mstsc[.]exe | Triage

Resubmissions

08/01/2024, 16:58

240108-vg44fsdhhp 3

08/01/2024, 16:57

240108-vgkptadhgp 3

Sharing

Copy URL Twitter E-mail

General

Target

mstsc.exe
Size

1.3MB
MD5

34aca6d3b1e243bfd23dc04d6ec44a49
SHA1

c7144aee24180d186565900f12a5717e896ea024
SHA256

2639f9f6b90d62d5b97cd958530a535adbd956da37a0d0656ce00af3f9d70718
SHA512

b9c0cb201c83ebe5153d6e320b3a72845ff2f57067605df758226a5e3b29c102414ce3967ec86e6c651b5126d9c1b5c62a9627f14e6c9b40f262119d71b47a86
SSDEEP

24576:xG+Q/Ze9zep+8Ka3RG4vpIldYVkxYtiPiG2MsLCSTbRQutwKcbFcf96/A3+xswtM:xG+Q/Ze9zep+8Ka3RG4vpIldYVkxYti4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mstsc.exe

Files

mstsc.exe
.exe windows:10 windows x64 arch:x64

6e2a23a42e5e177b23099091d574c61f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

IsRectEmpty
PtInRect
GetClassInfoW
DefDlgProcW
MonitorFromWindow
MessageBoxW
GetMenuItemCount
InsertMenuItemW
AllowSetForegroundWindow
CreateDialogParamW
DialogBoxParamW
LoadAcceleratorsW
CharNextW
MsgWaitForMultipleObjectsEx
PeekMessageW
SystemParametersInfoW
LoadStringW
RegisterClassW
SetProcessDPIAware
GetKeyboardLayout
CharLowerW
EnumDisplayDevicesW
FillRect
CheckRadioButton
DrawIconEx
GetWindow
MapDialogRect
ScreenToClient
SubtractRect
GetMonitorInfoW
GetWindowDC
GetFocus
DrawTextW
EnumDisplayMonitors
IsDlgButtonChecked
GetDlgItemTextW
CreateDialogIndirectParamW
EndPaint
DrawIcon
BeginPaint
SendDlgItemMessageW
MapWindowPoints
ReleaseDC
GetDC
IsWindowEnabled
RedrawWindow
UnregisterClassA
GetMenu
KillTimer
ShowWindowAsync
AdjustWindowRectEx
EnumDisplaySettingsExW
GetCursorPos
GetTitleBarInfo
SendInput
EqualRect
EnableWindow
IsWindowVisible
SetWindowRgn
SetWindowLongW
LockWindowUpdate
UpdateWindow
InvalidateRect
SetWindowTextW
EnableMenuItem
CheckMenuItem
SetMenuItemInfoW
UnregisterClassW
GetClassInfoExW
ShowWindow
MoveWindow
GetClientRect
SetWindowPlacement
GetWindowLongW
IsZoomed
LoadCursorW
SetCursor
ModifyMenuW
GetSystemMenu
GetMenuItemInfoW
DeleteMenu
CreateMenu
InsertMenuW
AppendMenuW
PostQuitMessage
IsWindow
DestroyIcon
LoadImageW
RegisterWindowMessageW
SetRect
CopyRect
GetDesktopWindow
SetWindowPos
IntersectRect
OffsetRect
SystemParametersInfoA
GetWindowRect
GetWindowPlacement
IsIconic
GetSystemMetrics
LoadIconW
SetForegroundWindow
DefWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
RegisterClassExW
IsChild
CreateWindowExW
DestroyWindow
GetDlgItem
SetFocus
SetDlgItemTextW
EndDialog
CheckDlgButton
SendMessageW
PostMessageW
PostThreadMessageW
IsDialogMessageW
TranslateAcceleratorW
DispatchMessageW
TranslateMessage
GetMessageW
CharUpperW
SetTimer

msvcrt

memcmp
?terminate@@YAXXZ
wcstok
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_acmdln
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
memmove
_amsg_exit
memcpy
calloc
_callnewh
iswdigit
towupper
_ltow_s
__CxxFrameHandler3
_wcslwr_s
towlower
wcstol
iswspace
toupper
wcstombs_s
_itow_s
wcstoul
wcschr
_wcsnicmp
_vsnprintf
swscanf_s
wcsstr
wcsftime
gmtime
_wtoi
wcsrchr
memset
pow
__getmainargs
wcsncmp
_wtol
wcstok_s
_wcsicmp
_purecall
wcscat_s
wcscpy_s
free
malloc
wcsncpy_s
__C_specific_handler
memcpy_s
_vsnwprintf
_XcptFilter
wcsncat_s
time
wcscmp

shlwapi

PathAppendW
PathFindFileNameW
StrStrIW
PathFindExtensionW
ShellMessageBoxW
PathRemoveFileSpecW
PathStripPathW

ntdll

RtlInitString
VerSetConditionMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError

api-ms-win-core-featurestaging-l1-1-0

RecordFeatureUsage
GetFeatureEnabledState
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shcore

SHStrDupW
SHCreateMemStream

dwmapi

DwmGetWindowAttribute

wtsapi32

WTSQuerySessionInformationW
WTSOpenServerW
WTSFreeMemory
WTSCloseServer

kernel32

GetModuleHandleW
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
InitializeCriticalSectionAndSpinCount
FindResourceW
LoadLibraryA
GetProcessId
TerminateThread
ProcessIdToSessionId
GetComputerNameW
InitOnceExecuteOnce
ExpandEnvironmentStringsW
LockResource
GetOverlappedResult
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
DisconnectNamedPipe
CreateThreadpoolIo
CancelThreadpoolIo
StartThreadpoolIo
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
QueueUserWorkItem
ResetEvent
CreateSemaphoreW
FreeLibraryAndExitThread
GetExitCodeThread
WaitForMultipleObjects
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerExW
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
WideCharToMultiByte
K32GetModuleFileNameExW
Sleep
HeapSetInformation
GetSystemDirectoryW
CreateProcessW
GetCurrentThread
GetTickCount64
WriteFile
VerifyVersionInfoW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesExW
GetTempPathW
CompareStringW
SetFilePointer
GetACP
GetFullPathNameW
CreateThreadpoolTimer
CompareStringOrdinal
GetFileAttributesW
LocalAlloc
CreateDirectoryW
SearchPathW
GetCurrentDirectoryW
LocalFree
LoadLibraryW
GetCurrentProcess
TerminateProcess
GetStartupInfoA
MulDiv
lstrcmpW
GetVersionExA
GetVersionExW
ReadFile
GetFileSize
CreateFileW
GetDateFormatW
GetTimeFormatW
GetLocalTime
DeleteFileW
CreateThread
CreateEventW
DeleteCriticalSection
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCommandLineW
GetModuleHandleExA
GetModuleFileNameW
FindResourceExW
SystemTimeToFileTime
MapViewOfFile
CreateFileMappingW
LCIDToLocaleName
UnmapViewOfFile
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
DelayLoadFailureHook
ResolveDelayLoadedAPI
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
LoadLibraryExW
FreeLibrary
IsDebuggerPresent
DebugBreak
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
CloseThreadpool
TrySubmitThreadpoolCallback
GetSystemTime
QueryPerformanceFrequency
TlsSetValue
OpenThread
TlsFree
TlsGetValue
SwitchToThread
GetSystemInfo
TlsAlloc
CloseThreadpoolCleanupGroup

normaliz

IdnToAscii

api-ms-win-core-path-l1-1-0

PathCchRemoveExtension
PathAllocCombine

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

6e2a23a42e5e177b23099091d574c61f

Headers

DLL Characteristics

File Characteristics

Imports

user32

msvcrt

shlwapi

ntdll

api-ms-win-core-featurestaging-l1-1-0

version

shcore

dwmapi

wtsapi32

kernel32

normaliz

api-ms-win-core-path-l1-1-0

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 192KB - Virtual size: 188KB

.data Size: 4KB - Virtual size: 10KB

.pdata Size: 40KB - Virtual size: 38KB

.didat Size: 4KB - Virtual size: 2KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 192KB - Virtual size: 188KB

.data
Size: 4KB - Virtual size: 10KB

.pdata
Size: 40KB - Virtual size: 38KB

.didat
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 12KB - Virtual size: 8KB