SetLastError
GetProcAddress
GetLongPathNameA
LoadLibraryA
InterlockedExchangeAdd
LocalAlloc
MoveFileA
AddAtomA
FoldStringA
OpenFileMappingW
GetFileTime
FindFirstVolumeA
FindAtomW
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetLastError
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetFilePointer
SetStdHandle
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
CloseHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
GetModuleHandleA
Sections
.text Size: 268KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zusivut Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vopigu Size: 512B - Virtual size: 346B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xofi Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
README.txt