runas[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

runas.exe
Size

20KB
MD5

fe2b85d19b0c36e51229145bf483d6e9
SHA1

33d95a2640b07f905d6be7cf05069e5fc848b3e9
SHA256

0867cc5937ab24d4cb334c1ef66a43d061923c856c64e585b15c3c9833ecba0e
SHA512

d326c583506c0bdc752b626a702308ff22ed8eefaeb8b48228b2a7db85522667aa7eb3648592176b5a1831ff37a6835d895cc07201b0d6e1d92259112b3be029
SSDEEP

384:M13uktNRQP6gFEcNEAhcSGpSW24GY2YorKq9bOOOoe2RzeMfeypWCOW:cektftQEcNEwi724GjYo9Yye7yb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
runas.exe

Files

runas.exe
.exe windows:10 windows x64 arch:x64

bb66b03234c66ac6a9f7ba5216f66930

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

runas.pdb

Imports

advapi32

CredUnmarshalCredentialW
CredFree
SaferComputeTokenFromLevel
SaferGetLevelInformation
CreateProcessAsUserW
SaferCreateLevel
CredMarshalCredentialW
CredGetSessionTypes
SaferGetPolicyInformation
SaferCloseLevel
CreateProcessWithLogonW
CredWriteW
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose

kernel32

LocalFree
GetProcessHeap
SetThreadPreferredUILanguages
GetEnvironmentStringsW
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
Sleep
HeapAlloc
HeapSetInformation
CloseHandle
GetLastError
FormatMessageW
GetExitCodeThread
GetStdHandle
GetModuleHandleW
GetCommandLineW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentDirectoryW
SetLastError
HeapFree
lstrcmpiW
GetVersionExW
lstrlenW
WriteConsoleW
GetCurrentThreadId
GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime

msvcrt

_commode
_fmode
_acmdln
memcpy
?terminate@@YAXXZ
__setusermatherr
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
wcschr
wcstoul
_vsnwprintf
_resetstkoflw
__C_specific_handler
_initterm
_ismbblead
memset

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

credui

SspiIsPromptingNeeded
CredUICmdLinePromptForCredentialsW

user32

LoadStringW

shell32

CommandLineToArgvW

crypt32

CertCloseStore
CertOpenSystemStoreW
CertFindCertificateInStore
CertGetNameStringW
CertFreeCertificateContext

netutils

NetApiBufferAllocate
NetApiBufferFree

sspicli

GetUserNameExW

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb66b03234c66ac6a9f7ba5216f66930

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ntdll

credui

user32

shell32

crypt32

netutils

sspicli

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 432B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 32B

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 432B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 32B