KWOTASIE[.]exe | Triage™

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

KWOTASIE.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 86d0b3c927b629f98bb72beebcdee8a831df152a6a2cedb0d65270c23069037c
MD5 31ca0fd14af9b89c0aacd1a1c7dfd7e4
SHA1 67a33810ae059e722bbc5203fa644e5e550d5995
SHA512 708a32227d8109ff111c1fdbee5fce28101a40f5f6c5a9965e025b2b3e37d260aabbd84ddad76f3e2c566151a08ac71d5007126544af41077d8572060d39fa33
SSDEEP 24576:L3WbOu88VY2nrnN/n3CaHouNH6K8Yx1Lp:L3Wyu8OY8rn5yaI6aRY/p
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6a:f0:8f:fc:df:f6:a5:8c:06:8f:44:ab:73:2b:96:6a:5e:fe:a5:b4:1c:0d:a1:37:bd:b1:ef:f6:3f:cc:13:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Afviseren,OU=Overstrmmet Timeworn Generalinspektrs\ ,O=Afviseren,L=Cranborne,ST=England,C=GB,1.2.840.113549.1.9.1=#0c1b456d6574696e65404e6f6e7265766f6c7574696f6e3132382e756e

Chains

Jul 5, 2024

Minor OS version

0

Major OS version

4

Entry point

13186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

Antideflation.Cof

SHA256 79498c6cac498b40536c1397a8d44837d24d762be7fc62480461044c9bb803d2
MD5 53691d2a58bf592f1411a5733d9960e6
SHA1 7e08face46ad91159602b1f5ceec91bf870c54c6
SHA512 8862533db46846491aa7cb5e61bc73a3b0764ec5b7428b6756bfda9b1fabcad3340a74e4516d920266edf0131b88a428eacfe1234213329ad33b03c7dabc47b2
SSDEEP 6144:muwKIetVXkl3ZX114MICIHFcLCdUfejNefaGxrEHZQol:mFTetk3K3FcLCdyejYfvenl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Flavors.fif

SHA256 576443ef6299c1f875d7d388d8a152445d4a8e016127f880c4a8bcd054eef0aa
MD5 f5b585e07fa4dba346b092554a8a8c4a
SHA1 98cff3e05f0ed3ec347464885730eeafa0147587
SHA512 d26c91799c75e5ca28a5c8f612d415ba61a3f0a35fd0206d1aa244653c709fb1a139247a4ff0e01049f641d745fefb0b7e8716f87a9c202e22ab672f7744a9f0
SSDEEP 768:iw4l8+rBVeiT5q9nzYiPRip5tiT3xN9uzx6H7/pRTeD5LehjmfoST+1rNbdzhkxU:DKoz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Haanendes.txt

SHA256 13da62ddc7eefc3d80cddec1fcd703fd07e614fa90576d7eb9be520adf9bc6bf
MD5 f24ead49da527490cc6d6c3afd585a4b
SHA1 0adf1b8d4ea1d6d133fce286aaf57bafaaec8844
SHA512 24ea46c8c153c4108d529e43f95314d04d6730cbd8866091973e44b0ecefa1d5888ffe2beeec37f1504d94353d85402693f73ab5cbdbe78364cd739178ab785b
MD5 SHA1 SHA512

NSIS installer

installer

Spisekamre/Grundlovsforhret/saddeltaskerne.wit

SHA256 6f61ff678aa8683ad8531be130be16430772ae0559cefab3f4bd5d1ff18941d2
MD5 baa2138ea74ac522a05504a493beb708
SHA1 7f7d1a17f9d538614718bc8c8fc084c2502a2c18
SHA512 6d07b79fd7a5257e4b09386bc468e4268c51136321f3629491ee2a761e1e10c872671d26b774e6ed11e7bf841875a655ddf0d666b5611a3e96c0d3bfe7a452cd
SSDEEP 768:Ij0F2rU92UWBfgOxXmeicUA5PdMMW8zaERnN3QqHx6b4fcmP8jrJyHzCOYTBv3fb:CLDDK4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Spisekamre/Grundlovsforhret/variabelnavn.san

SHA256 840cacc0f7073573d0a69de4256763c0b9f38d28e806a822cb44cf09557ffdfe
MD5 ef4c03d018bf45ab4bdfe58df15d3bcc
SHA1 c01ce9cf32b3e90d90c38732b4514ba7375df76e
SHA512 b806df760384c38415f6cf33f6963eeb0fbc02f7d693e955fc748d45c7f20ee34a6008b65919afcb9f6e8c67c73e6d41fce4ee81d5fc4f91db33dca5f0728bd6
SSDEEP 768:8Nn5kFNvMUCRaVmvAF1ZkRe4+4/hPmV+rkHicz3D1rpezic7uRY1lwfXN0KEl2fc:1ewk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Spisekamre/grssers.sol

SHA256 09ecb43cefb2ee8d4f496dc5a1cba0c4669962054e331aa29e5776a33f950923
MD5 97c0f36262acd7cc385f5196fcdca543
SHA1 bcd846201f4ff8d1cbed2f6db19a814386600445
SHA512 b1574258c80a8ea9bf5ff03e4e5e4cce37137fcf4648b7f51819d257145c7d68f84d941de5be5d288da6d1826eb244a14c301fe230fffeb10ddbbc8940a19216
SSDEEP 768:0ZVODWmKWoj9fQNNYGzv/I/Z4o6EFdD6v916rg+lDAZ47f2iNCY3pkiXeFv7Fqj:OyEHgTg
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Spisekamre/lugworm.cep

SHA256 1029756c98a4045871fdcf9db96b7206ecea1534300279faad5a4385543bc219
MD5 05c732fdba542e6586967dfb41224bc3
SHA1 66a9b0c2f9125c2657579851a8eaa270a84ef569
SHA512 8a6d6034a55b053c3379a9f513b689e849bd3b677104d32fb7dccc01dd1adcfe685dc7446b135649d9c8a69146004badf4618edec446140493a70b4f7452be05
SSDEEP 768:nMSVmERJPejgoV37VwdjlXZP6DOFj0VjqoLeiGEkUwa0jqlXF326WqBYeh6AO:E
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Turtledoving/goddises.hov

SHA256 639e30dfa1d0c3691bbf0b57bef3a167c70f21b8e5c9f9dccac1e88cecbdaf68
MD5 e539656049c4ba24825f0a4bc30ffff3
SHA1 5be6e5d0043c5b3c15f7fb5659ba028644aae031
SHA512 4ccbc2cf90103adada3ee93479346b184ff1f75f44f0752bf3b770ac3ed782305d761c4e4f014beaa9e6647b9bd8b763691f21bba8b262aae6d527b9dfb4af72
SSDEEP 768:7VoKZvDv05E7oIJLCO0F3JTQE3X/I+2AD2diCfLkDFAnuBGnUCPnPgTaf:J
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

adoptanten.fig

SHA256 f26424217cd03bc44951a7c6041cb47064c0ac6a2c973332ee67a46f91cd9de4
MD5 413951feaee5d7a111062bd44b114684
SHA1 1e50e33719d17903d8a554594dc8408655bcec15
SHA512 d318e61d0f836b217f3102ced874e604db7ad06237fc91986d3fee162603393fa3b2f193621e0a25ad69680ce1c123885947dee3acd9572607f4a7d849d01686
SSDEEP 384:IqU2IJohqB8ymfLKqpQNhPPv5/H2ZJO/UCXCeQNQMaZmgQNHWMek7O7+baO:ooFxpmRdCBmo2X
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

blokindskuddenes.uns

SHA256 554b43fa80d0f1107ac0800d408d8e6afd19b76058dbf988cdfc0830c1267869
MD5 5a7190fe8c19f5d1a06cb5f8dd4d3943
SHA1 6c0fc6bd78136b71c7f5dedb75b8ed7b88399d7d
SHA512 f49adde6525865fdaca2799d550391f718a26e2168262a027b6d69ac9f89c0446c9c6ec66269978979263ab839a413a0e3ce59a9116a018f976c90b0afa49e08
SSDEEP 768:AXsQNRUDnR3yDd0dbvkOHel7+XIOK87Hjgr8HnUD8uM6saBTH:Ah
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

catenoid.syg

SHA256 4d32fa35efe90a9e351123afee0adbc0c2814d1a50d2cbfb89fc8b0c08da8b83
MD5 c2eeabc675d230419496a0aaec227ae4
SHA1 56d45a6c81988aa2637d5864caa4b0527ea640df
SHA512 919d729a8a2e06ad63c1250776754e42389e2ebce6b4992dea8ca17cc46b6dbca3a9a5ddaf7443fa0851ef569b572f974637cb84fa9070a235cf4349a4dc5307
SSDEEP 768:l0nUVlrW3MD5Vk9HJOzZgTh3Mj3Hl737nI6N58IiwMCwDvvqJqw7wLwj3KMH/y:ed
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

femmers.For

SHA256 617116095303a7e05250a30d7554893e20da987dc5184ef5abc911671bae7dc3
MD5 3b009c76c1efdec3d9160870ff0b5280
SHA1 b2c005cb0fd4cfed460bb7a910388a5394085240
SHA512 c334334c839cb91930232dfcad44d8d1711ea4bab4fa81aa2301e0c4bab181050a51c1d3833607734a131560dee8f5729404ec5f252c1e9f8aa1f4c8fc881bc1
SSDEEP 1536:4nzwTMCLiV2cdw0PKgiVG+6cmklgxgpl8ssl5dVDclag+z8NpE5UjwrwP:4nzwTMCGV2cdw0PKgiV3lmk4gU8laQ0s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer