Muse_Hub[.]exe | Triage™

Resubmissions

04/08/2024, 01:11

240804-bkcntswdkh10

04/08/2024, 01:08

240804-bhmq1swcqa5

Sharing

Copy URL Twitter E-mail

General

Target
Muse_Hub.exe
Size 42.8MB
Sample240804-bkcntswdkh
SHA256 777516469e953cb8ef945f558388aa27a4bb0e4849d35295a54fa9b104916c73
MD5 f6a5eeafe3927f8b60edd4710f472526
SHA1 90990dc31a9ce75456d68653309e4b37291bf54e
SHA512 03efbe3004b1434fa13e230b1c8f8526cfafeb94ee6d9a4e1b65ab316d183e86c39d1af0def4a48d3d65d186d5f7b3c76352b57ae40288e9171893ca58c9f4e4
SSDEEP 786432:WxfDPC5XlW/BIWj9Tp+V9w/PHyNmG3i+QpNT0Oxwkyh2YvLYpv1A8AmZ4HEleUau:WxfD6yaeYV9EKNmG3iYOGke2+0nA8AmR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Muse_Hub.exe

.exe 42.8MB

Muse_Hub.exe

IMPHASH 5df88e265cdf894e147cc17c0cff6d98
SHA256 777516469e953cb8ef945f558388aa27a4bb0e4849d35295a54fa9b104916c73
MD5 f6a5eeafe3927f8b60edd4710f472526
SHA1 90990dc31a9ce75456d68653309e4b37291bf54e
SHA512 03efbe3004b1434fa13e230b1c8f8526cfafeb94ee6d9a4e1b65ab316d183e86c39d1af0def4a48d3d65d186d5f7b3c76352b57ae40288e9171893ca58c9f4e4
SSDEEP 786432:WxfDPC5XlW/BIWj9Tp+V9w/PHyNmG3i+QpNT0Oxwkyh2YvLYpv1A8AmZ4HEleUau:WxfD6yaeYV9EKNmG3iYOGke2+0nA8AmR
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

e8:57:ca:b7:7e:d3:3f:26:d2:03:d8:64:84:e3:fa:b6:3a:a1:19:74:01:2a:65:ce:dd:21:38:5a:5d:c7:9c:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Musecy SM Ltd.,O=Musecy SM Ltd.,ST=Lemesos,C=CY

Chains

Jul 30, 2024

CN=Musecy SM Ltd.,O=Musecy SM Ltd.,ST=Lemesos,C=CY

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Musecy SM Ltd.,O=Musecy SM Ltd.,ST=Lemesos,C=CY

Serial Number

c1:34:b2:a3:ae:7f:9b:d5:a2:60:dc:5f:cc:04:08:7c

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 21, 2022 - Apr 20, 2025

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

85136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Muse\Muse\Windows\src\MuseInstaller\bin\x64\Release\MuseInstaller.pdb

advapi32

RegSetValueExW RegQueryValueExW IsWellKnownSid RegOpenKeyExW GetTokenInformation

kernel32

FreeLibrary HeapFree GetStdHandle WriteFile TlsFree GetModuleHandleExW TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError LoadLibraryExW GetTempPathW WaitForSingleObject InterlockedPushEntrySList CreateFileW GetFileAttributesW GetCurrentThreadId SizeofResource RaiseException FreeResource SetEvent Sleep CreateEventW FormatMessageW GetLastError RtlPcToFileHeader OutputDebugStringW LockResource GetModuleFileNameA DeleteFileW GlobalFree CloseHandle FreeConsole RtlUnwindEx CreateThread LoadResource FindResourceW HeapAlloc InitializeSListHead WriteConsoleW GetProcAddress GlobalLock GetSystemTimeAsFileTime VerSetConditionMask GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW WideCharToMultiByte VerifyVersionInfoW QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent DebugBreak TerminateProcess AllocConsole GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetExitCodeProcess CreateDirectoryW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GlobalAlloc SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindFirstFileW FindClose GetStringTypeW GetLocaleInfoEx FormatMessageA LocalFree MultiByteToWideChar

user32

BeginPaint EndPaint ReleaseDC GetDesktopWindow SetRect GetClientRect SetWindowLongW GetMessageW DefWindowProcW AdjustWindowRectEx GetDC SetWindowPos MessageBoxW CreateWindowExW SetRectEmpty LoadCursorW TranslateMessage RegisterClassW InvalidateRect DispatchMessageW SendMessageW GetWindowLongPtrW

shell32

ShellExecuteW

ole32

CoInitializeEx CreateStreamOnHGlobal CoCreateFreeThreadedMarshaler

gdi32

GetDeviceCaps

urlmon

URLDownloadToFileW

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _get_narrow_winmain_command_line abort _configure_narrow_argv _initialize_narrow_environment _initterm _initialize_onexit_table _register_onexit_function _invalid_parameter_noinfo system __p___argc _crt_atexit _initterm_e _errno __p___argv exit _exit _c_exit _register_thread_local_exe_atexit_callback terminate _invalid_parameter_noinfo_noreturn _cexit _set_app_type

api-ms-win-crt-stdio-l1-1-0

_wfsopen fseek fflush fclose _fseeki64 fputwc __p__commode ungetwc fsetpos ungetc _set_fmode setvbuf fgetc fgetwc fgetpos __stdio_common_vswprintf fwrite

api-ms-win-crt-string-l1-1-0

__strncnt islower iswspace _wcsdup strcpy_s isupper wcsncmp wcsnlen

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free malloc _callnewh

gdiplus

GdipCreateFromHDC GdiplusStartup GdipCreateSolidFill GdipCreateStringFormat GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipSetTextRenderingHint GdipCloneBrush GdipDrawImageRect GdipCloneImage GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipSetStringFormatAlign GdipDeleteBrush GdipFillRectangle GdipFree GdipCreateBitmapFromStream GdipDrawString GdiplusShutdown GdipAlloc GdipSetInterpolationMode GdipCreateFont GdipDisposeImage GdipSetSmoothingMode GdipSetStringFormatLineAlign

dwmapi

DwmExtendFrameIntoClientArea

uxtheme

BufferedPaintSetAlpha BeginBufferedPaint EndBufferedPaint

api-ms-win-crt-locale-l1-1-0

__pctype_func ___lc_codepage_func setlocale ___mb_cur_max_func _configthreadlocale _unlock_locales ___lc_locale_name_func _lock_locales

api-ms-win-crt-math-l1-1-0

floor __setusermatherr

oleaut32

SysStringLen SetErrorInfo SysFreeString GetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Muse_Hub.exe

advapi32

kernel32

user32

shell32

ole32

gdi32

urlmon

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

gdiplus

dwmapi

uxtheme

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic