Nezur[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nezur.exe
Size 2.2MB
Sample240404-ty4ctacd6x
SHA256 6d49421c010e7b3bd7a0d1fa1585f3edc97a74ab675eb054d40e280a625fb385
MD5 def751a85aebdc495fae528d2b492e93
SHA1 3a4cb75e77f9efdda26f15c71ae8d16ccaa7a763
SHA512 5b5279ccb60e5e8c68d1e38c26f4ce352ff5d7ee67853e328b69a410881263ea946373354526c63eef4ee85db258b92c9c085c9824f72e46ecebafb31f58d210
SSDEEP 24576:/cTt35gF0ayuhEZodhNLmzRNTEQ7qscne2yXL4tWrZgQ7jMRQ5y09aagTljjkx:+qF0ppZoTSFEQW7RG48MRQ5Papljj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nezur.exe

File Explorer

Nezur.exe

.exe 2.2MB

Nezur.exe

IMPHASH 225e68682678f32a8150300555031615
SHA256 6d49421c010e7b3bd7a0d1fa1585f3edc97a74ab675eb054d40e280a625fb385
MD5 def751a85aebdc495fae528d2b492e93
SHA1 3a4cb75e77f9efdda26f15c71ae8d16ccaa7a763
SHA512 5b5279ccb60e5e8c68d1e38c26f4ce352ff5d7ee67853e328b69a410881263ea946373354526c63eef4ee85db258b92c9c085c9824f72e46ecebafb31f58d210
SSDEEP 24576:/cTt35gF0ayuhEZodhNLmzRNTEQ7qscne2yXL4tWrZgQ7jMRQ5y09aagTljjkx:+qF0ppZoTSFEQW7RG48MRQ5Papljj
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1675980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\vs_source_files\rbx-external-base\Build\Esp\external-sdk.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

listen recv getaddrinfo freeaddrinfo htonl sendto getpeername ioctlsocket gethostname WSACreateEvent recvfrom WSAEnumNetworkEvents send WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSACloseEvent getsockname WSASetLastError connect bind accept select __WSAFDIsSet socket htons WSAIoctl WSAGetLastError setsockopt WSACleanup getsockopt ntohs WSAStartup

normaliz

IdnToUnicode IdnToAscii

advapi32

GetLengthSid OpenProcessToken FreeSid InitializeSecurityDescriptor InitializeAcl SetKernelObjectSecurity RegCloseKey RegQueryValueExA RegOpenKeyExA RegSetValueExA LookupPrivilegeValueA AllocateAndInitializeSid RegDeleteKeyA RegOpenKeyA AdjustTokenPrivileges SetSecurityDescriptorDacl LookupPrivilegeValueW RegCreateKeyA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash ConvertSidToStringSidA CopySid SetSecurityInfo IsValidSid GetTokenInformation AddAccessAllowedAce CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData AddAccessDeniedAce

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CertOpenStore CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

wldap32

ord46 ord217 ord143 ord211 ord60 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord45 ord22 ord41 ord50

kernel32

FormatMessageA GetFileInformationByHandleEx GetLocaleInfoEx GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW AreFileApisANSI QueryFullProcessImageNameW GetModuleHandleW InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetModuleFileNameA Sleep QueryPerformanceFrequency QueryPerformanceCounter MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA GetProcAddress VerSetConditionMask FreeLibrary VirtualFree DeviceIoControl VirtualAlloc LoadLibraryExA GetCurrentProcessId VirtualQuery GetConsoleWindow SetConsoleTextAttribute SetConsoleTitleA GetStdHandle SetCurrentConsoleFontEx SetConsoleWindowInfo AllocConsole GetCurrentProcess CloseHandle Process32First Module32Next WaitForSingleObject LocalAlloc Module32First CreateToolhelp32Snapshot GetLastError CreateFileA Process32Next LocalFree GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent CreateEventA GetSystemDirectoryA GetEnvironmentVariableA SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx GetFileType PeekNamedPipe WaitForMultipleObjects SleepEx VerifyVersionInfoW CreateFileW HeapDestroy HeapSize CreateThread VirtualProtect CreateFileMappingW GetModuleFileNameW

user32

EnableMenuItem UpdateWindow SendInput GetAsyncKeyState SetWindowLongA DefWindowProcA SetLayeredWindowAttributes FindWindowA LoadImageA DispatchMessageA GetWindowRect DestroyWindow GetWindowLongA MoveWindow RegisterClassA CreateWindowExA TranslateMessage ShowWindow UnregisterClassA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxA GetSystemMenu SetWindowPos ShowScrollBar PeekMessageA

shell32

SHGetKnownFolderPath ShellExecuteA

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Xtime_get_ticks ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Thrd_detach _Query_perf_counter _Query_perf_frequency _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ??Bios_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?good@ios_base@std@@QEBA_NXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

ntdll

RtlVirtualUnwind RtlAnsiStringToUnicodeString RtlInitAnsiString RtlCaptureContext NtQuerySystemInformation RtlLookupFunctionEntry

dbghelp

ImageNtHeader ImageDirectoryEntryToData ImageRvaToVa

bcrypt

BCryptGenRandom

shlwapi

PathFindFileNameW

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException memchr memcmp memmove __current_exception_context memcpy __C_specific_handler strstr strchr __std_exception_copy __std_exception_destroy __std_terminate memset strrchr

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode _callnewh free calloc malloc

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate abort _errno __sys_errlist __sys_nerr system _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _invalid_parameter_noinfo _initterm _resetstkoflw _get_initial_narrow_environment exit _set_app_type _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe

api-ms-win-crt-string-l1-1-0

_stricmp strncmp strspn strncpy _strdup tolower strcspn strcmp strpbrk

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-stdio-l1-1-0

fflush fclose fseek fputs _popen _set_fmode _pclose __stdio_common_vfprintf _lseeki64 __stdio_common_vswprintf freopen_s fgets __p__commode ftell feof _read _write _get_stream_buffer_pointers _fileno _close _fseeki64 __stdio_common_vsprintf fwrite __acrt_iob_func _wfopen fsetpos ungetc setvbuf fread fgetpos __stdio_common_vsscanf fgetc fputc _open fopen

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _gmtime64 strftime

api-ms-win-crt-convert-l1-1-0

atof strtoull strtoul wcstombs strtod strtoll strtol atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_access _stat64 _fstat64 _lock_file _unlock_file _unlink

api-ms-win-crt-math-l1-1-0

sinf _dsign _fdopen __setusermatherr acosf ceilf cosf _dclass floorf fmodf sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func