NET[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

NET.exe
Size

58KB
MD5

0bd94a338eea5a4e1f2830ae326e6d19
SHA1

88b101598cc6726b7a57d02b1fa95be1b272a821
SHA256

9f376759bcbcd705f726460fc4a7e2b07f310f52baa73caaaaa124fddbdf993e
SHA512

2253820ee1e72340bb74d2be721ac5064953e85527f3c396c763032d6c22248c623eb7d0ca2d33d8c866b628d19e2b4d2c45bd2966f55b9584db97e56ed014b3
SSDEEP

1536:+CgeNgIVR1beQxaUa+tQFJuzY6z69q5ef3Rk1kDCtvGwgtZVmKtW:0egy1aQxaUa+tQTZq7kDCtvGwgtvmf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NET.exe

Files

NET.exe
.exe windows x64

57f0c47ae2a1a2c06c8b987372ab0b07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wcsnicmp
exit
wcschr
sprintf_s
_wcsicmp
_ultow
iswctype
_local_unwind
_wcsupr
memcpy
wcsncat_s
_wcsdup
memmove
qsort
wcspbrk
wcsncmp
wcstok
wcsncpy_s
wcsrchr
_XcptFilter
memset
_fileno
wcscspn
calloc
wcsspn
_setmode
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
__set_app_type
__getmainargs
wcscat_s
wcscpy_s
malloc
free
putchar
_vsnwprintf_s
_snwprintf_s
__iob_func
setlocale
_amsg_exit
wcscmp

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetStdHandle

api-ms-win-core-console-l1-1-0

WriteConsoleW
ReadConsoleW
GetConsoleMode
SetConsoleMode
GetConsoleOutputCP

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetCPInfo
SetThreadUILanguage

api-ms-win-core-synch-l1-1-0

WaitForSingleObject

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
CreateProcessW
TerminateProcess
GetExitCodeProcess

mpr

WNetGetConnectionW
WNetAddConnection2W
WNetOpenEnumW
WNetCancelConnection2W
WNetCloseEnum
WNetEnumResourceW
WNetGetLastErrorW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW

wkscli

NetUseGetInfo
NetUseEnum
NetWkstaUserGetInfo
NetWkstaGetInfo

netutils

NetpwNameValidate
NetapipBufferAllocate
NetpwPathType
NetApiBufferReallocate
NetApiBufferFree
NetApiBufferAllocate

samcli

NetUserGetInfo

api-ms-win-core-file-l1-1-0

WriteFile
GetFileType
GetDriveTypeW

srvcli

NetServerGetInfo
NetShareEnum

iphlpapi

GetCurrentThreadCompartmentId

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetModuleFileNameW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-console-l1-2-0

PeekConsoleInputW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo

api-ms-win-core-registry-l2-1-0

RegOpenKeyW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

ntdll

RtlAllocateHeap

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57f0c47ae2a1a2c06c8b987372ab0b07

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

mpr

api-ms-win-core-registry-l1-1-0

wkscli

netutils

samcli

api-ms-win-core-file-l1-1-0

srvcli

iphlpapi

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-apiquery-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 38KB - Virtual size: 38KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 2KB - Virtual size: 45KB

.pdata Size: 2KB - Virtual size: 1KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 116B

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 2KB - Virtual size: 45KB

.pdata
Size: 2KB - Virtual size: 1KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 116B