Tandbyld206[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Tandbyld206.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 72368b8044cbc2406d974a17f5e53b456bc2cc26afafaf4f215faffa003b0054
MD5 0ae314d41b6bad7b4d1b37f12ccd5e9f
SHA1 c3fa2a7fca69d7951b87a7dd4cfa5ac5d53db222
SHA512 fc8cfa1bf89cd4976cdea5f551772e7a514e6e3cca3e5cc4ac144910d8d426e91851b2b3b2182efc4c9bce10ab57da14f825ee5bdbaeb36ceb4b813503670a43
SSDEEP 6144:ayINO+ZYJH4Zbnqd5+y9KtXbJWTmsam76Tu6cRb36biwVFTe7nAJHRQKHVvxZ:0FCJH4N9ykbJ8msf6S6cR76bvxNJZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ab:92:fc:23:30:40:07:b4:54:e5:4e:ad:d8:dd:ae:7b:d0:bc:93:30:18:62:d8:fd:c5:96:44:02:1e:06:56:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bigeminate,OU=Southernmost Physicianless\ ,O=Bigeminate,L=Rezé,ST=Pays de la Loire,C=FR,1.2.840.113549.1.9.1=#0c1547757368696572404d6978656465733230372e4a65

Chains

May 3, 2024

PE Signature issue

Digest

84:36:70:1b:91:b9:38:cc:89:c4:9f:40:2c:f6:0c:6d:40:01:9f:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bigeminate,OU=Southernmost Physicianless\ ,O=Bigeminate,L=Rezé,ST=Pays de la Loire,C=FR,1.2.840.113549.1.9.1=#0c1547757368696572404d6978656465733230372e4a65

Chains

May 3, 2024

Minor OS version

0

Major OS version

4

Entry point

12672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Aragonspath.txt

SHA256 2e56dc8612cc97bf7a6bf4efc14480cdbc3d56af2ed8df18ef54e0882509701c
MD5 85496a03852e001a8373b1c949de3801
SHA1 10fc15070efe0bf4461bb8c95ccc5a5a4c2fcb44
SHA512 71cc130461ede5ac09fe3fb610e8041aca99ff8906180e7759909901ca13858289472806cbde1e6eb7808b7939189790b2b6882dc2c72155f022df6cd88d944e
MD5 SHA1 SHA512

NSIS installer

installer

Bommerters.vid

SHA256 6abfa429d0ecad1799a4b6f79b4b23c5f762d22b80ba6b030f2ffeef1b3fcd77
MD5 542b7214364e00118fab2d1f55c4c8c1
SHA1 8345a9c0f1f9a772b29a080585e9a18858550340
SHA512 a9e815349c240d36aef6eea8a6a41c83b9e9c7bee35653f354d5fa14cc7e60ecfe8470d761a6d3041ff2e32842bcb1a38efcc7a9de2d1006e02ea7e234fd64c7
SSDEEP 3072:x3JwVk+4tbgBTflraZmbyYs/EUc4BqEivXRa/pmktXJ1NuIxt:x5gk+HBVQ3uUc4MZa/pl7f
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Packboard243/Unvociferous.Mal

SHA256 15a85d7693708e92a4dffd0a33b806789d895e65836cc4cd8aebc98cbd8cbc8d
MD5 a8584ffb11b8ecacbf574fced684ea86
SHA1 f78ed54568bcfc89964541882a421f6cc4029077
SHA512 b7c2cb7530e94601841aba315161e3931521069015d2717cbcde55b9a38c4f0d1421fd79a7681ef1e63532b9c8375ee5404bc268aba82861ef975901ba35ca57
SSDEEP 3072:Wmld72S8r2dyjHyrmGvICUy23Sr55QzbB:Wmld8UyjHGm+4RCr5SzbB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Packboard243/cambrics.reb

SHA256 bc1d9684c776ca490944b1df273d09de2f6d14739f43de15697d4641ef276332
MD5 2d6feaa1f83349c9528084b0e5349256
SHA1 96d29af9d634c59317c822572e169e553e0d4631
SHA512 bdfc7b7d08b23c5577da19cfdc97ca84cef11aad9f2bb1491b6ff98316c3c37c743396a8b793d03782a1e2605741f3c266165b1ce316fbd695e07101b7120ccd
MD5 SHA1 SHA512

NSIS installer

installer

Packboard243/formuerettens.twa

SHA256 032d9f554a3029d2f4c6608bac49da736e7a52912abd276028aa374916cb1a8c
MD5 033211c6a4f10b0bcb249bd30770cb7d
SHA1 f772d9a75adee19d7034f28e24afca26cb1e1651
SHA512 ccba8d95418e8cf75857b980c563b2e72e719062c8fc2945d22cda8d612004176c6193a0f51972176a23a25a4f8d69ba048e32c3ffcd99a06187b114ed9ddcb9
MD5 SHA1 SHA512

NSIS installer

installer

Packboard243/gudfars.tat

SHA256 31536a7279bd7499597ba2385da73b67b01a1647f3ba994ba25cd7cfb532452d
MD5 fed717d3cb21adadeeef1b60f1b5845c
SHA1 b6d6ce948f482d740586dfcddf316aebd8a6ed1b
SHA512 8e05fe41eaef107283f2d7fb5575db9876a5f85c3a8a304ce916fbab2212378b8ec88f2bdf91c897939eae7e1eca9ad6468aca5c33379e2d03f65175e1dc9ec0
MD5 SHA1 SHA512

NSIS installer

installer

Packboard243/instructors.cha

SHA256 8829e429c8de49c9ffb86988fd7cdf1d179c095ff3a0013ea5af03e46e73b36d
MD5 15ebbe8429b9e4c21920657e4c322fa9
SHA1 ca3160a9a01997d88dcc89c2dfb4cda1333a05ee
SHA512 dd3be3b88f42f1693c7a7c7dd07f9613b3d81368b988b7bf79696d102fc86c5dd49d1534ce77e394c634e01277f398b353543147ab78e9176c4b7126bba52390
MD5 SHA1 SHA512

NSIS installer

installer

Packboard243/librettoerne.ven

SHA256 7ec9a8e2c37a4402f3e35d63821bd7676345ae7ece2adeb9f4494f6645608d68
MD5 fdeb16a9c3a30711f900ffdafbe10b00
SHA1 7cdbfaa23bb48f829e4acebc225e703392204c00
SHA512 f0124fb6aaeb61ce2e89f20cc229f743cbbfcab72b4e7623f465bbbe8c0eb28e9522a9abb78af3ab0f1141f4798e642a5f1a17f0b024baff730907f0f0889a2c
MD5 SHA1 SHA512

NSIS installer

installer

Tandbyld206.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aragonspath.txt

Bommerters.vid

Packboard243/Unvociferous.Mal

Packboard243/cambrics.reb

Packboard243/formuerettens.twa

Packboard243/gudfars.tat

Packboard243/instructors.cha

Packboard243/librettoerne.ven

Sharing

General

Malware Config

Signatures

File Explorer

Tandbyld206.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Aragonspath.txt

Bommerters.vid

Packboard243/Unvociferous.Mal

Packboard243/cambrics.reb

Packboard243/formuerettens.twa

Packboard243/gudfars.tat

Packboard243/instructors.cha

Packboard243/librettoerne.ven