wintask[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

wintask.exe
Size

1.3MB
MD5

d716b5f8425bc84dcf06cb517f03c977
SHA1

e407eaf1b86f23ea97285f5cc1365149c7a55d8c
SHA256

1828e2df0ad76ea503af7206447e40482669bb25624a60b0f77743cd70f819f6
SHA512

bbc84fb48728bba943bdfb3a3605b4e815a35c4646a5b56a3a5f6573be0c7dfc030363f052c3c38b5f609e2349495b044a93a81d2ff5b3132adc5ba96f178af7
SSDEEP

24576:DB7oWvLR21bbgJMIkSV9Jmc7ljVIH06iyb:DB5vLRAbbJIkS/z7XIU6iA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wintask.exe

Files

wintask.exe
.exe windows x64

95a6df00399d356d08e078d74c217c74

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FormatMessageW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
WaitForSingleObjectEx
SetHandleInformation
SetLastError
WriteConsoleW
IsDebuggerPresent
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetStdHandle
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
GetCurrentThread
CancelIo
ReadFile
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
OpenProcess
GetProcAddress
ReadProcessMemory
GetModuleHandleA
RaiseException
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
InitializeCriticalSectionAndSpinCount
WakeAllConditionVariable
GetModuleHandleW
SleepConditionVariableSRW
LocalFree
VirtualQueryEx
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
UnhandledExceptionFilter
GetTickCount64
TlsAlloc
SetUnhandledExceptionFilter
RtlLookupFunctionEntry
GetEnvironmentVariableW
ReleaseMutex
GetCurrentProcess
GetLogicalDrives
TlsGetValue
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
lstrlenW
TlsSetValue
PostQueuedCompletionStatus
TryAcquireSRWLockExclusive
GetSystemInfo
TlsFree
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
SwitchToThread
HeapReAlloc
HeapFree
GlobalMemoryStatusEx
GetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
InitializeSRWLock
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
SetFileCompletionNotificationModes
GetProcessHeap
RtlVirtualUnwind
HeapAlloc
SetThreadStackGuarantee
GetLogicalProcessorInformationEx
AddVectoredExceptionHandler
WakeConditionVariable
MultiByteToWideChar
GetExitCodeProcess
WaitForSingleObject
GetOverlappedResult
WaitForMultipleObjects
CreateMutexA
EncodePointer
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetLastError
SetCurrentDirectoryW
FreeLibrary
CloseHandle
LoadLibraryExW
CreateEventW
CompareStringOrdinal
ReleaseSRWLockExclusive
RtlPcToFileHeader

pdh

PdhCloseQuery
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhCollectQueryData
PdhRemoveCounter
PdhAddEnglishCounterW

advapi32

AllocateAndInitializeSid
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
OpenProcessToken
GetTokenInformation
RegCloseKey
IsValidSid
LookupAccountSidW
RegEnumKeyExW
SystemFunction036
CheckTokenMembership
FreeSid
GetLengthSid
CopySid

user32

EnumDisplayMonitors
EnumDisplaySettingsExW
GetMonitorInfoW
GetWindowRect
GetDesktopWindow
MonitorFromPoint

gdi32

DeleteObject
CreateDCW
DeleteDC
CreateCompatibleBitmap
GetObjectW
StretchBlt
CreateCompatibleDC
GetDIBits
GetDeviceCaps
SetStretchBltMode
SelectObject

ws2_32

getsockopt
select
connect
WSAGetLastError
ioctlsocket
getaddrinfo
WSAStartup
closesocket
WSACleanup
WSASocketW
recv
WSASend
freeaddrinfo
setsockopt
WSAIoctl
send

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

ntdll

NtQuerySystemInformation
NtQueryInformationProcess
RtlNtStatusToDosError
NtWriteFile
NtReadFile
RtlGetVersion

bcrypt

BCryptGenRandom

iphlpapi

FreeMibTable
GetIfEntry2
GetIfTable2
GetAdaptersAddresses

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetUserGetInfo
NetUserEnum

secur32

LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData

powrprof

CallNtPowerInformation

oleaut32

SysFreeString
SysAllocString
VariantClear

psapi

GetPerformanceInfo
GetModuleFileNameExW

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp
wcslen

api-ms-win-crt-heap-l1-1-0

malloc
realloc
_set_new_mode
free
calloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_errno
terminate
_configure_narrow_argv
_initialize_narrow_environment
_wassert
abort
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_crt_atexit
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 833KB - Virtual size: 833KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 434KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

95a6df00399d356d08e078d74c217c74

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

pdh

advapi32

user32

gdi32

ws2_32

shell32

ole32

ntdll

bcrypt

iphlpapi

netapi32

secur32

powrprof

oleaut32

psapi

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 833KB - Virtual size: 833KB

.rdata Size: 434KB - Virtual size: 433KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 26KB - Virtual size: 25KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 833KB - Virtual size: 833KB

.rdata
Size: 434KB - Virtual size: 433KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 26KB - Virtual size: 25KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 6KB - Virtual size: 5KB