run.zip
- SHA256 31b176c08f7b51ad35a492f8d87aec48bee5c4f2bf1245b5213957bd7bb719ff
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
run.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
22 signatures
900 seconds
General
- Target run.zip
- Size 11.8MB
- Sample260803-lddmnatbme
- SHA256 31b176c08f7b51ad35a492f8d87aec48bee5c4f2bf1245b5213957bd7bb719ff
- MD5 d2a4699aae435afd548ec97237f00f21
- SHA1 dddc7841c28ca3316d09734600869e01a996e646
- SHA512 26c2186b37e1d9502f32efd67e7b435b599c3c036f9eb3acb54ed0c5f7df31f1ae6670c882bd136d3dfd201437f42d9556bea0d24ebdeee7399bca0c1ac9cfaf
- SSDEEP 196608:2V1luDAQC7zGXKxKK2GDH9JAnsZyTuyxoft+m2g+ikEdFo6fLSk:2roDAQnI92GSqq98eVEdP9
- TLSH T181C633ACD4613EAF69FE3E0C78A0C06035837D9F0E72EDA6B2945D86546C4B91B78C17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/clrhost.dll unpack001/nfregdrv.exe
File Explorer
-
run.zip.zip 11.8MB
-
clrhost.dll.dll 8.6MB
-
nfregdrv.exe.exe 3.6MB
-
run.bat293B
clrhost.dll
- IMPHASH e94ea2107aea49bf9742c257e1ecc8d7
- SHA256 a6a4dccc4efe71ae5cb3af4ccb3a99faa246334148a8b02d8662e8241ad6bd0a
- MD5 756d21f0542f6a037214f42be278d367
- SHA1 77260db6a983bb4594fccc5b9c3c2b62f83dac21
- SHA512 20a4e4f300086578c8a204e7f93a9e02acf4d3c03d1ece6e2faea58ebb53ff1c96e41ed7018ec912f7c40937929b8598d2e535e701544491680771011efcdba8
- SSDEEP 196608:B8SL7Uba+ED7odkLaHtv6j4zaDUorkjzCFjOL:m6oba+9caawIxKCFjO
- TLSH T1579633CDB98503A6C463FFB858F28DBFB111FB8565214D0B7A8993401C37A352AB79C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16721245
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
advapi32
ChangeServiceConfigW
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
RtlLookupFunctionEntry
winhttp
WinHttpQueryDataAvailable
kernel32
MoveFileExW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
CreateWindowExW
shell32
ShellExecuteW
ole32
CoInitializeEx
msvcp140
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
wininet
HttpOpenRequestA
d3d9
Direct3DCreate9
iphlpapi
GetAdaptersInfo
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
strncpy_s
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
atan2f
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
oleaut32
GetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
Name
.text
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.T,~
Size
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.UnV
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
..DZ
Size
8.6MB
Virtual Size
8.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
nfregdrv.exe
- IMPHASH cd8ff9164200ffb3098092663234dbdf
- SHA256 01a9ccff60dbdf2dce2a6304f01c51ab32b03029fb4648394fb715bc1dc2ce5b
- MD5 de7218aed3ac1635468ee8f3a3b45b9c
- SHA1 c49f1acd0593546d0aaac5de23e92ff6c82c03e8
- SHA512 d46da180eaec6f33ecf6b44f1067c0e5bfc1655d53174467155aa5a32169b741ad93f6f01debe81cc9c863bdbe1ca21420bf595bd4c7cd39a3e40ee6dddb2535
- SSDEEP 98304:P9pu81M/MJaxGER+fOAq2Z+HK3aBJWhrGgLA7MCrOc:Pn1M/MJzERaOA++NLvLc
- TLSH T13B0623AF5BCB2EF0D01ECF74C94971ACB06D3B968AA1DC15B7CD190E4E9222ADD31251
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5761338
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shlwapi
PathStripPathW
kernel32
LocalAlloc
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
ExitWindowsEx
advapi32
QueryServiceStatusEx
msvcp140
??0_Lockit@std@@QEAA@H@Z
urlmon
URLOpenBlockingStreamA
ntdll
RtlCaptureContext
vcruntime140
_CxxThrowException
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.$Go
Size
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.Z1G
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.4PN
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
run.bat
- SHA256 2adf3bf0545d2635605ce250be13c6a8702f57f6604e26ab7c1a6152bf3852a3
- MD5 6a3849164fdd31b2e1f21629aa0911db
- SHA1 64c8e2e8ae395dfd581d745b5fb232162161dfda
- SHA512 4709189cb98a846dce44bcb773ef839fc86ec5e03a79ea7fa9931f6cbffce3b50626bc27c7db11b0ecdabf72d3f8d9a5d6e333bcd38602557d40d1decf855d89
- TLSH T1ABE0C21DDD41C2813529298007127C4B0392C8BEEB148C72374C838BEDCC9A11E5F3F1
- MD5 SHA1 SHA512 TLSH