VeeamManageClient[.]exe | Triage

Resubmissions

13-02-2024 05:55

240213-gmt9jsbb68 3

13-02-2024 05:38

240213-gbrz2sfg6w 3

Sharing

General

Target

VeeamManageClient.exe
Size

39KB
MD5

a56012610e82f692cbcd80ea54cfc522
SHA1

722d883a8b8737bd0bf92901671b9c758b6a706b
SHA256

4ae9f46399bb088df9b59fea4f80f3448e9b3937476a10ab5af00e7b80a8597e
SHA512

b22147f325a9a2276a6c7d23b18bc5dfda9fc921817865566d5ebf5a1fac139746ec88885844a523018fb219e082c7c2f69341b7711168540be0a1fb8137aacb
SSDEEP

768:KPKylEHlFZMC+t2FHyfcvF4FYY1A+84ykatVST5:KCfR2cvmW48s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VeeamManageClient.exe

Files

VeeamManageClient.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\dominic\Desktop\ews\PowershellEmbed\iisrunpowershellwithotpowershell\obj\Release\iisrunpowershellwithotpowershell.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ