TPM[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

TPM.exe
Size

2.2MB
MD5

b9e5561737d4e1b226288c4c18692fb1
SHA1

b5ae4f245413cacb6659c3914006d8a626925369
SHA256

952bf80d46302218618c584edcb25be292ce7c829843218593347e222bbe433a
SHA512

df6489e989fc3a4c0e968097ae08c6492472f038f5054f24d2d8cf1e82446bb5a6a7d93c28573fef4e49f48be97da39f29bae3623cf61a93e625b58ee5c4b94f
SSDEEP

24576:IWnFP2ey/3Y5gIfbvG+mRrkDZquVaX+pZ42klLlyxEmRz7kK2RjxDxZDowsCrw86:1R/Gx65DRLsM3ecuvprQbNYJfP6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TPM.exe

Files

TPM.exe
.exe windows:6 windows x64 arch:x64

Password: dwadwadadsad

fff36662c611efa8140cbc6aebe53d29

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\VSTUDIO\KDMAPPERSHIT\TPM BYPASS\x64\Release\TPM BYPASHU.pdb

Imports

kernel32

GetStartupInfoW
GetTickCount64
VirtualAlloc
VirtualProtect
VirtualQuery
VirtualAllocEx
WriteProcessMemory
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
LoadLibraryW
WideCharToMultiByte
LocalFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentThread
QueryPerformanceFrequency
GetSystemDirectoryA
VerifyVersionInfoA
QueryPerformanceCounter
GetTickCount
MoveFileExA
WaitForSingleObjectEx
MultiByteToWideChar
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SetLastError
FormatMessageA
HeapReAlloc
GetLocaleInfoEx
GetCurrentDirectoryW
FindClose
FindFirstFileW
CreateProcessW
CreateRemoteThread
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
SleepEx
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
HeapFree
HeapAlloc
HeapDestroy
CheckRemoteDebuggerPresent
WaitForDebugEvent
ContinueDebugEvent
CreateFileA
IsDebuggerPresent
QueryFullProcessImageNameW
GetModuleHandleW
GetWindowsDirectoryW
CreateThread
CloseHandle
Process32FirstW
DeleteFileW
Process32NextW
GetLastError
Sleep
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
CreateToolhelp32Snapshot
OpenProcess
CreateFileW
TerminateProcess
WriteFile
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
GetFileSizeEx
GetCommandLineW

user32

GetWindowThreadProcessId
GetClassNameA
FindWindowA
GetWindowTextA
PostMessageW
MessageBoxA
SetCursorPos
EnumWindows

shell32

ShellExecuteA
ShellExecuteW

msvcp140

_Query_perf_frequency
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Random_device@std@@YAIXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setf@ios_base@std@@QEAAHHH@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Xbad_function_call@std@@YAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
_Query_perf_counter
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

normaliz

IdnToAscii

wldap32

ord46
ord217
ord50
ord41
ord22
ord26
ord45
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord143
ord301
ord211
ord60

crypt32

CertEnumCertificatesInStore
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CryptDecodeObjectEx
CertOpenStore
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertAddCertificateContextToStore

ws2_32

select
getaddrinfo
freeaddrinfo
ioctlsocket
sendto
gethostname
ntohl
listen
__WSAFDIsSet
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
closesocket
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recvfrom
recv
setsockopt

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

psapi

EnumProcessModules
EnumProcesses
GetModuleInformation
GetModuleFileNameExW

ntdll

VerSetConditionMask
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
memchr
wcsstr
__std_terminate
memcmp
memmove
memcpy
memset
strchr
strrchr
strstr
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_cexit
_invalid_parameter_noinfo
_configure_narrow_argv
_resetstkoflw
_invalid_parameter_noinfo_noreturn
_set_app_type
_crt_atexit
_initterm
exit
system
_initialize_narrow_environment
_initterm_e
_seh_filter_exe
abort
_exit
_getpid
__p___argc
_register_onexit_function
__p___argv
strerror
_beginthreadex
_c_exit
_register_thread_local_exe_atexit_callback
_errno
__sys_nerr
_get_initial_narrow_environment
_initialize_onexit_table
terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode
_read
_write
_close
_open
ftell
fseek
_set_fmode
feof
__stdio_common_vsscanf
fputs
fopen
_popen
_pclose
fgets
_get_stream_buffer_pointers
_fseeki64
fread
fputc
__acrt_iob_func
fflush
fsetpos
fclose
ungetc
fgetc
fwrite
__stdio_common_vsprintf
setvbuf
_lseeki64
fgetpos

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
realloc
_recalloc
calloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

_dclass
__setusermatherr
_dsign

api-ms-win-crt-string-l1-1-0

isupper
_strdup
strcmp
strncmp
strpbrk
strtok_s
tolower
strnlen
strncpy
strcspn
strspn

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
atoi
strtod
strtoll
strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlink
_fstat64
_access
_stat64
_unlock_file
remove
_lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
localeconv
_configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

advapi32

IsValidSid
CryptHashData
CryptDestroyKey
CryptCreateHash
CryptImportKey
CryptEncrypt
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
GetUserNameA
OpenProcessToken
CopySid
GetLengthSid
GetTokenInformation
ConvertSidToStringSidA
CryptAcquireContextA
CryptDestroyHash

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 248KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: dwadwadadsad

fff36662c611efa8140cbc6aebe53d29

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

msvcp140

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

ntdll

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

advapi32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 142KB - Virtual size: 142KB

.data Size: 248KB - Virtual size: 252KB

.pdata Size: 32KB - Virtual size: 32KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 142KB - Virtual size: 142KB

.data
Size: 248KB - Virtual size: 252KB

.pdata
Size: 32KB - Virtual size: 32KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB