drp-cmd.7z
- SHA256 c613097e837f3d90d122f66f25766de045b6ba8922b751903ff2dc650421cb14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7za.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7za.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
7za.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
7za.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
7zxa.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
7zxa.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
start.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral8
Sample
start.cmd
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target drp-cmd.7z
- Size 12.3MB
- Sample260716-w487csft51
- SHA256 c613097e837f3d90d122f66f25766de045b6ba8922b751903ff2dc650421cb14
- MD5 a203c689fb57bfa199496b6540c629d1
- SHA1 0cbd3cee372cfbb1114a51ef57ab66f9fc32abfa
- SHA512 e6a622c89c86a4a4850297dc00641ea801cce6db46c1c5a90ff7ba51b8247859953323f0d9e110411ec049880560581821375333211ddeea01b55f0b408d1d8b
- SSDEEP 196608:cHrtv9EdM0j9e975rOFSEUzH0jKRNIVr65Jp1d8O9KPxQxKbQN:cH7Exe975rsU/yJsxdTKPKEbQN
- TLSH T1A7D63305FAA3A04248B599B1079CD5B2C3395BAFDBA877FF1A39D3F127A600D046C94D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/7za.dll unpack001/7za.exe unpack001/7zxa.dll
File Explorer
-
drp-cmd.7z.7z 12.3MB
-
7za.dll.dll 272KB
-
7za.exe.exe 796KB
-
7zxa.dll.dll 161KB
-
arc.7z.7z 11.9MB
-
start.cmd86B
7za.dll
- IMPHASH abef435823a11ce87635e8e72c359aba
- SHA256 d7f1224cc4afb90af3792dadfdf2f14bad4a19329ee0f3c87c111611aa36b7b1
- MD5 b54e2dcd1a3d593ca0ae4cb71910710e
- SHA1 15ab00317b310a7a535684c7221e0eb6cde68ac2
- SHA512 1414fd599095c3afd4faa6cf56e2f00d9db4d80f460457e4e08734ee24ed852f74d5813b4e96091c330ba8dd2f998995233583bbf887eff1c89b924b09a3fcc0
- SSDEEP 6144:Ml7K/bZ3Xb4/e4BQSx65Pz6RjVM/oTO+T7KmdCUOHn:MRK/bi/ecx6gJVMgTOE7KAQ
- TLSH T13244AE21BBF6C0F5D5862235861C7BBA55FDE3894B10C8D3A390DE1EAE329D2D23950D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
229479
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
realloc
memset
strlen
memcpy
memmove
free
_CxxThrowException
malloc
memcmp
_purecall
__CxxFrameHandler
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
GetLastError
CloseHandle
GetProcAddress
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
231KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=94, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=90, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=26, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
7za.exe
- IMPHASH abae283b9febd6b6c99aae6c6b3d9202
- SHA256 ba7f3627715614d113c1e1cd7dd9d47e3402a1e8a7404043e08bc14939364549
- MD5 90aac6489f6b226bf7dc1adabfdb1259
- SHA1 c90c47b717b776922cdd09758d2b4212d9ae4911
- SHA512 befaa9b27dc11e226b00a651aa91cbfe1ec36127084d87d44b6cd8a5076e0a092a162059295d3fcd17abb6ea9adb3b703f3652ae558c2eef4e8932131397c12d
- SSDEEP 24576:HWdp+y7/ya3yc7tfBA6rDUzfKrBxEATB:up+fa3rLA6s+/
- TLSH T177059F227BF5D077C25211328A1C7BB691F9936C0B2448C763848F2DBB719D5DE3A92E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
656756
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear
user32
CharPrevExA
CharUpperW
advapi32
OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
exit
_ftol
realloc
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
malloc
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
_fileno
kernel32
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
ResumeThread
SetFileAttributesW
WaitForSingleObject
InterlockedIncrement
VirtualFree
VirtualAlloc
GetOEMCP
LocalFileTimeToFileTime
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
ReadFile
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
DeviceIoControl
SetThreadAffinityMask
Name
.text
Size
672KB
Virtual Size
672KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=158, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=188, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=36, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
7zxa.dll
- IMPHASH 72325093dd826f0b5d93d82d3606361c
- SHA256 6b4888207c46c23d2d4e4eace8a2db01711692bc7d4bb93f3750bc41e91bb73c
- MD5 72dcc77ba25ebc4984d959a78c8646d5
- SHA1 50347fcdb44426918d2eeafd5ff8ca9385fbbb0b
- SHA512 1ff7c0027802e65d5d668f2c7d90b71d720c964e7da03c2a8dc8e0b8456bfa8658ca57de17e66a1ebaaef5bf0be1806188813e1da608b6861bc4d8b6a48f8876
- SSDEEP 3072:ifGI+bVn1rLT8VxY9ZcHwDLULRpqnhlGZcQU6aRg+NmVRmCHOtGgYckP:3eK7QwUqnT6aRfmVR5SYz
- TLSH T16FF3BD20B7BAC0F9C70A3231991E7B7752BAE38D4B0059D76350EE9A2E355D5E33C129
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
130359
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
msvcrt
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
_except_handler3
memset
strlen
free
malloc
_CxxThrowException
memcpy
memmove
memcmp
_purecall
__CxxFrameHandler
_beginthreadex
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
VirtualFree
VirtualAlloc
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
GetModuleHandleA
GetProcAddress
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
IsProcessorFeaturePresent
GetLastError
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=59, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=72, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=16, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
arc.7z
- SHA256 dfe2955ba24ad28704e059fe567902ce9f878c9d6f95184b82d95753e151757c
- MD5 4354df0a9a59df39d5cfb2c4636a5f85
- SHA1 e0490ab9c6bbe6ecccb7ac9ce8e266db3d0ba7db
- SHA512 6e208c9a9bdcf917810baead0853e401c3cebd7d8746a57f24bce0b86fbfd2ad4a0d6ef50cdfac608c767f6b8417842588d301986ac63794864e4a4d98a78899
- SSDEEP 196608:6Hr3vSlcEl4Sa+7kr3Adin3FpjXmVyo50YWhmB9b1dPbHx3Ga:6HOlha+7krhn6QibXBndPb9Ga
- TLSH T15CC63345EA93A04248B99DB1079CE5B2C3394E6FCBA477FE1A3DD3F1276601E046C94E
- MD5 SHA1 SHA512 SSDEEP TLSH
start.cmd
- SHA256 030ee398e53caf0928e757162f3c7be7d593a59dde2795991ec7e4fd8e71f2e3
- MD5 232ebf167ea35163ea69a1570be7b03e
- SHA1 b8bc8c8b3f9ebf83ec43244a934389bd98849a0a
- SHA512 efe7d716b4c2553b1dc295271b1bb32fccf12e2b64e6de7adbf5f8284bdee1c3a92b5a227c46a6bff6c1298d2e7319b73b7a75651710cad84564f0c4ec4c917f
- TLSH T127A01210003B9930B8650418835A079D080B44611522184C381209520004851C0301C2
- MD5 SHA1 SHA512 TLSH