MWIIIClient_Loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MWIIIClient_Loader.exe
Size 2.2MB
Sample240613-sj6nystfle
SHA256 6fd31ef74ad9c121058616de189508022e3a8c84c78160f3d466c21c646ea93d
MD5 1b6f57d6677e3c60128cba11647c71c3
SHA1 233e3d7fd31e5f9f1a6c2824d8fa59d25f550877
SHA512 ff0b43ba778e985df4c1f92490ac646adbd64d264c48c4900e8c7d44878fbac1aec7317ae754809c536b5aafd1e98a7231c1dc8bbe5752b71ec16f462a1f86c4
SSDEEP 49152:RQiRXke3BL9mpp36/gQAHyFvS1mxCNmlFsKxN:2WBRmNQAHyFoNmlFsKP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MWIIIClient_Loader.exe

File Explorer

MWIIIClient_Loader.exe

.exe 2.2MB

MWIIIClient_Loader.exe

IMPHASH b8dbc155e9daecc40e596b725012ab51
SHA256 6fd31ef74ad9c121058616de189508022e3a8c84c78160f3d466c21c646ea93d
MD5 1b6f57d6677e3c60128cba11647c71c3
SHA1 233e3d7fd31e5f9f1a6c2824d8fa59d25f550877
SHA512 ff0b43ba778e985df4c1f92490ac646adbd64d264c48c4900e8c7d44878fbac1aec7317ae754809c536b5aafd1e98a7231c1dc8bbe5752b71ec16f462a1f86c4
SSDEEP 49152:RQiRXke3BL9mpp36/gQAHyFvS1mxCNmlFsKxN:2WBRmNQAHyFoNmlFsKP
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

425840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA GetFileSizeEx WideCharToMultiByte OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter VerifyVersionInfoA LoadLibraryA GetProcAddress FreeLibrary GetSystemDirectoryA QueryPerformanceFrequency VerSetConditionMask SleepEx LeaveCriticalSection EnterCriticalSection PeekNamedPipe SetLastError QueryFullProcessImageNameW GetModuleHandleW GetModuleHandleA GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForMultipleObjects ReadFile GetFileType GetStdHandle GetEnvironmentVariableA MultiByteToWideChar WaitForSingleObjectEx MoveFileExA FormatMessageA GetTickCount VirtualProtect CreateThread GetCurrentProcess Sleep DeleteCriticalSection InitializeCriticalSectionEx GetLastError CloseHandle CreateFileW

user32

MessageBoxA

advapi32

GetTokenInformation AddAccessAllowedAce GetLengthSid InitializeAcl IsValidSid GetUserNameA SetSecurityInfo CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptEncrypt CryptImportKey OpenProcessToken

shell32

ShellExecuteA

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setf@ios_base@std@@QEAAHHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z

normaliz

IdnToAscii

wldap32

ord33 ord32 ord27 ord26 ord22 ord143 ord79 ord200 ord30 ord35 ord301 ord45 ord60 ord211 ord50 ord46 ord217 ord41

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CertFreeCertificateChain PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertOpenStore CertEnumCertificatesInStore CertCloseStore CryptDecodeObjectEx

ws2_32

ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl socket setsockopt WSASetLastError ntohs htons getsockopt getsockname getpeername connect bind WSAGetLastError send recv closesocket __WSAFDIsSet

rpcrt4

RpcStringFreeA UuidToStringA UuidCreate

psapi

GetModuleInformation

vcruntime140

__std_exception_copy __std_exception_destroy __current_exception_context _CxxThrowException __current_exception __C_specific_handler strstr strrchr strchr memchr memcmp memcpy memmove __std_terminate memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

strerror _invalid_parameter_noinfo_noreturn _beginthreadex _errno __sys_nerr _getpid system raise terminate _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type exit _get_initial_narrow_environment _initterm _initterm_e _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _c_exit

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh realloc free calloc

api-ms-win-crt-convert-l1-1-0

strtoul strtoll strtod atoi strtol strtoull

api-ms-win-crt-stdio-l1-1-0

feof fflush __p__commode fseek fwrite _read _write __acrt_iob_func __stdio_common_vsscanf _close _open _set_fmode fputs fopen fgets fclose ftell _pclose _lseeki64 _popen fputc __stdio_common_vsprintf fread

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr

api-ms-win-crt-string-l1-1-0

strcmp strpbrk isupper strspn strncpy strcspn tolower _strdup strncmp

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_unlink _access _fstat64 _stat64

Name

.text

Size

419KB

Virtual Size

419KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

1.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

MWIIIClient_Loader.exe

kernel32

user32

advapi32

shell32

msvcp140

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic