Cumacean[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Cumacean.exe

IMPHASH e871f39e81b4aa977737b07cee050825
SHA256 1f7f8fa2a0d1850a1753edd61fc2ddfd67031a15b65929469c044dc8c751de03
MD5 d9ad627096015371e1d4db92375bc6ff
SHA1 c625bbef9ca680e05e6d426ef1417086d059cd94
SHA512 9573885810921efacaa924e48069cd04adbc0f1003a94318734233a570c495d91f6e1dc6ab02e078ebd17cdceb1a616636f6799dc737aae281e9cd4681df6aa3
SSDEEP 6144:Ek62PBHbekcwi+GGKPNYLsJbRGryWCP3fI/C:BpaGgvfRRGrK4a
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

db:c6:5e:0d:6d:c5:8d:52:c5:d3:38:8a:a3:9f:2f:e2:ea:47:3b:12:a6:9b:ea:e8:3b:20:2a:f9:7b:8d:91:ac

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Denitrifikation Karenstider Drachmanns\ ,O=Omfangsmaessige,L=La Tronche,ST=Auvergne-Rhône-Alpes,C=FR,1.2.840.113549.1.9.1=#0c1b4163636f756368656d656e74404d69736f67616c6c69632e506563

Chains

Nov 27, 2023

Minor OS version

1

Major OS version

5

Entry point

13515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegQueryValueExA RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA SetFileSecurityA RegCreateKeyExA RegOpenKeyExA

shell32

ShellExecuteExA SHBrowseForFolderA SHFileOperationA SHGetPathFromIDListA SHGetFileInfoA SHGetSpecialFolderLocation

ole32

OleUninitialize IIDFromString OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

SystemParametersInfoA LoadCursorA SetClassLongA GetWindowLongA ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuA EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA DispatchMessageA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA SetWindowLongA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA PeekMessageA SetDlgItemTextA MessageBoxIndirectA CharPrevA CallWindowProcA GetDlgItemTextA GetSysColor

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectA

kernel32

WriteFile GetTempFileNameA GetLastError WaitForSingleObject ReadFile CreateFileA CreateDirectoryA lstrcpynA GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceA CopyFileA lstrlenA GetVersionExA GetWindowsDirectoryA ExitProcess GetExitCodeProcess SetErrorMode GetTempPathA SetEnvironmentVariableA GetCommandLineA GetModuleFileNameA GetTickCount GetFileSize MultiByteToWideChar MoveFileA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA ExpandEnvironmentStringsA RemoveDirectoryA CreateProcessA WideCharToMultiByte GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA MoveFileExA GetCurrentProcess

$PLUGINSDIR/Banner.dll

IMPHASH 2b2f33529e896a18f9e0cdb98bb9d6ab
SHA256 37f3514571476a739a26d86bf0bfb7f41f7a56fc30a9bf43f9381d0eb4df22d6
MD5 ab67c38251627bdd59af50c52deda52c
SHA1 2eaf5464a294a5c5aa77ae757893be6f59e0e087
SHA512 b9af9182d4f15cfb8547fc93ecd17aa95c2c65fe45b41c8fdb25752f54bfce397b371dae3a31e15f697047f8037c34e88daa83867d96e93cade57737c9b35afd
MD5 SHA1 SHA512

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4396

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 595a3fd71239f605bb02d7a5e48fd4df
SHA256 e32b35cde7c6e2c967445de92884684db7fda506ea52b9aaa74c1a33dd2fdfe6
MD5 55f18cafe28167995629fdeae4f07bdf
SHA1 a6bd9310f4408c86149993d1e8833d35dd16bb23
SHA512 113e7a9e1958bea6a045a7120adf6c667880b9b1d90ff7790e2004f3954f9358a5e44ceb6be0c3b32ff8e6a06878a0f22be7206d0b5a6c5392ca30b8c3bff8ce
SSDEEP 192:sj9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6YV:qJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 96cabceb30af6fc52810e26202e5e11a
SHA256 b170d492cedc29719d27092c29ae1c71bc0b4d9c7df5707b44ac748bc394967f
MD5 f294cfefcf2f306696944427ef551de5
SHA1 6ae91bc7706e0dc0e882f2648277ffc9437a5f8b
SHA512 da8b57a3b9256aa6f5e8a33399eea9fb154f9463dfcb297b67419f540049cca9450ce81fe5d3dffad3d8708f300c9453d64add8e81e8dd48b6bae0f1053f116e
SSDEEP 96:jWIKf21CuHq37MPuQ7rA9auHav8ZwK03cONByZyImHcAqgvB05CZnthgve9QIpKd:jW5Om342wrA5apH3/NYmciACZUApU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0d6ae1f1ecbace583969d8eb8b21d1b8
SHA256 b4ec96eda12eb0cbd593d4a65bb9ebb9055244f16a19dc976ba57bc552763419
MD5 6b174eb4d11c11ad5d8c8653f09e60c3
SHA1 222b75fa7c03707d8664817a2fd7db142f33867b
SHA512 3d847f863b367b7822a3a2422846bb15d5f68408af937224e19cf0f5fed8632738701d42d1f3a251b9ed69b3ce1a1698314698ac22a14ef38504415daf5aca09
SSDEEP 96:znYPt4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KA4e3VUxQvLL1mKZ:7YPt4Vlw1Iul5J8T1vK20m3VUaLL1l
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4339

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bruseniche.Dav

SHA256 b2eafd1f935031b15efe19f4fa5eea773bef614ce006a9ec39af00a0aa664e5e
MD5 127d320c1971242505b52fc27cb49059
SHA1 1691351cb2e08aff07fd70e87c9167a0cdeac196
SHA512 7b8e1fb8e2adb693d5faedbfecc756ec8a1268266e633767ce24dca67d6a2fcafd53a42f5abfe29e5a2f4bd40b11a847367074fe41993a73a7e2e07f1c4b9ec4
SSDEEP 3072:mi/uWTNXJZBfPOGU/z7+KR/pfK/jaSuQ7HWcx1c+Z2wyrM0jfMCs9PAvUwy3jmu/:mimaYzaKVpfKjaSuQ7HWcDc+Z23QsUNT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fornyes.txt

SHA256 9996179a8cdf28c767d3a3db181bde4a4cdbe61bd6bc5e7829bf89762d0c3ed3
MD5 7d902a7a3adf6c005ec93318c217be35
SHA1 fb41b11419ef3cb56ff1699b383c6654e194f21c
SHA512 efd0c4b69b4aa9d045c2898125d97a4a7ce3aa2a20067535405f47b4e1ae776d0854d617076df587178bbc166d43143a3970c68e5ee0745431926bfd78ad8657
MD5 SHA1 SHA512

NSIS installer

installer

Gravitometer/disapprobations.mot

SHA256 17848962f0c6edb396a4c966e4293c1f7ab6c28f6f721311c697e3367cf47d85
MD5 7c75d42fdcafe366bf74d03d2b99a8a4
SHA1 ee5defc35c1af601ef5c4e1dd08ccc6363a46390
SHA512 920a812ce5a381aaf32d3f6da480408e9d9836ac2615a969cb8793ef8aab7235185fb3d4bc6de4c2d575e42227895ccb40df759af9bde43fcfe36386bdc87f99
MD5 SHA1 SHA512

NSIS installer

installer

Helsingborgs.non

SHA256 0730a4d76ba0c8695bef4d03c9d325e2ee15d93c58e99080595c6f7285521199
MD5 b72b9b55f106d62d93bbcc3e32b0cb54
SHA1 cd94cb18b4a7294754a10980b20a5eff2d185783
SHA512 01e8e4d61e1c1da4df0c5e1f836666f0ecbe53428eb3a69c0d52f735e9e71d8cd3df35d61c9262811819bb80dc10d9e67d9ae5bd6d28522c73fa04bf2337e6fd
SSDEEP 192:SYHTXg7om+0xzV9N8oP9z8KvYVQ4NxBHD:SYj8omlxR9NlAG4vBj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Retableringsudgifter27/ataxia.sto

SHA256 f0c7bf0942f25674a19cb4d30445570b490a26dda3c81800856a9c3712a15cc4
MD5 eb6c8cab855a34246ac169b6b3e3b435
SHA1 d743a1c89083ef4f7834438fdccffcfa46d4191d
SHA512 c9b4261b28cc92b4679cb1d53449c4d1cb10e3a3de55c64d19f46fb2706faa2303a50ecaa6f4832437008f1df8480760b192c163f1e286f334000088a518a82d
SSDEEP 96:+jx066/AvvnkDhln3t6rhX+xRZjJGx3xSwytA15ogxFhypG:+jxfpfOhKNuXQEwRPog5ypG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Retableringsudgifter27/billethul.til

SHA256 686a8f7d27f0b88f16564b9148400a8ebf617955e3c9ba3f5d16ef13efab611b
MD5 872b70f633154f931f60c412d94815b3
SHA1 ccf33bf960a70396338a1e45fe4fd837b75da858
SHA512 a881dd19359a9694ad4bc84c7fbed53f60ebe9a89d9c4378899fabfa5643462a582b239709fbf53afb249776b37b9b9c9a1b956b31bbfd5643bc49690c75878c
SSDEEP 96:j8w1snb5pqCMCAgigzn1kCg0U3stMdhFKzkuujNxbnaaI+G:t1MgSn1/g0chhFKYRDbav
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Unriven/isovalerianic/hairgrass/upaaagtethed.unb

SHA256 3590997db870a313ed4e1d3fe6df0974d3ac992a8124f1515caabc21fc7a9bb7
MD5 492367381076d00c9bc1a7d0d17181da
SHA1 a4a1f5d035c47f073f1a8b3358529ad64c185371
SHA512 2df082dd79ea6106909770b24ae23cf3c1b05bf2501da9d8ad3caefc98a511bd4c0b3951fbe61605c299c72cde013e5b6006e4e6f50bba3032321856d37e1b4c
MD5 SHA1 SHA512

NSIS installer

installer

adnescent.krs

SHA256 544f577d8a878a895a56351ad471609b2fc9f6d519ffbbe36db8ed951d606e9d
MD5 196e8618dcfc8f8614e57f28b9a0fbdb
SHA1 8ec25c84eb1cadea94996863eae2ca9d5aa121a2
SHA512 cd0cb883563d6106181c3f45281a67f00cd394a369b0d3ae178dd7ce85fa75af8a2e694808a9ba306c0054ca5e1b18835358d2205fd34399bc74256da4e56e8d
SSDEEP 96:SD+2QYMEwmqz0zMXrlh/aIyR0yiCysKxcK6WwfHiU7luR6GY7kutQjxxarIFaH+C:IN19vM7lh/asEKqVWKllw6DFeLarzSg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Cumacean.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/Banner.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Bruseniche.Dav

Fornyes.txt

Gravitometer/disapprobations.mot

Helsingborgs.non

Retableringsudgifter27/ataxia.sto

Retableringsudgifter27/billethul.til

Unriven/isovalerianic/hairgrass/upaaagtethed.unb

adnescent.krs

Sharing

General

Malware Config

Signatures

File Explorer

Cumacean.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/Banner.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

Bruseniche.Dav

Fornyes.txt

Gravitometer/disapprobations.mot

Helsingborgs.non

Retableringsudgifter27/ataxia.sto

Retableringsudgifter27/billethul.til

Unriven/isovalerianic/hairgrass/upaaagtethed.unb

adnescent.krs