check[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
check.exe
Size 2.3MB
Sample240822-sdps9atbjh
SHA256 2114aefe4d9460c04028d45b0f41ca9c65cea365727fda0fd2a885222c87db3c
MD5 1f3d6134710193f7d4d1e864d5e6b362
SHA1 538a93f3103e461906f783210c08cb1a4708a438
SHA512 85a9d0906d57b276ae8eedc6f7a3a8b109c7c68e1e7805f5ab3a5fa26c09e80cdf786e71e1e6f7d03479d7510393aa8710ae969847285900e7b5fbd44343fffc
SSDEEP 49152:YMLtHPldWWLafLAUCweyFI0ZBAFCGLcRe2xTIYLEJL:jLaMUzRe2M
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
check.exe

File Explorer

check.exe

.exe 2.3MB

check.exe

IMPHASH 6d8ae0d2e04c00f81a9b4bcd9a56d1d6
SHA256 2114aefe4d9460c04028d45b0f41ca9c65cea365727fda0fd2a885222c87db3c
MD5 1f3d6134710193f7d4d1e864d5e6b362
SHA1 538a93f3103e461906f783210c08cb1a4708a438
SHA512 85a9d0906d57b276ae8eedc6f7a3a8b109c7c68e1e7805f5ab3a5fa26c09e80cdf786e71e1e6f7d03479d7510393aa8710ae969847285900e7b5fbd44343fffc
SSDEEP 49152:YMLtHPldWWLafLAUCweyFI0ZBAFCGLcRe2xTIYLEJL:jLaMUzRe2M
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

613616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\3ec84b7238d5b18a\BUILDS\Release\x64\overseer.pdb

shell32

ShellExecuteExW SHGetFolderPathW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ntdll

RtlPcToFileHeader NtDeleteKey NtQueryKey NtOpenKey NtClose RtlVirtualUnwind RtlNtStatusToDosError VerSetConditionMask RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlUnwind

kernel32

CreateProcessW ReadFile VerifyVersionInfoW FileTimeToSystemTime GetSystemTimeAsFileTime InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA TlsAlloc TlsGetValue TlsSetValue FreeLibrary CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore GetSystemInfo GetTickCount QueryPerformanceFrequency QueryPerformanceCounter ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW LoadLibraryExW GetWindowsDirectoryW GetSystemDirectoryW VirtualAlloc VirtualFree GlobalMemoryStatusEx GetExitCodeThread TlsFree GetDriveTypeW SetFilePointer K32GetProcessImageFileNameW LockFileEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesExW FindClose CreateDirectoryW GetCurrentDirectoryW FindFirstFileExW GetCurrentThread QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetEnvironmentVariableW GetDateFormatW GetTimeFormatW InitializeCriticalSectionAndSpinCount GetVersion LockResource FindResourceExW SetEnvironmentVariableW UnlockFileEx K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GetSystemTimes RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive GetSystemDirectoryA GetModuleHandleA LoadLibraryA MoveFileExA GetEnvironmentVariableA SleepEx CreateFileA ExpandEnvironmentStringsA GetWindowsDirectoryA GetVersionExA WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent InitOnceBeginInitialize CompareStringW UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList InitOnceComplete FreeLibraryWhenCallbackReturns SetFileAttributesW GetFileSizeEx SetFilePointerEx WriteFile SetEndOfFile GetExitCodeProcess WaitForSingleObject FormatMessageW GetModuleHandleExW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc HeapReAlloc HeapSize InitializeCriticalSectionEx HeapFree GetCommandLineW OpenMutexW GetComputerNameW GetLocaleInfoA GetDiskFreeSpaceExW GetNativeSystemInfo GetVersionExW SetLastError ReleaseMutex MultiByteToWideChar OutputDebugStringW GetCurrentProcessId GetCurrentThreadId DeviceIoControl CopyFileW MoveFileExW FlushFileBuffers CreateFileW GetCurrentProcess SetPriorityClass HeapSetInformation CreateMutexW LocalFree GetProcAddress SetDllDirectoryW GetSystemPowerStatus QueryUnbiasedInterruptTime SizeofResource LoadResource FindResourceW GetModuleHandleW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcessTimes WideCharToMultiByte TerminateProcess CloseHandle OpenProcess GetLastError Sleep GetTickCount64 FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FormatMessageA FlsAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime TryAcquireSRWLockExclusive GetStringTypeW FreeEnvironmentStringsW SetStdHandle WriteConsoleW PeekNamedPipe GetFileType ExitProcess GetStdHandle FreeLibraryAndExitThread ExitThread CreateThread InterlockedPushEntrySList GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead IsDebuggerPresent GetCPInfo LCMapStringEx EncodePointer GetLocaleInfoEx WaitForSingleObjectEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FindNextFileW SetFileInformationByHandle

user32

LoadStringW RegisterClassExW GetClassInfoExW

advapi32

ConvertStringSidToSidW OpenServiceW QueryServiceStatusEx CloseServiceHandle ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW RegSetValueExW RegCloseKey QueryServiceStatus ControlService StartServiceW SystemFunction036 RegQueryValueExA RegOpenKeyExA RegEnumKeyExA CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegDeleteKeyExW RegEnumKeyW RegQueryInfoKeyW RegDeleteValueW RegQueryValueExW RegOpenKeyExW OpenSCManagerW FreeSid EqualSid LookupAccountSidW AllocateAndInitializeSid RevertToSelf ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW OpenThreadToken GetTokenInformation OpenProcessToken

ole32

CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

bcrypt

BCryptGenRandom

ws2_32

getsockopt WSAResetEvent send getservbyname recvfrom gethostname ioctlsocket recv getsockname getpeername connect bind htonl WSAGetLastError select __WSAFDIsSet WSAIoctl setsockopt socket htons closesocket WSACleanup WSAStartup WSASetLastError ntohs ntohl WSAWaitForMultipleEvents WSACloseEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent

crypt32

CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore

winhttp

WinHttpCrackUrl

iphlpapi

GetBestRoute2 GetUnicastIpAddressTable FreeMibTable GetAdaptersAddresses

shlwapi

PathMatchSpecW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

525KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=213, id=261, version=29395,

count=11, id=253, version=33030,

count=19, id=260, version=33030,

count=116, id=261, version=33030,

count=18, id=259, version=33030,

count=16, id=259, version=29395,

count=32, id=260, version=29395,

count=166, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=259, productName=VS2019 v16.4.0 build 28314, version=28314,

count=12, id=260, productName=VS2019 v16.4.0 build 28314, version=28314,

count=13, productName=Unmarked objects (old),

count=1, id=262, version=29395,

count=4, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=477, id=1, productName=Unmarked objects,

count=31, id=257, version=29395,

count=162, id=265, version=33130,

count=1, id=256, version=33130,

count=1, id=255, version=33130,

count=2, id=151,

count=1, id=258, version=33130,