madrigal[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

madrigal.exe
Size

7.0MB
MD5

08791dff0f3b35dc997569faa59594ae
SHA1

a6225e1e562dfc5756c0e126442f9cbbcc2ee8e7
SHA256

f25637fb74e0b85fa98da13f43f13f344194e26290fad34172d17d433530a2f5
SHA512

228133ab3814c16f32d69c18674ed0c3d3b8ff0d997cbcb7f47d10b416b3f35f61d479f96298891974e691ea88386deba862431d679d266743082d997cb5c745
SSDEEP

49152:8OIU6iUGtlqCVwASODegShViv2IIYLZ+gMxLUXTICG3EIkzToXsjW0b/jwxG4yqt:G+J9xlmxk80b//dskA02yubN0buvDe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
madrigal.exe

Files

madrigal.exe
.exe windows:6 windows x64 arch:x64

b80f133435f44a8164d3e8c86a58e3d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
CreateEventW
CreateWaitableTimerA
SleepEx
TlsGetValue
CreateIoCompletionPort
CreateMutexA
GetModuleFileNameA
GetFullPathNameW
TerminateProcess
K32GetModuleFileNameExW
InitializeCriticalSectionEx
OpenProcess
DecodePointer
CreateProcessA
WriteProcessMemory
VirtualAlloc
ResumeThread
GetThreadContext
VirtualAllocEx
SetThreadContext
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
CloseHandle
CreateFileW
DeviceIoControl
GetSystemFirmwareTable
GlobalUnlock
WideCharToMultiByte
GlobalLock
ReadConsoleA
SetConsoleMode
LoadLibraryW
SetLastError
GetSystemDirectoryA
VirtualFree
TlsSetValue
SetWaitableTimer
FormatMessageA
TlsFree
DeleteCriticalSection
LocalFree
QueueUserAPC
TlsAlloc
GlobalFree
GlobalAlloc
GlobalSize
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
HeapSize
GetTimeZoneInformation
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
TerminateThread
SetEvent
GetLastError
PostQueuedCompletionStatus
Sleep
WaitForSingleObject
ReadConsoleW
GetConsoleMode
SetFilePointerEx
WriteFile
GetStdHandle
GetModuleFileNameW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LeaveCriticalSection
WaitForMultipleObjects
EnterCriticalSection
GetEnvironmentVariableW
QueryPerformanceCounter
PeekNamedPipe
GetFileType
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
SetConsoleCtrlHandler
LoadLibraryExW
RtlUnwind
InterlockedPushEntrySList
RtlUnwindEx
OutputDebugStringW
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
LCMapStringEx
CreateFileA
GetFileSizeEx
ReadFile
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetSystemTime
SystemTimeToFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
GetLocaleInfoEx
RtlPcToFileHeader
RaiseException
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
ReleaseSRWLockShared
AcquireSRWLockShared
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
WaitForSingleObjectEx
GetExitCodeThread
EncodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeSRWLock
GetSystemTimeAsFileTime
MultiByteToWideChar

user32

GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
ReleaseDC
SetCursorPos
IsIconic
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
SetForegroundWindow
ReleaseCapture
RegisterClassExA
SetWindowLongPtrA
IsWindowUnicode
IsClipboardFormatAvailable
GetClientRect
SetWindowLongW
SetCursor
SetCapture
BringWindowToTop
SetFocus
SetLayeredWindowAttributes
CreateWindowExA
DefWindowProcA
GetForegroundWindow
GetMonitorInfoA
TrackMouseEvent
IsChild
ClientToScreen
SetWindowLongA
GetCapture
ShowWindow
WindowFromPoint
SetWindowTextW
ScreenToClient
SetClipboardData
UnregisterClassA
EnumDisplayMonitors
GetWindowThreadProcessId
EnumWindows
GetClassNameW
DispatchMessageA
TranslateMessage
PeekMessageA
UpdateWindow
GetAsyncKeyState
PostQuitMessage
GetWindowRect
GetDesktopWindow
GetSystemMetrics
GetWindowLongW
AdjustWindowRectEx
GetKeyState
GetMessageExtraInfo
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow

gdi32

GetDeviceCaps

advapi32

ReportEventW
RegOpenKeyA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
DeregisterEventSource
RegisterEventSourceW

shell32

SHCreateItemFromParsingName
SHGetKnownFolderPath

ole32

CoUninitialize
CoInitialize
CoTaskMemFree

dxgi

CreateDXGIFactory

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

__WSAFDIsSet
accept
bind
WSAIoctl
select
recv
send
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
socket
listen
WSASocketW
getaddrinfo
getsockname
connect
WSARecv
freeaddrinfo
closesocket
WSAStartup
WSACleanup
WSAGetLastError
setsockopt
ioctlsocket
htons
htonl
getsockopt
WSAAddressToStringW
ntohs
getpeername
WSASetLastError
shutdown
ntohl
WSASend

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory

bcrypt

BCryptGenRandom

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertCloseStore
CertOpenStore

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 95KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 202KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b80f133435f44a8164d3e8c86a58e3d4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

dxgi

imm32

dwmapi

ws2_32

d3d9

d3dx9_43

bcrypt

crypt32

Sections

.text Size: 4.9MB - Virtual size: 4.9MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 95KB - Virtual size: 140KB

.pdata Size: 202KB - Virtual size: 201KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 52KB - Virtual size: 51KB

.text
Size: 4.9MB - Virtual size: 4.9MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 95KB - Virtual size: 140KB

.pdata
Size: 202KB - Virtual size: 201KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 52KB - Virtual size: 51KB