MartDrum[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MartDrum.exe
Size 904KB
Sample240528-bbbp6sge71
SHA256 9410861cbe8204310017cdec72056d49f8effbe26961cc6cb73fee37c731e0a0
MD5 1e4352c43b8c5a6b5a10dd0ace9a57a4
SHA1 6d4f220bdfee34df0b3b9d8a829dd423fab5abdf
SHA512 ac96916f4c42acbf8be07d814dbc15e04c50e3874888ebdb3d762f74fcac58e4e100da68a34d78da12403ee09f3bf59c681bf3fa258de8e39e1038b5fc42e7a9
SSDEEP 12288:Fy3S2m4omcLCRdCPiofcsdS3c2qRWi2kx6RAaiPjMoxIlDhI4HPlRoQ9RT9tQ6DP:FyhM1LAdCKo0s6xrkxJxjDIldBHdRvfb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

MartDrum.exe

.exe 904KB

MartDrum.exe

IMPHASH a602c5f081ba454f5c1df2cfd85b0b3a
SHA256 9410861cbe8204310017cdec72056d49f8effbe26961cc6cb73fee37c731e0a0
MD5 1e4352c43b8c5a6b5a10dd0ace9a57a4
SHA1 6d4f220bdfee34df0b3b9d8a829dd423fab5abdf
SHA512 ac96916f4c42acbf8be07d814dbc15e04c50e3874888ebdb3d762f74fcac58e4e100da68a34d78da12403ee09f3bf59c681bf3fa258de8e39e1038b5fc42e7a9
SSDEEP 12288:Fy3S2m4omcLCRdCPiofcsdS3c2qRWi2kx6RAaiPjMoxIlDhI4HPlRoQ9RT9tQ6DP:FyhM1LAdCKo0s6xrkxJxjDIldBHdRvfb
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

5d:06:db:27:30:ec:60:e0:32:7b:38:a6:4c:5a:62:b9:60:60:12:8a:31:cd:50:78:e7:6d:51:c7:d8:e5:79:94

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Irfan Skiljan,O=Irfan Skiljan,ST=Lower Austria,C=AT

Chains

Dec 20, 2023

CN=Irfan Skiljan,O=Irfan Skiljan,ST=Lower Austria,C=AT

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Irfan Skiljan,O=Irfan Skiljan,ST=Lower Austria,C=AT

Serial Number

3f:54:20:92:be:51:82:36:46:2d:c1:ac:e2:e0:7f:ae

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 2, 2023 - Aug 1, 2026

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

Major OS version

Entry point

125334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

kernel32

GetProcAddress GetDiskFreeSpaceExW SetFileAttributesW Sleep CreateThread GetExitCodeThread GetLocalTime SystemTimeToFileTime GetStdHandle GetEnvironmentVariableW ExpandEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW CompareFileTime CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW WriteFile GetTempPathW GetSystemTimeAsFileTime GetModuleHandleW LoadResource LockResource SizeofResource LoadLibraryA GlobalAlloc GlobalFree MulDiv lstrcmpW lstrcmpiA lstrcmpiW lstrlenA FindResourceExA MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLCID SetEnvironmentVariableW CreateFileW GetDriveTypeW GetCurrentProcess GetVersionExW FreeLibrary GetModuleFileNameW InitializeCriticalSection SetEvent ResetEvent CreateEventW GetCurrentThreadId TerminateThread SuspendThread GetSystemDirectoryW LocalFree FormatMessageW lstrcpyW AssignProcessToJobObject EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VirtualAlloc VirtualFree GetFileSize ReadFile SetEndOfFile SetFilePointer SetFileTime GetFileInformationByHandle WaitForMultipleObjects RtlUnwind RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId InitializeSListHead TerminateProcess DecodePointer SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize GetStringTypeW SetStdHandle WriteConsoleW GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetFileType HeapReAlloc LCMapStringW CompareStringW HeapFree HeapAlloc GetACP GetCommandLineA GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateJobObjectW GetStartupInfoW CreateProcessW ResumeThread SetInformationJobObject GetExitCodeProcess WaitForSingleObject GetQueuedCompletionStatus CreateIoCompletionPort SetLastError GetLastError CloseHandle GetCommandLineW lstrlenW GetTickCount IsBadReadPtr

user32

EnableMenuItem GetSystemMenu GetDC GetClientRect MessageBeep ClientToScreen PtInRect SetWindowLongW GetWindow DrawTextW EndDialog ShowWindow BringWindowToTop SendMessageW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx LoadIconW LoadImageW DrawIconEx SystemParametersInfoW GetSystemMetrics EnableWindow SetFocus GetDlgItem DialogBoxIndirectParamW IsWindow CreateWindowExA CallWindowProcW DefWindowProcW wvsprintfW MessageBoxA GetKeyState CopyImage GetClassNameA GetParent GetDesktopWindow GetWindowLongW GetSysColor ScreenToClient GetWindowRect GetWindowTextLengthW GetWindowTextW SetWindowTextW ReleaseDC GetWindowDC GetMenu KillTimer SetTimer CharUpperW SetWindowPos DestroyWindow CreateWindowExW GetMessageW wsprintfW wsprintfA DispatchMessageW

gdi32

SelectObject StretchBlt GetCurrentObject GetObjectW CreateFontIndirectW DeleteObject DeleteDC CreateCompatibleDC GetDeviceCaps SetStretchBltMode CreateCompatibleBitmap

shell32

SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteW SHGetSpecialFolderPathW ShellExecuteExW

ole32

CreateStreamOnHGlobal CoCreateInstance CoInitialize

oleaut32

SysAllocStringLen VariantClear SysAllocString SysFreeString OleLoadPicture

Sharing

General

Malware Config

Signatures

File Explorer

MartDrum.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

shell32

ole32

oleaut32

generic