mtk[.]exe | Triage

Resubmissions

24-10-2023 18:49

231024-xgcqbagg7t 10

24-10-2023 18:43

231024-xcw86agg5y 3

Sharing

Copy URL

Twitter E-mail

General

Target

mtk.exe
Size

4.1MB
MD5

70c30480eb06b0183743d108788a2f2c
SHA1

84e4960ed1fad36636dde2be095e4ef330ba80e8
SHA256

732551a1d5097426140ce31fae1be56a76a8e4e1fe7f3f8f881541fb75f0df0a
SHA512

88f1555af06d66b62709e8f34241f14e9fdbdc56ee1aa847923509e2794637cee751d7e67993339542d9730f6953d5f96a8dec3e0e0b7cd3961c31f5086422b9
SSDEEP

49152:yJztu88Rw5yLMmRBOCWRgC4NqFgyMnQHhvwnKhTcF5UHsn3A1DNekUEmZT:tjFnkwssn3AN8E8T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

mtk.exe

resource
mtk.exe

Files

mtk.exe
.exe windows:6 windows x64

41fcf47aab45949cb6680dfe00cbee9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtWriteFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtDeviceIoControlFile
NtCreateFile
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
NtReadFile

kernel32

GetCurrentProcess
DuplicateHandle
GetSystemInfo
AcquireSRWLockExclusive
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetProcAddress
TryAcquireSRWLockExclusive
GetConsoleMode
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentThread
ReleaseSRWLockExclusive
GetCurrentProcessId
SetHandleInformation
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetConsoleWindow
CloseHandle
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
GetStdHandle
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
FindNextFileW
CreateFileW
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
UnhandledExceptionFilter
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetSystemTimeAsFileTime
GetTempPathW
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetLastError
GetFileInformationByHandle
FreeEnvironmentStringsW

user32

RemoveMenu
GetSystemMenu
SetForegroundWindow
GetWindowLongPtrW
SetWindowLongPtrW
GetForegroundWindow

advapi32

RegCloseKey
SystemFunction036
GetUserNameW
RegOpenKeyExW
RegQueryValueExW

ws2_32

bind
WSASocketW
getpeername
getsockname
ioctlsocket
getsockopt
shutdown
recv
send
closesocket
WSASend
setsockopt
WSAIoctl
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
connect

secur32

FreeCredentialsHandle
QueryContextAttributesW
DeleteSecurityContext
AcquireCredentialsHandleA
ApplyControlToken
DecryptMessage
FreeContextBuffer
AcceptSecurityContext
EncryptMessage
InitializeSecurityContextW

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3
memcmp
memcpy
__current_exception_context
memmove
memset
_CxxThrowException
__C_specific_handler
__current_exception

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
__p___argv
__p___argc
_exit
terminate
exit
_initialize_onexit_table
_initterm_e
_initterm
_get_initial_narrow_environment
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_crt_atexit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

41fcf47aab45949cb6680dfe00cbee9e

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

advapi32

ws2_32

secur32

crypt32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 16KB - Virtual size: 17KB

.pdata Size: 142KB - Virtual size: 141KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 16KB - Virtual size: 17KB

.pdata
Size: 142KB - Virtual size: 141KB

.reloc
Size: 22KB - Virtual size: 22KB