cheeto[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cheeto.exe
Size 1.9MB
Sample240530-rm7vrabd5y
SHA256 f0cd71edabf49bc65c7de45cebd7dbb972ad216302155e555bde69484ce3ba98
MD5 e7117f2f7fa1270692cebf5784b255e9
SHA1 09f67cd075a94077964a6d64326a1b3755069eb3
SHA512 a4fec6e9574f843cabe8bdee96fe1d8ea7c738cfb55b3f3acc8eb955b3db87533918b65c571e541a57b5bd52160cf46cf6295801c600ace94a16c61d18fafd16
SSDEEP 49152:b/yNSwDDkqs+Lgon7lBGf9/nuSJtrBmO7iR8:baEuAJ3t7K
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cheeto.exe

File Explorer

cheeto.exe

.exe 1.9MB

cheeto.exe

IMPHASH f0befbadef0d578ec7362d2b84a691dc
SHA256 f0cd71edabf49bc65c7de45cebd7dbb972ad216302155e555bde69484ce3ba98
MD5 e7117f2f7fa1270692cebf5784b255e9
SHA1 09f67cd075a94077964a6d64326a1b3755069eb3
SHA512 a4fec6e9574f843cabe8bdee96fe1d8ea7c738cfb55b3f3acc8eb955b3db87533918b65c571e541a57b5bd52160cf46cf6295801c600ace94a16c61d18fafd16
SSDEEP 49152:b/yNSwDDkqs+Lgon7lBGf9/nuSJtrBmO7iR8:baEuAJ3t7K
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1071840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\codon\Downloads\src\src\x64\Release\tulpical.pdb

kernel32

GetFileSizeEx OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx PeekNamedPipe AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx ReadFile GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA GetTickCount VerifyVersionInfoA GetSystemDirectoryA SleepEx LeaveCriticalSection EnterCriticalSection LocalFree QueryFullProcessImageNameW GetModuleHandleW UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect CreateThread DeleteCriticalSection InitializeCriticalSectionEx QueryPerformanceCounter VerSetConditionMask QueryPerformanceFrequency GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar lstrcmpiA Process32Next CreateFileA CreateToolhelp32Snapshot CreateFileW Process32First GetCurrentProcess SetLastError CloseHandle LoadLibraryA GetCurrentProcessId GetModuleHandleA VirtualAlloc DeviceIoControl VirtualFree Sleep SetConsoleTitleA GetModuleFileNameA FormatMessageA FreeLibrary WaitForMultipleObjects GetProcAddress GetLastError LoadLibraryExA

user32

LoadCursorA GetKeyState MoveWindow SetWindowDisplayAffinity DispatchMessageA SetWindowLongA GetWindowRect DestroyWindow GetSystemMetrics GetMonitorInfoA RegisterClassExA DefWindowProcA MonitorFromWindow GetCapture ClientToScreen TrackMouseEvent PostQuitMessage SetCapture SetCursor GetClientRect SetProcessDPIAware ReleaseCapture SetCursorPos OpenClipboard UnregisterClassA UpdateWindow CloseClipboard EmptyClipboard GetClipboardData SetClipboardData CreateWindowExA SetLayeredWindowAttributes TranslateMessage LoadIconA ShowWindow MessageBoxA FindWindowA SendInput GetCursorPos GetForegroundWindow GetAsyncKeyState ScreenToClient PeekMessageA

gdi32

CreateSolidBrush

advapi32

CryptCreateHash AddAccessAllowedAce GetLengthSid GetTokenInformation RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken RegSetValueExA RegDeleteKeyA RegOpenKeyA AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyA InitializeAcl IsValidSid SetSecurityInfo CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom GetUserNameW CryptHashData CryptDestroyHash CryptDestroyKey CryptEncrypt CryptImportKey

shell32

SHGetFolderPathW ShellExecuteA

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Query_perf_frequency _Query_perf_counter _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?setf@ios_base@std@@QEAAHHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Xtime_get_ticks ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

ntdll

RtlAnsiStringToUnicodeString NtQuerySystemInformation RtlVirtualUnwind RtlCaptureContext RtlInitAnsiString RtlLookupFunctionEntry

dbghelp

ImageNtHeader ImageDirectoryEntryToData ImageRvaToVa

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

psapi

GetModuleInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memcpy memcmp memchr _CxxThrowException __C_specific_handler __current_exception_context longjmp strchr strstr __std_terminate _purecall __std_exception_copy __std_exception_destroy __current_exception strrchr __intrinsic_setjmp memmove

api-ms-win-crt-heap-l1-1-0

free malloc realloc _set_new_mode _callnewh calloc

api-ms-win-crt-math-l1-1-0

sqrtf sqrt sinf sin pow log10 log fmod floor exp cosf cos roundf _dsign frexp tan __setusermatherr ceilf ceil atan2 asin acosf acos llround ldexp fmodf

api-ms-win-crt-string-l1-1-0

strpbrk isgraph tolower isalpha isspace iscntrl ispunct islower strcoll isupper _stricmp strncpy strcmp strcspn isdigit strspn _strdup isalnum toupper isxdigit isblank strncmp

api-ms-win-crt-runtime-l1-1-0

strerror _beginthreadex _invalid_parameter_noinfo_noreturn _errno system terminate perror __sys_nerr exit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc abort _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _getpid

api-ms-win-crt-stdio-l1-1-0

_lseeki64 _set_fmode __p__commode freopen fwrite _read _write __stdio_common_vsscanf _wfopen clearerr ferror fseek ftell _close fopen _pclose _open fgets _get_stream_buffer_pointers fsetpos fgetpos fgetc fputc tmpfile setvbuf _popen ungetc _ftelli64 _fseeki64 fread __acrt_iob_func tmpnam __stdio_common_vsprintf fflush fclose getc __stdio_common_vfprintf fputs feof

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func setlocale _configthreadlocale

api-ms-win-crt-time-l1-1-0

clock _mktime64 strftime _gmtime64 _localtime64 _difftime64 _time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-convert-l1-1-0

atoi strtoul strtod strtoll atof strtol strtoull

api-ms-win-crt-filesystem-l1-1-0

remove _access _fstat64 _unlink rename _lock_file _unlock_file _stat64

api-ms-win-crt-utility-l1-1-0

rand qsort

ws2_32

getsockopt getpeername connect closesocket htons ntohl recv ioctlsocket listen htonl gethostname sendto __WSAFDIsSet recvfrom send freeaddrinfo getaddrinfo bind ntohs WSAGetLastError getsockname accept setsockopt socket WSACleanup WSAStartup WSAIoctl WSASetLastError select

normaliz

IdnToAscii

crypt32

CertCreateCertificateChainEngine CryptQueryObject CertFreeCertificateChain CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChainEngine CertGetCertificateChain CertGetNameStringA

wldap32

ord45 ord26 ord60 ord27 ord50 ord22 ord32 ord33 ord211 ord217 ord41 ord46 ord35 ord79 ord30 ord301 ord200 ord143