mcman[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mcman.exe
Size

10.0MB
MD5

3b5642482e98b08451b4e679b09bc3b4
SHA1

12cc6dc2eed05f96bde96cb82081e77ed7aad94a
SHA256

ae3b08b2d3a219cea46c23715256fceb63025c9e05922616cb7a17d191dc2e1a
SHA512

eb2b616804f7ad9aadca94cb0232e184dafa2c3220e923b348730e52a15cbe7ac71dbf11ed00211e25bad610273177536bb550c1cfaa430f02d484f072abc76b
SSDEEP

98304:P+r+ZUlH7qPeD0mIqXMT97wSHHc5wA441DHeYRn+nI6wo5Apb1:r2YV1LHHc5wHSDpRaxApb1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mcman.exe

Files

mcman.exe
.exe windows:6 windows x64 arch:x64

66d1d2a1be4c6e23f5a7d3801dceec36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptGenRandom

advapi32

RegCloseKey
SystemFunction036
RegQueryValueExW
RegOpenKeyExW

kernel32

GetQueuedCompletionStatusEx
CreateIoCompletionPort
WaitForSingleObjectEx
CreateFileW
CreateSemaphoreW
CancelIo
ReadDirectoryChangesW
ReleaseSemaphore
GetFileInformationByHandle
MoveFileExW
Sleep
GetModuleHandleA
GetProcAddress
SetThreadStackGuarantee
AddVectoredExceptionHandler
RegisterWaitForSingleObject
SetHandleInformation
GetCurrentThread
CompareStringOrdinal
MultiByteToWideChar
WriteConsoleW
SetLastError
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
ReadFileEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
SleepEx
GetFinalPathNameByHandleW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
WideCharToMultiByte
ReadConsoleW
GetSystemInfo
GetFullPathNameW
GetCommandLineW
GetExitCodeProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
CreateThread
WriteFileEx
CreateEventW
ReadFile
ExitProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
DeleteFileW
SetFileInformationByHandle
CopyFileExW
GetFileType
SleepConditionVariableSRW
WakeAllConditionVariable
WaitForSingleObject
GetOverlappedResult
WaitForMultipleObjects
TryAcquireSRWLockExclusive
UnregisterWaitEx
SetConsoleCtrlHandler
PostQueuedCompletionStatus
CloseHandle
WakeConditionVariable
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
SwitchToThread
FindClose
lstrlenW
InitializeSListHead
IsDebuggerPresent
GetNumberOfConsoleInputEvents
ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
ReadConsoleInputW
SetConsoleCursorInfo
GetConsoleCursorInfo
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
SetConsoleCursorPosition
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetLastError
SetConsoleMode
GetConsoleMode
GetStdHandle
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
SetFileCompletionNotificationModes
GetCurrentDirectoryW

shell32

ShellExecuteW
SHGetKnownFolderPath

ole32

CoTaskMemFree

ws2_32

send
connect
bind
WSASend
recv
getsockopt
getaddrinfo
WSACleanup
freeaddrinfo
WSAStartup
getsockname
WSAGetLastError
getpeername
closesocket
WSAIoctl
ioctlsocket
WSASocketW
shutdown
setsockopt

ntdll

NtDeviceIoControlFile
NtCancelIoFileEx
NtCreateFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError

vcruntime140

__CxxFrameHandler3
memmove
memcmp
memcpy
memset
_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context

api-ms-win-crt-math-l1-1-0

round
fmod
truncf
ceil
pow
trunc
__setusermatherr

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_seh_filter_exe
_initterm_e
exit
_set_app_type
_register_onexit_function
_exit
_initialize_onexit_table
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 322KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66d1d2a1be4c6e23f5a7d3801dceec36

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

advapi32

kernel32

shell32

ole32

ws2_32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 7.1MB - Virtual size: 7.1MB

.rdata Size: 2.6MB - Virtual size: 2.6MB

.data Size: 4KB - Virtual size: 14KB

.pdata Size: 322KB - Virtual size: 321KB

.reloc Size: 39KB - Virtual size: 38KB

.text
Size: 7.1MB - Virtual size: 7.1MB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 4KB - Virtual size: 14KB

.pdata
Size: 322KB - Virtual size: 321KB

.reloc
Size: 39KB - Virtual size: 38KB