hatch[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hatch.exe
Size

3.8MB
MD5

3d81dba29c92788fec342ff529acd0da
SHA1

578a99d61f5850c6c030b6e1d3380bf814b27355
SHA256

14808357b9e4d1ccb14f6b0d559d8358b027a026bd7115641524704a2ccdfe20
SHA512

d9970dbdc9743cf299a598ee9c699238f9501f134830ba1d486ba83ab64f65a2a071dd2479f71f6ae05997cc0eae554aa2530479f5272ff386e87acaea738061
SSDEEP

49152:R4AFXhPR7mNc/yQnqCq82LwFPs7BERIPWhkcdljWSNEWzYng30XgB6qNQTIqpYI1:2SgBQRdljWkB3PB6q0pn+Q/Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hatch.exe

Files

hatch.exe
.exe windows:6 windows x64 arch:x64

2f433c0c9a4913ad3590e7bd080236be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptGenRandom

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036

ntdll

RtlVirtualUnwind
NtReadFile
NtWriteFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
RtlCaptureContext
NtCreateFile
RtlLookupFunctionEntry

kernel32

SetFileTime
GetStdHandle
GetConsoleMode
SetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
GetFileInformationByHandleEx
SetFileAttributesW
MoveFileExW
SetConsoleTextAttribute
lstrlenW
SetFileCompletionNotificationModes
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
GetQueuedCompletionStatusEx
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
CreateIoCompletionPort
GetCommandLineW
SetFileInformationByHandle
SetFilePointerEx
PostQueuedCompletionStatus
GetCurrentProcessId
WriteFileEx
SleepEx
GetExitCodeProcess
TerminateProcess
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
HeapFree
SetHandleInformation
HeapReAlloc
ReleaseMutex
GetModuleHandleA
GetProcAddress
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
CreateDirectoryW
FindFirstFileW
DeleteFileW
CreateSymbolicLinkW
CreateHardLinkW
GetFinalPathNameByHandleW
CopyFileExW
GetFileType
GetSystemInfo
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetSystemTimeAsFileTime
GetTempPathW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CreatePipe
DuplicateHandle
GetCurrentProcess
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
SetThreadStackGuarantee

ws2_32

WSASend
send
shutdown
getpeername
getsockname
getsockopt
ioctlsocket
connect
bind
WSASocketW
closesocket
setsockopt
WSAIoctl
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
recv

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

vcruntime140

memcpy
__C_specific_handler
__CxxFrameHandler3
__current_exception
memset
memmove
__current_exception_context
memcmp

api-ms-win-crt-math-l1-1-0

trunc
__setusermatherr
round
truncf
pow
ceil

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-runtime-l1-1-0

exit
_initterm_e
_initialize_narrow_environment
_get_initial_narrow_environment
_seh_filter_exe
terminate
_crt_atexit
_register_onexit_function
_initterm
_initialize_onexit_table
_exit
_configure_narrow_argv
_set_app_type
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f433c0c9a4913ad3590e7bd080236be

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

advapi32

ntdll

kernel32

ws2_32

shell32

ole32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 16KB - Virtual size: 18KB

.pdata Size: 51KB - Virtual size: 50KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 16KB - Virtual size: 18KB

.pdata
Size: 51KB - Virtual size: 50KB

.reloc
Size: 24KB - Virtual size: 23KB