TCWG_Support[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

TCWG_Support.exe
Size

2.8MB
MD5

cc235db6a61a1c37844efe48332be433
SHA1

fd20508869c23e612260a5a342150af1972b1223
SHA256

7f5714d9eca2869486dfafe9f9e5d1e32342889dbecd89ed890539a38c92183b
SHA512

b68ed48ef58db56289cb533dc35e3a98fbfe834d6cfad1773c175b24874ab8e05e7312b4281d5a0cca91e54aa641c0da15da5b8b6a2dc3b34bc5a61f00cccb05
SSDEEP

49152:QxuXwMnQUnvoA4N1015+pTAg6NTkGCgOOxQTYywC8PSJzyUkpijZMI9n1:vg2Qw4PCNT49eBk

Score

1^/10

Malware Config

Signatures

Files

TCWG_Support.exe
.exe windows x86

818699aa1838d590f4e1c28a29c17a40

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

72:ee:0d:70:6b:f1:04:d6:59:bf:7e:3c
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

28/06/2022, 08:18

Not After

28/07/2025, 08:18

Subject

SERIALNUMBER=1187746374661,CN=Aeroadmin LLC,O=Aeroadmin LLC,STREET=st. Konstantin Simonov\, 5 / building 1 kv 16,L=Moscow,ST=Moscow,C=RU,1.2.840.113549.1.9.1=#0c16657567656e652e73406165726f61646d696e2e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:1e:f7:cd:0e:f8:61:d4:5e:05:e3:ef:97:e6:e1:ea:c5:4d:7f:18:07:e2:62:53:57:e0:d4:24:9b:33:11:78
Signer

Actual PE Digest

3c:1e:f7:cd:0e:f8:61:d4:5e:05:e3:ef:97:e6:e1:ea:c5:4d:7f:18:07:e2:62:53:57:e0:d4:24:9b:33:11:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CloseHandle
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedExchangeAdd
GetCurrentProcessId
PostQueuedCompletionStatus
GetProcAddress
Sleep
WriteFile
ReadFile
CreateFileW
RaiseException
GetModuleHandleW
DecodePointer
LoadLibraryW
LocalFree
GetModuleFileNameW
FreeLibrary
GetFileSize
GetTickCount
ProcessIdToSessionId
AttachConsole
GetCommandLineW
WTSGetActiveConsoleSessionId
GetVersionExW
GetCurrentProcess
TlsFree
OpenProcess
TerminateProcess
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
FormatMessageW
FormatMessageA
WideCharToMultiByte
DeleteFileW
TlsAlloc
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapSize
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetStringTypeW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
EncodePointer
LCMapStringEx
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetLocaleInfoEx
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
SleepEx
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetExitCodeProcess
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
GetUserGeoID
GetGeoInfoW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
SetThreadExecutionState
GetConsoleWindow
CreateEventW
WaitForSingleObject
CreateDirectoryW
InterlockedCompareExchange
WaitForMultipleObjects
TerminateThread
QueueUserAPC
SetEvent
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
SetLastError
VerSetConditionMask
VerifyVersionInfoW
TlsGetValue
TlsSetValue
CompareFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SetCurrentDirectoryW
LocalAlloc
GetFileAttributesW
OutputDebugStringA
FreeConsole
SetConsoleCtrlHandler
GenerateConsoleCtrlEvent
GetCurrentThread
GetThreadTimes
DeviceIoControl
SetPriorityClass
HeapAlloc
GetProcessHeap
HeapFree
GetComputerNameW
GetUserDefaultUILanguage
FindResourceW
LockResource
LoadResource
SizeofResource
MoveFileW
GetLogicalDriveStringsW
GetVolumeInformationW
GetDiskFreeSpaceExW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
GetFileAttributesExW
SetFileTime
SetFilePointer
SetEndOfFile
ResetEvent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
InterlockedPushEntrySList
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetStdHandle
GetACP
GetDateFormatW
GetTimeFormatW
VirtualQuery

user32

EmptyClipboard
SetClipboardData
CloseClipboard
LoadCursorW
SetCursor
SetClassLongW
wsprintfW
ExitWindowsEx
ChangeDisplaySettingsW
LockWorkStation
SendInput
GetDC
ReleaseDC
mouse_event
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
GetClipboardData
OpenDesktopW
SetThreadDesktop
CloseDesktop
MapVirtualKeyW
SystemParametersInfoW
EnableWindow
GetDlgItem
GetWindowRect
GetAsyncKeyState
SetMenu
GetClientRect
InvalidateRect
AdjustWindowRect
SetFocus
GetKeyState
SetWindowPos
EnableMenuItem
GetSystemMenu
GetWindowTextW
MoveWindow
FillRect
UpdateWindow
ScreenToClient
DrawTextW
CallNextHookEx
ClientToScreen
SetWindowsHookExW
BroadcastSystemMessageW
UnhookWindowsHookEx
SetWindowTextA
GetWindowTextA
GetScrollInfo
SetScrollInfo
IsDlgButtonChecked
GetMenu
DestroyWindow
DrawTextExW
DrawFrameControl
GetParent
SendMessageW
ToAscii
SetScrollPos
ShowScrollBar
SetScrollRange
HideCaret
ShowCaret
MessageBeep
SetCaretPos
RegisterClassW
BeginPaint
EndPaint
GetFocus
GetScrollPos
GetScrollRange
CreateCaret
DestroyCaret
GetWindowPlacement
DrawIconEx
DestroyIcon
GetDesktopWindow
GetMonitorInfoW
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
OpenInputDesktop
GetUserObjectInformationW
EnumDisplayMonitors
GetCursorInfo
GetIconInfo
GetWindowDC
DestroyCursor
CreateIconIndirect
InsertMenuItemW
PostQuitMessage
SetMenuItemInfoW
RemoveMenu
GetMenuBarInfo
CreateMenu
SetWindowLongW
LoadIconW
MapWindowPoints
CallWindowProcW
GetWindowLongW
ShowWindow
SetForegroundWindow
DefWindowProcW
GetCursorPos
CreatePopupMenu
InsertMenuW
TrackPopupMenu
DestroyMenu
FindWindowW
GetSystemMetrics
RegisterClassExW
CreateWindowExW
DrawMenuBar
LoadImageW
GetGuiResources
SetWindowTextW
PostMessageW
MessageBoxW
TranslateMessage
PeekMessageW
OpenClipboard
DispatchMessageW
GetKeyboardState
DrawEdge
GetDCEx

gdi32

CreateSolidBrush
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
SetBrushOrgEx
SetBkMode
CreateFontIndirectW
SetTextColor
Rectangle
CreatePen
GetROP2
SetROP2
CreateFontW
GetTextMetricsW
CreateDIBitmap
CreateCompatibleBitmap
DeleteDC
GetDeviceCaps
GetDIBits
GetObjectW
StretchBlt
SaveDC
GetStockObject
RestoreDC
GetBitmapBits
CreateBitmap
SetBkColor
ExtTextOutW
GetTextExtentPoint32W
CreatePatternBrush

shell32

SHGetFolderPathW
SHGetFileInfoW
SHBrowseForFolderW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW
ord47
SHGetPathFromIDListW

ole32

CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
CoInitializeEx

oleaut32

SysAllocString
SysFreeString
VariantInit
SysStringLen
VariantClear

ws2_32

ioctlsocket
closesocket
listen
socket
getsockopt
connect
WSASend
WSARecv
WSAStartup
WSACleanup
bind
shutdown
WSASetLastError
gethostname
ntohl
WSAConnect
WSASocketW
inet_ntoa
gethostbyname
recv
select
send
setsockopt
getpeername
WSAGetLastError
getaddrinfo
freeaddrinfo
accept

urlmon

URLOpenBlockingStreamW
URLDownloadToFileW

winmm

waveInReset
waveOutOpen
waveOutUnprepareHeader
waveInStart
waveOutPrepareHeader
waveOutWrite
waveOutClose
timeBeginPeriod
timeEndPeriod
waveInPrepareHeader
waveInOpen
waveInGetDevCapsW
waveInGetNumDevs
waveInUnprepareHeader
waveInAddBuffer
waveInClose

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock
GetUserProfileDirectoryW
DestroyEnvironmentBlock

winhttp

WinHttpReceiveResponse
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpReadData
WinHttpWriteData
WinHttpSendRequest
WinHttpAddRequestHeaders

iphlpapi

IcmpSendEcho
IcmpCreateFile
GetBestInterface
GetAdaptersAddresses

mpr

WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum

gdiplus

GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipDisposeImage
GdipAlloc
GdipFree
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipSaveImageToStream

msimg32

AlphaBlend

comctl32

InitCommonControlsEx
ord17

comdlg32

GetOpenFileNameW

advapi32

OpenProcessToken
LookupAccountSidW
GetTokenInformation
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
CryptAcquireContextW
LookupPrivilegeValueW
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserW
SetServiceStatus
RegisterServiceCtrlHandlerExW
OpenSCManagerW
CreateServiceW
ChangeServiceConfig2W
CloseServiceHandle
RegCreateKeyExW
OpenServiceW
DeleteService
StartServiceW
StartServiceCtrlDispatcherW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SetSecurityInfo
LogonUserW
CreateProcessWithLogonW
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
CryptReleaseContext
CryptGenRandom

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 625KB - Virtual size: 841KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

818699aa1838d590f4e1c28a29c17a40

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

72:ee:0d:70:6b:f1:04:d6:59:bf:7e:3cCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

3c:1e:f7:cd:0e:f8:61:d4:5e:05:e3:ef:97:e6:e1:ea:c5:4d:7f:18:07:e2:62:53:57:e0:d4:24:9b:33:11:78Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

ws2_32

urlmon

winmm

wtsapi32

userenv

winhttp

iphlpapi

mpr

gdiplus

msimg32

comctl32

comdlg32

advapi32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 312KB - Virtual size: 311KB

.data Size: 625KB - Virtual size: 841KB

.rsrc Size: 33KB - Virtual size: 32KB

.reloc Size: 87KB - Virtual size: 87KB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

72:ee:0d:70:6b:f1:04:d6:59:bf:7e:3c
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

3c:1e:f7:cd:0e:f8:61:d4:5e:05:e3:ef:97:e6:e1:ea:c5:4d:7f:18:07:e2:62:53:57:e0:d4:24:9b:33:11:78
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 312KB - Virtual size: 311KB

.data
Size: 625KB - Virtual size: 841KB

.rsrc
Size: 33KB - Virtual size: 32KB

.reloc
Size: 87KB - Virtual size: 87KB