carrier[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
carrier.exe
Size 16.0MB
Sample240807-xaablssaqr
SHA256 d45b6b04ac18ef566ac0ecdaf6a1f73d1c3164a845b83e0899c66c608154b93d
MD5 6bc398dba59c8d162ee858b7b199f81d
SHA1 6fdb6f50f4ad693c64b72a76a970fc93916b3655
SHA512 f9332a20481ccac87e3779ed6df34a9c89510bd799ed6f03fd2fa3db398b44e492ed5a84c404322ebb1844462912b714028262699d5fae5dd5ae01c771d45608
SSDEEP 393216:RewpHPns4Xi7qez6CO5vXnzi6B95k9MJxsQLDGtj6wd:kwpvnzXy6CO5v/twd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

carrier.exe

.exe 16.0MB

carrier.exe

IMPHASH c56881e2e7dccc95ea6b3e2a1d39b9c6
SHA256 d45b6b04ac18ef566ac0ecdaf6a1f73d1c3164a845b83e0899c66c608154b93d
MD5 6bc398dba59c8d162ee858b7b199f81d
SHA1 6fdb6f50f4ad693c64b72a76a970fc93916b3655
SHA512 f9332a20481ccac87e3779ed6df34a9c89510bd799ed6f03fd2fa3db398b44e492ed5a84c404322ebb1844462912b714028262699d5fae5dd5ae01c771d45608
SSDEEP 393216:RewpHPns4Xi7qez6CO5vXnzi6B95k9MJxsQLDGtj6wd:kwpvnzXy6CO5v/twd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

a5:79:ec:02:b4:2c:d2:44:51:1b:2b:25:73:88:13:9a:14:49:4b:84

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Unagaev Sergei Aleksandrovich IP,O=Unagaev Sergei Aleksandrovich IP,POSTALCODE=670042,STREET=ofis 5\, 28 Mokrova ul.,L=Ulan-Ude,C=RU

Chains

Oct 28, 2020

CN=Unagaev Sergei Aleksandrovich IP,O=Unagaev Sergei Aleksandrovich IP,POSTALCODE=670042,STREET=ofis 5\, 28 Mokrova ul.,L=Ulan-Ude,C=RU

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=Unagaev Sergei Aleksandrovich IP,O=Unagaev Sergei Aleksandrovich IP,POSTALCODE=670042,STREET=ofis 5\, 28 Mokrova ul.,L=Ulan-Ude,C=RU

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Unagaev Sergei Aleksandrovich IP,O=Unagaev Sergei Aleksandrovich IP,POSTALCODE=670042,STREET=ofis 5\, 28 Mokrova ul.,L=Ulan-Ude,C=RU

Serial Number

d6:f4:a5:36:85:58:b0:4f:ab:2f:5d:55:14:33:62:ad

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2020 - May 14, 2021

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Minor OS version

Major OS version

Entry point

4100286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

M:\SYSINFODETECTOR\SYSINFODETECTOR\Release\SysInfoDetector.pdb

kernel32

IsValidLocale EnumSystemLocalesA InterlockedCompareExchange CreateFileA ExpandEnvironmentStringsA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetStringTypeA WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount LCMapStringA GetDriveTypeA LCMapStringW GetDateFormatA GetTimeFormatA IsValidCodePage GetOEMCP GetCPInfo GetConsoleMode GetConsoleCP GetCurrentDirectoryA HeapCreate GetStartupInfoA SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle GetFileType SetStdHandle HeapSize ExitThread HeapReAlloc RaiseException ExitProcess RtlUnwind VirtualQuery IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW GetFileSizeEx LocalFileTimeToFileTime GetFileAttributesExW FileTimeToLocalFileTime SetErrorMode FindResourceExW SystemTimeToFileTime TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle TlsGetValue SearchPathW GetProfileIntW GetDiskFreeSpaceW GetFileTime SetFileTime GetShortPathNameW GetFullPathNameW GetVolumeInformationW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers GetStringTypeExW MoveFileW VirtualProtect GetFileSize GlobalReAlloc InterlockedIncrement GlobalFlags GetModuleHandleA SuspendThread SetThreadPriority ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA CompareStringA InterlockedExchange GetPrivateProfileIntW GlobalSize GlobalGetAtomNameW GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW GetVersionExA FreeResource lstrcpyA GetCurrentDirectoryW GetProcessTimes GetSystemTimeAsFileTime DefineDosDeviceW SetFilePointer VirtualFree VirtualAlloc IsBadStringPtrW GetComputerNameW CreateMutexW ReleaseMutex FormatMessageW GetSystemDefaultLangID lstrcmpiW GetWindowsDirectoryW FileTimeToSystemTime GetDateFormatW ExpandEnvironmentStringsW SetEvent UnmapViewOfFile MapViewOfFile OpenEventW OpenFileMappingW GetFileAttributesW ResetEvent CancelIo DeviceIoControl InterlockedDecrement QueryPerformanceFrequency QueryPerformanceCounter GetSystemInfo SetThreadAffinityMask TerminateThread CreateThread LocalFree LocalAlloc GetCurrentThread GetVersionExW GetTempPathW GlobalLock GlobalAlloc GlobalFree GlobalUnlock GetVersion GetDriveTypeW HeapFree HeapAlloc GetProcessHeap TerminateProcess GetCurrentProcessId GetCurrentThreadId SetUnhandledExceptionFilter lstrcmpW GetPrivateProfileStringW lstrcatA OpenProcess DeleteFileW CopyFileW FindClose FindNextFileW FindFirstFileW GetCurrentProcess MultiByteToWideChar lstrlenA MulDiv lstrcpyW CreateEventW WaitForSingleObject LoadLibraryA GetSystemDirectoryA GetTickCount GetTimeZoneInformation GetLocalTime GetThreadLocale WideCharToMultiByte GetOverlappedResult WriteFile ReadFile CreateFileW CloseHandle GetExitCodeThread GetACP ResumeThread GetLocaleInfoW FindResourceW GetModuleFileNameW GetTempFileNameW FreeLibrary CreateDirectoryW lstrlenW GetProcAddress GetModuleHandleW LoadLibraryW GetLastError SetLastError Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WritePrivateProfileStringW SystemTimeToTzSpecificLocalTime GetSystemTime lstrcatW LockResource SizeofResource LoadResource SetEnvironmentVariableA

user32

GetMessageTime GetMessagePos MapWindowPoints ScrollWindow GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos ShowScrollBar IsWindowVisible GetMenuItemID CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DeferWindowPos GetScrollInfo SetScrollInfo GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW SystemParametersInfoA GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW GetMenuState RegisterWindowMessageW CharUpperW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx IsIconic IsZoomed GetAsyncKeyState NotifyWinEvent DestroyWindow SetActiveWindow GetLastActivePopup MessageBeep ReleaseCapture MapVirtualKeyExW GetDoubleClickTime PostMessageW BringWindowToTop SetForegroundWindow IsWindow WindowFromPoint SetCapture GetCapture BeginDeferWindowPos EndDeferWindowPos SetWindowRgn GetSystemMenu EnableMenuItem CheckMenuItem DeleteMenu IsChild EqualRect IntersectRect GetWindowRect GetWindowDC CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetCursor LoadMenuW ShowWindow MessageBoxW KillTimer DispatchMessageW TranslateMessage PeekMessageW TrackPopupMenu GetCursorPos SetFocus GetTopWindow LoadCursorW SetCursor GetScrollPos DrawFocusRect IsRectEmpty SetRect PtInRect GetWindowLongW LockWindowUpdate AppendMenuW RemoveMenu GetMenuItemCount GetSubMenu ScreenToClient wsprintfW SetRectEmpty GetParent InvalidateRect FillRect DrawIconEx DrawEdge GetForegroundWindow GetWindowTextW GetWindowTextLengthW RemovePropW GetPropW SetPropW GetClassNameW GetClassLongW WinHelpW SendDlgItemMessageA SendDlgItemMessageW ClientToScreen DestroyAcceleratorTable TranslateAcceleratorW GetDesktopWindow CreatePopupMenu LoadStringW RedrawWindow LoadImageW SetWindowPlacement GetFocus SetTimer DestroyIcon UpdateWindow SetWindowTextW SetWindowPos GetWindowPlacement InsertMenuItemW LoadAcceleratorsW IsWindowEnabled GetActiveWindow GetWindowThreadProcessId DestroyMenu ReuseDDElParam UnpackDDElParam CheckDlgButton LoadBitmapW PostThreadMessageW EnableWindow GetSysColor SubtractRect DestroyCursor CreateMenu GetWindowRgn EnumChildWindows InvalidateRgn CharNextW UnregisterClassW TranslateMDISysAccel DrawMenuBar DefMDIChildProcW DefFrameProcW IsClipboardFormatAvailable CharUpperBuffW FrameRect SendMessageW CopyRect GetDC GetSystemMetrics ReleaseDC DrawIcon SetMenuDefaultItem GetMenuDefaultItem UpdateLayeredWindow EnableScrollBar GetMenuItemInfoW CopyIcon SetCursorPos GetUpdateRect UnionRect GetClientRect InflateRect OffsetRect LoadIconW GetDlgItem SetParent DrawFrameControl SetClassLongW CreateAcceleratorTableW GetKeyboardState GetKeyboardLayout ToUnicodeEx IsCharLowerW CopyAcceleratorTableW GetIconInfo GetNextDlgGroupItem CopyImage DrawStateW EndPaint BeginPaint GrayStringW DrawTextExW DrawTextW TabbedTextOutW ShowOwnedPopups GetMessageW ValidateRect PostQuitMessage MapVirtualKeyW GetKeyNameTextW GetSysColorBrush WaitMessage SetWindowContextHelpId MapDialogRect RegisterClipboardFormatW CreateDialogIndirectParamW GetNextDlgTabItem EndDialog IsDialogMessageW MoveWindow SystemParametersInfoW IsMenu InsertMenuW GetMenuStringW

gdi32

ExtSelectClipRgn DeleteDC CreatePatternBrush SelectPalette GetObjectType CreateHatchBrush SetRectRgn CombineRgn GetMapMode DPtoLP SetDIBColorTable GetDIBits RealizePalette StretchBlt CreateDIBSection CreateDIBitmap GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo OffsetRgn GetRgnBox CreateEllipticRgn CreatePolygonRgn GetTextColor Polyline Ellipse Polygon LPtoDP RectVisible EnumFontFamiliesExW RoundRect ExtFloodFill CreatePalette GetPaletteEntries SetPaletteEntries GetWindowOrgEx PtInRegion FrameRgn GetBoundsRect GetViewportOrgEx GetNearestPaletteIndex GetSystemPaletteEntries SetPixelV PtVisible GetPixel GetWindowExtEx GetViewportExtEx SelectClipRgn SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect SetMapMode SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC PatBlt CreateRectRgnIndirect SetBkColor SetTextColor GetClipBox GetDCOrgEx CreateBitmap CreateRoundRectRgn DeleteObject SelectObject CreateCompatibleBitmap CreatePen BitBlt CreateCompatibleDC GetBkColor SetPixel FillRgn CreateRectRgn GetDeviceCaps GetStockObject CreateSolidBrush CreateFontIndirectW ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape GetObjectW GetTextExtentPoint32W ExtTextOutW GetTextFaceW TextOutW Rectangle CopyMetaFileW

msimg32

TransparentBlt AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW ord203

advapi32

RegOpenKeyExA RegCreateKeyW GetFileSecurityW SetFileSecurityW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteValueW RegSetValueExW RegSetValueW RegCreateKeyExW ConvertSidToStringSidW RegEnumValueW RegQueryInfoKeyW RegDeleteKeyW CreateServiceW StartServiceW DeleteService ControlService ChangeServiceConfigW RegEnumKeyExW OpenThreadToken EnumServicesStatusExW QueryServiceConfig2W QueryServiceConfigW QueryServiceStatus OpenServiceW CloseServiceHandle OpenSCManagerW LookupAccountSidW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA

shell32

ShellExecuteW SHGetFolderPathW ord64 DragFinish DragQueryFileW SHAppBarMessage SHGetFileInfoW ExtractIconW SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW

comctl32

ImageList_GetImageCount ImageList_ReplaceIcon ImageList_DrawEx ImageList_Destroy ImageList_GetIcon ImageList_GetIconSize ImageList_Create InitCommonControlsEx

shlwapi

PathRemoveExtensionW PathFindExtensionW PathAddBackslashW PathRemoveFileSpecW PathIsNetworkPathW PathIsUNCW PathGetDriveNumberW PathFindFileNameW PathRenameExtensionW PathIsDirectoryW PathStripToRootW PathFileExistsW

oledlg

OleUIBusyW

ole32

StgCreateDocfileOnILockBytes RegisterDragDrop CoLockObjectExternal RevokeDragDrop OleGetClipboard OleTranslateAccelerator IsAccelerator OleCreateMenuDescriptor CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes CoRegisterMessageFilter CoRevokeClassObject CoGetClassObject OleLockRunning DoDragDrop OleFlushClipboard OleIsCurrentClipboard CLSIDFromString CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize OleDuplicateData ReleaseStgMedium CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CreateStreamOnHGlobal CoTaskMemAlloc CoCreateGuid CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize OleDestroyMenuDescriptor

oleaut32

SysStringLen VariantChangeType VariantCopy SysAllocStringLen SafeArrayGetElement VariantTimeToSystemTime VariantClear VariantInit SysAllocString SysFreeString OleCreateFontIndirect SystemTimeToVariantTime SafeArrayDestroy

gdiplus

GdipAlloc GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDeleteFont GdipGetLogFontW GdipCreateFontFromLogfontW GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDrawString GdipCreateHICONFromBitmap GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageI GdipCreatePen1 GdipDeletePen GdipDrawLineI GdipCreateBitmapFromScan0 GdipFillRectangleI GdipMeasureString GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipBitmapLockBits GdipBitmapUnlockBits GdipFree GdiplusStartup GdipCreateBitmapFromHICON GdiplusShutdown

ws2_32

ntohl gethostname WSAEventSelect WSACreateEvent WSAEnumNetworkEvents WSAConnect WSASocketW WSACloseEvent gethostbyaddr getservbyport ntohs inet_ntoa htonl getservbyname htons WSAGetLastError gethostbyname inet_addr WSASetLastError shutdown WSACleanup WSAStartup closesocket

dnsapi

DnsQuery_W DnsRecordListFree

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

timeGetTime PlaySoundW

netapi32

NetApiBufferFree NetGroupGetUsers NetGroupEnum NetLocalGroupGetMembers NetLocalGroupEnum NetShareEnum NetServerGetInfo NetUserEnum NetWkstaGetInfo

iphlpapi

GetAdaptersInfo GetIfEntry GetIpForwardTable GetPerAdapterInfo

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList CM_Locate_DevNodeW CM_Get_DevNode_Registry_PropertyW CM_Get_Device_IDW CM_Get_Child CM_Get_Sibling CM_Get_Parent CM_Get_First_Log_Conf CM_Get_Next_Res_Des CM_Free_Res_Des_Handle CM_Get_Res_Des_Data_Size CM_Get_Res_Des_Data SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassImageList SetupDiDestroyClassImageList CM_Enumerate_Classes SetupDiGetClassDescriptionW CM_Get_DevNode_Status SetupDiGetClassDevsW

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

Sharing

General

Malware Config

Signatures

File Explorer

carrier.exe

PE Signature issue

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

ws2_32

dnsapi

version

winmm

netapi32

iphlpapi

setupapi

imm32

generic