Monster_Mods[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Monster_Mods.exe
Size

14.5MB
MD5

72913eadcc43e1bb446b9e99bdfdd9d0
SHA1

67564e21775e29d5e294da23473ad4ff11d723db
SHA256

33bc0fc5c9823692a2211a67f27505d252d198f5612b4e6e577e09ac15b4995a
SHA512

63b111ce9624bf2183effb25d262e416809122c9ca25e8f35e61987f1cc1da9116d3d3323878510d82ee2ded3354b05399aa6c47982e43a4e46ca3fb9a60c9b9
SSDEEP

393216:5k53Evl1qIsqVzoGnNgw2H/NVv4hWvhcsZOWvVS9rP5b:RmwsNVv4hWvhcsZOWvVS9rP5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Monster_Mods.exe

Files

Monster_Mods.exe
.exe windows x64

4fe8eca58f15770cba67a12bc52cdf1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
EventSetInformation
EventUnregister
RegCloseKey
EventActivityIdControl
EventRegister
EnumerateTraceGuidsEx
EventWriteTransfer
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
EventWrite
EventEnabled

bcrypt

BCryptExportKey
BCryptGetProperty
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptDestroyKey
BCryptFinishHash
BCryptHashData

crypt32

CryptFindOIDInfo
CryptFormatObject
CertFreeCertificateContext
CryptMsgClose
CertNameToStrW
CertCloseStore
CryptImportPublicKeyInfoEx2
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertControlStore
CertGetValidUsages
CryptQueryObject
CertGetCertificateContextProperty
CertSetCertificateContextProperty
CertGetNameStringW
CertDuplicateCertificateContext
CertOpenStore
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertEnumCertificatesInStore
PFXImportCertStore
CryptMsgGetParam
CertSerializeCertificateStoreElement
PFXExportCertStore
CryptDecodeObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertSaveStore
CertFindCertificateInStore
CertVerifyTimeValidity
CertFindExtension
CertGetIntendedKeyUsage

iphlpapi

GetAdaptersAddresses
GetNetworkParams
GetPerAdapterInfo
if_nametoindex

kernel32

GetProcessHeap
LCMapStringW
HeapReAlloc
CompareStringW
HeapSize
SetLastError
GetLastError
FormatMessageW
LocalFree
GetTickCount64
OpenProcess
CloseHandle
GetProcAddress
GetModuleHandleA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
IsWow64Process
GetModuleHandleW
WaitForSingleObject
VirtualFreeEx
GetExitCodeThread
VirtualQueryEx
ReadProcessMemory
VirtualProtectEx
LoadLibraryExW
QueryPerformanceCounter
GetExitCodeProcess
GetStdHandle
CreateProcessW
GetCurrentProcess
K32EnumProcesses
GetProcessId
DuplicateHandle
GetConsoleCP
GetConsoleOutputCP
CreatePipe
MultiByteToWideChar
WideCharToMultiByte
GetCPInfoExW
CancelIoEx
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
GetConsoleMode
GetFileType
ReadFile
ReadConsoleW
ReadConsoleInputW
SetConsoleCursorPosition
SetConsoleOutputCP
SetConsoleTextAttribute
SetConsoleTitleW
WriteFile
WriteConsoleW
CloseThreadpoolIo
GetCurrentProcessId
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
CompareStringEx
FindNLSStringEx
GetUserPreferredUILanguages
FindStringOrdinal
GetCurrentProcessorNumber
GetCurrentThread
Sleep
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
QueryPerformanceFrequency
GetCPInfo
LocalAlloc
RaiseFailFastException
WaitForThreadpoolWaitCallbacks
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
LocaleNameToLCID
LCMapStringEx
CompareStringOrdinal
GetLocaleInfoEx
EnumTimeFormatsEx
GetCalendarInfoEx
EnumCalendarInfoExEx
ResolveLocaleName
SleepConditionVariableCS
CreateDirectoryW
CreateFileW
DeleteFileW
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFullPathNameW
GetLongPathNameW
GetOverlappedResult
GetSystemDirectoryW
MoveFileExW
QueryUnbiasedInterruptTime
SetFileInformationByHandle
SetFilePointerEx
SetThreadErrorMode
GetDynamicTimeZoneInformation
GetTimeZoneInformation
SetEvent
ResetEvent
CreateEventExW
GetEnvironmentVariableW
CreateThread
ResumeThread
GetThreadPriority
SetThreadPriority
VerSetConditionMask
FlushProcessWriteBuffers
GetCurrentThreadId
WaitForSingleObjectEx
VirtualQuery
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
TerminateProcess
SwitchToThread
SuspendThread
GetThreadContext
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
K32GetProcessMemoryInfo
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
HeapAlloc
HeapFree
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSectionAndSpinCount

ncrypt

NCryptImportKey
NCryptOpenStorageProvider
NCryptSetProperty
NCryptDeleteKey
NCryptGetProperty
NCryptFreeObject
NCryptOpenKey

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoGetApartmentType
CoCreateGuid
CoWaitForMultipleHandles

user32

LoadStringW

ws2_32

shutdown
WSAConnect
WSAGetOverlappedResult
WSARecv
WSASend
select
listen
ioctlsocket
getsockopt
getsockname
getpeername
bind
accept
FreeAddrInfoExW
GetAddrInfoExW
WSASocketW
WSACleanup
WSAStartup
FreeAddrInfoW
GetAddrInfoW
GetNameInfoW
gethostname
closesocket
WSAIoctl
WSAEventSelect
setsockopt
send
recv

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: 820KB - Virtual size: 820KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 432KB - Virtual size: 544KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 417KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4fe8eca58f15770cba67a12bc52cdf1e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

user32

ws2_32

Exports

Exports

Sections

.text Size: 820KB - Virtual size: 820KB

.managed Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 7.8MB - Virtual size: 7.8MB

.data Size: 432KB - Virtual size: 544KB

.pdata Size: 417KB - Virtual size: 417KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 243KB - Virtual size: 243KB

.reloc Size: 208KB - Virtual size: 207KB

.text
Size: 820KB - Virtual size: 820KB

.managed
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 7.8MB - Virtual size: 7.8MB

.data
Size: 432KB - Virtual size: 544KB

.pdata
Size: 417KB - Virtual size: 417KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 243KB - Virtual size: 243KB

.reloc
Size: 208KB - Virtual size: 207KB