d21e79c924e8a94324f1d03d5c82b985b5c801c4528adc680b03f2c3513512ab

General

Target
d21e79c924e8a94324f1d03d5c82b985b5c801c4528adc680b03f2c3513512ab
Size 116KB
Sample260922-ktbbsscb38
SHA256 d21e79c924e8a94324f1d03d5c82b985b5c801c4528adc680b03f2c3513512ab
MD5 b86d80ee3cdad5d28f9a3e26528e1427
SHA1 0ffd02fa876fb1842cdef745716a343dcec04319
SHA512 4efd043ae0e919eec09b736b7441d9a6cb2d3e9b177ab0a09f48b817fbd10cf4192f41903ada18bc76d604d846819c54a6b9c12b40e59abff9be74066f91a5bf
SSDEEP 1536:f5ksLxd1kJdmp1mHZO/AuQiuGWMV9oKtmgIpTKw+ieJRFlhkoOSWZoqR:astd1rWHuQN29dIp8iAvvO7yqR
TLSH
T140C34B04BAE51582F4BBC2F4DB554213EBB6F4A52325C6DF4780852B2B727D2AA3D3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d21e79c924e8a94324f1d03d5c82b985b5c801c4528adc680b03f2c3513512ab

File Explorer

d21e79c924e8a94324f1d03d5c82b985b5c801c4528adc680b03f2c3513512ab

.sys 116KB

d21e79c924e8a94324f1d03d5c82b985b5c801c4528adc680b03f2c3513512ab

IMPHASH ebf80ae1b6783215a51e54b3c91728fc
SHA256 d21e79c924e8a94324f1d03d5c82b985b5c801c4528adc680b03f2c3513512ab
MD5 b86d80ee3cdad5d28f9a3e26528e1427
SHA1 0ffd02fa876fb1842cdef745716a343dcec04319
SHA512 4efd043ae0e919eec09b736b7441d9a6cb2d3e9b177ab0a09f48b817fbd10cf4192f41903ada18bc76d604d846819c54a6b9c12b40e59abff9be74066f91a5bf
SSDEEP 1536:f5ksLxd1kJdmp1mHZO/AuQiuGWMV9oKtmgIpTKw+ieJRFlhkoOSWZoqR:astd1rWHuQN29dIp8iAvvO7yqR
TLSH
T140C34B04BAE51582F4BBC2F4DB554213EBB6F4A52325C6DF4780852B2B727D2AA3D3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

76608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\WorkSpace\2.000\55\mbs_windows_sandbox_new\network\sys\x64\Release\SedeNetDrv.pdb

ntoskrnl.exe

wcsncmp wcsrchr wcsstr _wcsnicmp _wcslwr KeInitializeSpinLock RtlCompareMemory ExAcquireSpinLockShared ExReleaseSpinLockShared strstr RtlIpv4AddressToStringA KeDelayExecutionThread KfRaiseIrql KeLowerIrql DbgPrint RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitUnicodeString RtlCopyUnicodeString strncmp KeWaitForSingleObject KeReleaseMutex KeInitializeMutex ExReleaseSpinLockExclusive ExAcquireSpinLockExclusive ExFreePool KeReleaseSpinLock KeAcquireSpinLockRaiseToDpc _wcsupr IoFreeMdl IoAllocateMdl MmBuildMdlForNonPagedPool ExAllocatePool RtlIpv6AddressToStringW RtlIpv4AddressToStringW _snwprintf ZwDeviceIoControlFile ZwClose ZwCreateFile ObReferenceObjectByHandle PsTerminateSystemThread PsCreateSystemThread ExFreePoolWithTag ExAllocatePoolWithTag KeReleaseInStackQueuedSpinLock ZwOpenProcess KeAcquireInStackQueuedSpinLock RtlInitAnsiString wcsncpy MmGetSystemRoutineAddress wcscat_s

ndis.sys

NdisAllocateNetBufferListPool NdisAdvanceNetBufferDataStart NdisGetDataBuffer NdisFreeNetBufferListPool NdisRetreatNetBufferDataStart

fwpkclnt.sys

FwpmFilterDeleteById0 FwpmFilterAdd0 FwpmCalloutAdd0 FwpmSubLayerAdd0 FwpmTransactionAbort0 FwpmTransactionCommit0 FwpmTransactionBegin0 FwpmEngineClose0 FwpmEngineOpen0 FwpsCalloutUnregisterById0 FwpsCalloutRegister2 FwpsQueryPacketInjectionState0 FwpsInjectNetworkReceiveAsync0 FwpsInjectNetworkSendAsync0 FwpsFreeNetBufferList0 FwpsAllocateNetBufferAndNetBufferList0 FwpsInjectionHandleDestroy0 FwpsInjectionHandleCreate0 FwpsRedirectHandleDestroy0 FwpsRedirectHandleCreate0 FwpsFreeCloneNetBufferList0 FwpsAllocateCloneNetBufferList0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsCompleteClassify0 FwpsReleaseClassifyHandle0 FwpsAcquireClassifyHandle0

wdfldr.sys

WdfVersionUnbind WdfVersionBind WdfVersionBindClass WdfVersionUnbindClass

Name

.text

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d21e79c924e8a94324f1d03d5c82b985b5c801c4528adc680b03f2c3513512ab

ntoskrnl.exe

ndis.sys

fwpkclnt.sys

wdfldr.sys

generic