b7dfe099c47d1784ca8ec068b172832f644d3ed49b6a9ea58af357a81175a120

Sharing

Copy URL Twitter E-mail

General

Target
b7dfe099c47d1784ca8ec068b172832f644d3ed49b6a9ea58af357a81175a120
Size 419KB
Sample260831-j9gcbafn21
SHA256 b7dfe099c47d1784ca8ec068b172832f644d3ed49b6a9ea58af357a81175a120
MD5 3a312221a24ee3902d552b1d58297c2f
SHA1 2d02d3b22214f14a97b6bbcef2e83aa7b6c104df
SHA512 e8f60bf0c4ebe0c2317166d331d59be0e9a8e9aa3d981acf4dbe01239b682c6f3f1bf2ad5cdf1ef8a307a15eb448dc08da5642c4a0b7fddcc094601328161a0e
SSDEEP 12288:FsKh55rub+6cgNUFMLFl0dqEQxbFWbUw36w6f4b/QxJK0U/7c0MBGI2Tiop:mG55rub+6cgNUFMLFOdqEVjKrJKDXTi0
TLSH
T10C947DB27BC864B3D12302B3D88A728575BC92704B7B9EC723585B5C1AB04C23B77697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7dfe099c47d1784ca8ec068b172832f644d3ed49b6a9ea58af357a81175a120

File Explorer

b7dfe099c47d1784ca8ec068b172832f644d3ed49b6a9ea58af357a81175a120

.dll 419KB

b7dfe099c47d1784ca8ec068b172832f644d3ed49b6a9ea58af357a81175a120

IMPHASH b56905eff19ae0bd21e7c18cd66bdd50
SHA256 b7dfe099c47d1784ca8ec068b172832f644d3ed49b6a9ea58af357a81175a120
MD5 3a312221a24ee3902d552b1d58297c2f
SHA1 2d02d3b22214f14a97b6bbcef2e83aa7b6c104df
SHA512 e8f60bf0c4ebe0c2317166d331d59be0e9a8e9aa3d981acf4dbe01239b682c6f3f1bf2ad5cdf1ef8a307a15eb448dc08da5642c4a0b7fddcc094601328161a0e
SSDEEP 12288:FsKh55rub+6cgNUFMLFl0dqEQxbFWbUw36w6f4b/QxJK0U/7c0MBGI2Tiop:mG55rub+6cgNUFMLFOdqEVjKrJKDXTi0
TLSH
T10C947DB27BC864B3D12302B3D88A728575BC92704B7B9EC723585B5C1AB04C23B77697
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

224960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\__w\1\b\Release\x86\Conduit.Broker.pdb

rpcrt4

RpcStringBindingParseW RpcBindingToStringBindingW RpcSsDestroyClientContext RpcAsyncInitializeHandle RpcAsyncCancelCall RpcAsyncCompleteCall RpcServerUnsubscribeForNotification RpcServerSubscribeForNotification RpcBindingInqObject RpcServerInqBindingHandle RpcServerUseProtseqEpW NdrAsyncClientCall RpcServerUnregisterIfEx RpcServerRegisterIf2 RpcExceptionFilter RpcStringFreeW RpcErrorGetNextRecord RpcErrorStartEnumeration RpcErrorEndEnumeration RpcBindingFromStringBindingW RpcStringBindingComposeW RpcBindingBind RpcBindingFree RpcBindingCreateW NdrServerCall2 NdrClientCall2 UuidCreate NdrAsyncServerCall RpcObjectSetType

advapi32

EventRegister EventWriteTransfer OpenServiceW OpenSCManagerW CloseServiceHandle EventActivityIdControl CreateWellKnownSid CheckTokenMembership DuplicateTokenEx RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW RegQueryValueExW OpenProcessToken EventUnregister

kernel32

RaiseException InterlockedFlushSList RtlUnwind GetCurrentProcessId IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead EncodePointer LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime InitOnceBeginInitialize InitOnceComplete MultiByteToWideChar WideCharToMultiByte GetCurrentProcess GetModuleHandleExW TlsAlloc FreeLibrary GetFinalPathNameByHandleW CreateFileW TlsGetValue SetLastError TlsSetValue TlsFree GetVersion GetProcAddress LoadLibraryExW HeapFree HeapAlloc GetProcessHeap GetModuleHandleA AreFileApisANSI InitializeCriticalSectionEx DecodePointer DeleteCriticalSection GetModuleHandleW GetStdHandle InitializeProcThreadAttributeList GetFileInformationByHandleEx UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateProcessW VerSetConditionMask VerifyVersionInfoW InitializeCriticalSectionAndSpinCount GetExitCodeProcess DisassociateCurrentThreadFromCallback WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CloseThreadpoolTimer CreateThreadpoolTimer SubmitThreadpoolWork LocalFree CloseHandle CloseThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers CreateThreadpoolCleanupGroup VirtualProtect LoadLibraryExA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetSystemInfo VirtualQuery CreateEventW GetLastError CloseThreadpoolWork CreateThreadpoolWork GetModuleFileNameW CloseThreadpoolWait GetFileAttributesExW FindFirstFileW FindClose CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks QueryPerformanceFrequency QueryPerformanceCounter GetTickCount64 TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared GetCurrentThreadId SleepConditionVariableSRW SleepEx WakeAllConditionVariable GetLocaleInfoEx FormatMessageA

ws2_32

htons

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll terminate abort _invalid_parameter_noinfo _configure_narrow_argv _initterm_e _invalid_parameter_noinfo_noreturn _initialize_narrow_environment _errno _initterm _initialize_onexit_table _cexit _crt_atexit _register_onexit_function _execute_onexit_table

api-ms-win-crt-string-l1-1-0

_wcsicmp _stricmp _strnicmp strncpy_s wmemcpy_s wcsnlen wcscpy_s wcsncmp _wcsnicmp towlower isspace isalnum wcsncpy_s strcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vsprintf_s __stdio_common_vsprintf __stdio_common_vswprintf_s

api-ms-win-crt-heap-l1-1-0

calloc _callnewh free malloc

api-ms-win-crt-math-l1-1-0

_ldclass _dsign _dclass _fdclass

api-ms-win-crt-locale-l1-1-0

__pctype_func localeconv ___lc_codepage_func _lock_locales ___mb_cur_max_func ___lc_locale_name_func setlocale _unlock_locales

api-ms-win-crt-convert-l1-1-0

_itow_s strtoul

oleaut32

SysFreeString SysAllocString

ntdll

RtlIpv4AddressToStringW RtlIpv6AddressToStringW

BrokerConnector_CreateBrokerRpcConnectionAsync BrokerConnector_Destroy BrokerConnector_GetConnectionString BrokerManagerClient_AddDefaultPathMapping BrokerManagerClient_AddPathMapping BrokerManagerClient_AllowAccessFromVM BrokerManagerClient_Create BrokerManagerClient_CreateBrokerManagerClientForContainer BrokerManagerClient_CreateBrokerRpcConnection BrokerManagerClient_CreateNewReference BrokerManagerClient_CreateWithAddress BrokerManagerClient_Destroy BrokerManagerClient_GetConnectionId BrokerManagerClient_GetServerAddress BrokerManagerClient_IsLocalServerAvailable BrokerManagerClient_MapPath BrokerManagerClient_PrepareForExternalBrokerLaunch BrokerManagerClient_RepresentsLocalComputeSystem BrokerManagerClient_SetDefaultConnectionToCrossVmServer BrokerManagerClient_SetDefaultConnectionToLocalServer BrokerManagerClient_TryGetBrokerByID BrokerManager_AllowAccessFromVM BrokerManager_AllowUnauthenticatedRemoteAccess BrokerManager_Create BrokerManager_DefaultConstruct BrokerManager_Destroy BrokerManager_GetConnectedClient BrokerReference_CreateNewReference BrokerReference_Destroy BrokerReference_GetBrokerRpcConnection BrokerReference_SetID BrokerReference_SetKeepAliveDuration BrokerRpcConnection_Destroy BrokerRpcConnection_GetBrokerReference BrokerRpcConnection_GetConnectionAddress BrokerRpcConnection_GetConnectionAddressToBrokerManagerFromBroker BrokerRpcConnection_GetHvSocketAddress BrokerRpcConnection_GetRpcBindingHandle BrokerRpcConnection_IsConnectedOverHvSocket BrokerRpcConnection_IsConnectedToSameBroker ConnectionAddress_CreateHvSocketAddress ConnectionAddress_CreateIPv4Address ConnectionAddress_CreateIPv6Address ConnectionAddress_CreateLocalAddress ConnectionAddress_Destroy ConnectionAddress_GetAddressType ConnectionAddress_GetHvSocketAddress ConnectionAddress_GetIPv4Address ConnectionAddress_GetIPv6Address ConnectionAddress_GetPortNumber

Name

.text

Size

254KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

123KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

24KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b7dfe099c47d1784ca8ec068b172832f644d3ed49b6a9ea58af357a81175a120

rpcrt4

advapi32

kernel32

ws2_32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

oleaut32

ntdll

generic