tc[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tc.exe
Size

7.9MB
MD5

2d22aa4f8e3e837f1a4744b7c5e8ca87
SHA1

98cdd18cf3b33b6c8159dd5f30afd60ac2279d7f
SHA256

e0b8243800d135f72235f93859f635a82b86558252922a32626f5257233c5f33
SHA512

854102a7725c44c2dc36e3f781198ed8a6c433501c4ad14b410b1191fcfe4ddfd1ac74a4a8bcb27932249f6d69fd8cb4a80507792c3f35bd13b6b04f40e3898d
SSDEEP

98304:pMiniAWOiOepbmCTamIR6liW9fg/QQtfddle+:pQmCT2cd+Ho

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tc.exe

Files

tc.exe
.exe windows:6 windows x64 arch:x64

3b844fee2f0f427546b6d4b5e2b11b0f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
SystemFunction036

kernel32

GetConsoleMode
SetConsoleMode
GetLastError
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
QueryPerformanceCounter
SetConsoleCursorInfo
SetConsoleCursorPosition
WaitForMultipleObjects
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
CreateFileW
TryAcquireSRWLockExclusive
GetCurrentThread
WaitForSingleObject
SwitchToThread
PostQueuedCompletionStatus
GetFileType
GetFileInformationByHandleEx
CreateIoCompletionPort
GetQueuedCompletionStatusEx
SetFileCompletionNotificationModes
GetSystemInfo
Sleep
GetModuleHandleA
GetProcAddress
QueryPerformanceFrequency
ReleaseMutex
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
GetModuleFileNameW
GetCurrentProcess
RtlCaptureContext
RtlLookupFunctionEntry
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetFullPathNameW
GetFinalPathNameByHandleW
SetHandleInformation
GetModuleHandleW
FormatMessageW
ExitProcess
MultiByteToWideChar
WriteConsoleW
CreateThread
GetSystemTimeAsFileTime
RtlVirtualUnwind
GetEnvironmentVariableA
WriteFile
FlsAlloc
FlsSetValue
FlsFree
GetProcessTimes
GetCurrentProcessorNumber
VirtualAlloc
VirtualFree
VirtualQuery
GetLargePageMinimum
FreeLibrary
GetNumaHighestNodeNumber
GetNumaNodeProcessorMask
WriteConsoleA
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

ntdll

NtReadFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtWriteFile

user32

GetWindowThreadProcessId
GetKeyboardLayout
ToUnicodeEx
GetForegroundWindow

ws2_32

WSAStartup
WSASend
freeaddrinfo
accept
getaddrinfo
getpeername
listen
getsockname
connect
send
recv
getsockopt
shutdown
WSAIoctl
WSAGetLastError
setsockopt
closesocket
bind
ioctlsocket
WSASocketW
WSACleanup

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler
__CxxFrameHandler3
memset
memcpy
memmove
memcmp
__current_exception_context
strstr
__current_exception

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_get_initial_narrow_environment
_configure_narrow_argv
_set_app_type
_initterm_e
exit
_exit
_seh_filter_exe
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_errno
_initterm
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
fputs
__acrt_iob_func
_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b844fee2f0f427546b6d4b5e2b11b0f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

user32

ws2_32

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 6.1MB - Virtual size: 6.1MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 17KB - Virtual size: 222KB

.pdata Size: 78KB - Virtual size: 77KB

.reloc Size: 49KB - Virtual size: 48KB

.text
Size: 6.1MB - Virtual size: 6.1MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 17KB - Virtual size: 222KB

.pdata
Size: 78KB - Virtual size: 77KB

.reloc
Size: 49KB - Virtual size: 48KB