926b7ce73da19032bae2dc4213cfce43c59b098f1ae8e99e1a2d5c4cade87ae7

General

Target
926b7ce73da19032bae2dc4213cfce43c59b098f1ae8e99e1a2d5c4cade87ae7
Size 303KB
Sample261002-prrm8aw1dz
SHA256 926b7ce73da19032bae2dc4213cfce43c59b098f1ae8e99e1a2d5c4cade87ae7
MD5 fd54a2492b1ced303e6fb2e2310dd7d9
SHA1 e96921b2c6546710a6677ee05301a6305fe29865
SHA512 1113184cd649da36d26219b8d6fb63df59599893656d94c61f8cca0ea1859f4d9b29f3af652e5fb55fa98c321d4611de144dba7023422f8262510d0592683f27
SSDEEP 6144:GL/jzlUejjoA7sKIg5Y0ssgzmrddle/SJ:GLnlUco2sKIg5YogzmJe/
TLSH
T116646C09B3D50498FB7BC179C6ABE526E67378911710C5EF167088AA1F33AE4BD35322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
926b7ce73da19032bae2dc4213cfce43c59b098f1ae8e99e1a2d5c4cade87ae7

File Explorer

926b7ce73da19032bae2dc4213cfce43c59b098f1ae8e99e1a2d5c4cade87ae7

.sys 303KB

926b7ce73da19032bae2dc4213cfce43c59b098f1ae8e99e1a2d5c4cade87ae7

IMPHASH 24e8a4e4f4a1099ed3e87363a5b80534
SHA256 926b7ce73da19032bae2dc4213cfce43c59b098f1ae8e99e1a2d5c4cade87ae7
MD5 fd54a2492b1ced303e6fb2e2310dd7d9
SHA1 e96921b2c6546710a6677ee05301a6305fe29865
SHA512 1113184cd649da36d26219b8d6fb63df59599893656d94c61f8cca0ea1859f4d9b29f3af652e5fb55fa98c321d4611de144dba7023422f8262510d0592683f27
SSDEEP 6144:GL/jzlUejjoA7sKIg5Y0ssgzmrddle/SJ:GLnlUco2sKIg5YogzmJe/
TLSH
T116646C09B3D50498FB7BC179C6ABE526E67378911710C5EF167088AA1F33AE4BD35322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

166160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\MyDriver1\x64\Release\MyDriver1.pdb

ntoskrnl.exe

__C_specific_handler ExAllocatePool ExAllocatePoolWithTag ExFreePoolWithTag ZwCreateFile ZwQueryInformationFile ZwSetInformationFile ZwReadFile ZwWriteFile ZwClose ZwOpenKey ZwDeleteValueKey ZwEnumerateKey ZwQueryValueKey ZwSetValueKey RtlCompareMemory KeInitializeEvent KeClearEvent KeSetEvent KeWaitForSingleObject MmMapLockedPagesSpecifyCache ObReferenceObjectByName IoDriverObjectType ObReferenceObjectByHandle ZwDeleteKey IoCreateFileSpecifyDeviceObjectHint IoGetBaseFileSystemDeviceObject ZwQueryDirectoryFile IoFileObjectType ZwEnumerateValueKey RtlPcToFileHeader KeGetCurrentIrql KeLowerIrql KfRaiseIrql MmBuildMdlForNonPagedPool MmUnmapLockedPages IoAllocateMdl IoFreeMdl IoGetCurrentProcess MmIsAddressValid ZwQuerySystemInformation RtlUnicodeStringToInteger RtlInitAnsiString MmGetSystemRoutineAddress RtlAnsiStringToUnicodeString RtlUnicodeStringToAnsiString RtlFreeUnicodeString RtlFreeAnsiString VerSetConditionMask RtlGetVersion RtlVerifyVersionInfo KeDelayExecutionThread KeInitializeSpinLock KeAcquireSpinLockRaiseToDpc ObfDereferenceObject KeQueryTimeIncrement ProbeForRead ProbeForWrite ExGetPreviousMode MmProbeAndLockPages MmUnlockPages MmProtectMdlSystemAddress MmMapIoSpace MmUnmapIoSpace MmAllocateContiguousMemory MmFreeContiguousMemory PsCreateSystemThread PsTerminateSystemThread IoAttachDeviceToDeviceStack IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoDetachDevice IoGetAttachedDeviceReference IoAllocateWorkItem IoFreeWorkItem IoQueueWorkItem IoWMIOpenBlock IoWMIQueryAllData IoGetDeviceInterfaces ExUuidCreate MmGetPhysicalAddress MmCopyMemory RtlRandomEx KeStackAttachProcess KeUnstackDetachProcess IoGetRequestorProcess IoEnumerateDeviceObjectList KeReadStateEvent PsThreadType ObReferenceObjectByPointer RtlIpv4StringToAddressA PsProcessType strncpy_s ZwOpenFile PsSetCreateProcessNotifyRoutineEx PsGetProcessId ZwTerminateProcess ZwOpenProcess PsGetProcessPeb PsGetProcessImageFileName ZwDeleteFile ZwCreateSection ZwMapViewOfSection ZwUnmapViewOfSection RtlAnsiCharToUnicodeChar RtlUnicodeToMultiByteN IoIs32bitProcess IoGetDeviceObjectPointer IofCallDriver IoBuildDeviceIoControlRequest KeReleaseSpinLock RtlInitUnicodeString

hal

KeQueryPerformanceCounter

netio.sys

GetIfEntry2 FreeMibTable GetUnicastIpAddressTable

Name

.text

Size

202KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

926b7ce73da19032bae2dc4213cfce43c59b098f1ae8e99e1a2d5c4cade87ae7

ntoskrnl.exe

hal

netio.sys

generic