Nezur[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nezur.exe
Size 2.3MB
Sample240302-3cexrsag24
SHA256 68fc232535a29649d46dc5f9108a2a59b2b4ef7aad09fa675b497c7f1b585d1b
MD5 490ff45ffb331fe7d1af3e8be7505943
SHA1 3dbaf10c1b701299d1a2e805b6a007f4e22e028d
SHA512 79ccefd495dfde1ddcd28ac57aa6033ba6b08255ee4ec6b844d716adf25fc74cc7e77fb68696af617563969eef2c5d5bbd982c124b5c5eed3e79eacf21363bb2
SSDEEP 24576:uR+gKf3Iv02rq6s1Hm3MRWj3D2CotikzCEkXuSMOSByL8X:X/Ue6MG8A3eCISMOSB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nezur.exe

File Explorer

Nezur.exe

.exe 2.3MB

Nezur.exe

IMPHASH 3a63ee6883f410f4614ea25e2499f959
SHA256 68fc232535a29649d46dc5f9108a2a59b2b4ef7aad09fa675b497c7f1b585d1b
MD5 490ff45ffb331fe7d1af3e8be7505943
SHA1 3dbaf10c1b701299d1a2e805b6a007f4e22e028d
SHA512 79ccefd495dfde1ddcd28ac57aa6033ba6b08255ee4ec6b844d716adf25fc74cc7e77fb68696af617563969eef2c5d5bbd982c124b5c5eed3e79eacf21363bb2
SSDEEP 24576:uR+gKf3Iv02rq6s1Hm3MRWj3D2CotikzCEkXuSMOSByL8X:X/Ue6MG8A3eCISMOSB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1669388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\vs_source_files\rbx-external-base\Build\Esp\external-sdk.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

connect getsockname htonl listen recv getaddrinfo freeaddrinfo recvfrom sendto getpeername ioctlsocket gethostname WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSASetLastError WSAGetLastError WSACreateEvent WSACloseEvent bind getsockopt accept select __WSAFDIsSet socket htons WSAIoctl setsockopt WSACleanup send WSAStartup ntohs WSAEnumNetworkEvents

normaliz

IdnToAscii IdnToUnicode

advapi32

AllocateAndInitializeSid CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegCreateKeyA LookupPrivilegeValueW SetSecurityDescriptorDacl AdjustTokenPrivileges RegOpenKeyA RegDeleteKeyA LookupPrivilegeValueA RegSetValueExA AddAccessDeniedAce OpenProcessToken FreeSid InitializeSecurityDescriptor InitializeAcl SetKernelObjectSecurity GetLengthSid RegCloseKey ConvertSidToStringSidA CopySid SetSecurityInfo IsValidSid GetTokenInformation AddAccessAllowedAce CryptEncrypt CryptImportKey CryptDestroyKey RegQueryValueExA RegOpenKeyExA CryptDestroyHash CryptHashData

crypt32

CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertGetCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CertFreeCertificateChain CertEnumCertificatesInStore CertFreeCertificateChainEngine

wldap32

ord211 ord46 ord217 ord143 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60

kernel32

GetFileInformationByHandleEx AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetModuleHandleW GetModuleFileNameW CreateFileMappingW FormatMessageA GetLocaleInfoEx WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW QueryFullProcessImageNameW GetModuleFileNameA Sleep QueryPerformanceFrequency QueryPerformanceCounter MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA GetProcAddress VerSetConditionMask FreeLibrary VirtualFree DeviceIoControl VirtualAlloc LoadLibraryExA GetCurrentProcessId VirtualQuery GetConsoleWindow SetConsoleTextAttribute SetConsoleTitleA GetStdHandle SetCurrentConsoleFontEx SetConsoleWindowInfo AllocConsole GetCurrentProcess CloseHandle Process32First Module32Next WaitForSingleObject LocalAlloc Module32First CreateToolhelp32Snapshot GetLastError CreateFileA Process32Next LocalFree GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent CreateEventA GetSystemDirectoryA GetEnvironmentVariableA SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx GetFileType PeekNamedPipe WaitForMultipleObjects SleepEx VerifyVersionInfoW CreateFileW HeapDestroy HeapSize CreateThread VirtualProtect

user32

EnableMenuItem UpdateWindow SendInput GetAsyncKeyState SetWindowLongA DefWindowProcA SetLayeredWindowAttributes FindWindowA LoadImageA DispatchMessageA GetWindowRect DestroyWindow GetWindowLongA MoveWindow RegisterClassA CreateWindowExA TranslateMessage ShowWindow UnregisterClassA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetSystemMenu SetWindowPos MessageBoxA ShowScrollBar PeekMessageA

shell32

SHGetKnownFolderPath ShellExecuteA

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Xtime_get_ticks ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Thrd_detach _Query_perf_counter _Query_perf_frequency _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ??Bios_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

ntdll

RtlVirtualUnwind RtlAnsiStringToUnicodeString RtlInitAnsiString RtlCaptureContext NtQuerySystemInformation RtlLookupFunctionEntry

dbghelp

ImageNtHeader ImageDirectoryEntryToData ImageRvaToVa

bcrypt

BCryptGenRandom

shlwapi

PathFindFileNameW

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException memchr memcmp memmove strrchr __std_terminate memcpy __C_specific_handler strstr strchr __std_exception_copy __std_exception_destroy memset

api-ms-win-crt-heap-l1-1-0

malloc calloc realloc free _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

__p___argv _beginthreadex _errno system _register_thread_local_exe_atexit_callback __sys_errlist __sys_nerr _c_exit _invalid_parameter_noinfo_noreturn __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _invalid_parameter_noinfo _seh_filter_exe _resetstkoflw _cexit abort exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate

api-ms-win-crt-string-l1-1-0

strncmp strpbrk _strdup strncpy strcmp strcspn tolower strspn _stricmp

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fseek freopen_s _popen _pclose fclose _lseeki64 _set_fmode fputs setvbuf fgets ftell _open feof __p__commode fwrite _get_stream_buffer_pointers _read _write _fseeki64 _fileno _close fsetpos __stdio_common_vswprintf __stdio_common_vsprintf _wfopen fread __stdio_common_vsscanf ungetc fopen fgetpos fflush fgetc fputc __acrt_iob_func

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _gmtime64 strftime

api-ms-win-crt-convert-l1-1-0

wcstombs strtol strtoll strtod atof strtoull atoi strtoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_access _stat64 _fstat64 _unlock_file _lock_file _unlink

api-ms-win-crt-math-l1-1-0

ceilf sinf cosf _fdopen __setusermatherr _dsign floorf fmodf _dclass acosf sqrtf

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func