usermode[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

usermode.exe
Size

434KB
MD5

bd8c03e599bf74ed97db13b72556c7d5
SHA1

ebf6ea6b1737f7aafce3da663ab1de7d6192e615
SHA256

c069dd91f3e0aaae6119b6ba26db5441a55bade4fbcce66a48bb1f53a680639d
SHA512

06b225bb246df2f1fd1b5a6213f1d78b0f6f3ffd02088b5e1fc830af6bec80c2c0cd02fbc54a6912a564b4c427d47dc811a84b2feb807f6e0aa41751bb8e9a11
SSDEEP

6144:Megz4Wr4iHawAmy8KzMVs+QMOMg6DnuTgrGNLmq4gMvhwMmsivhEYhHfy:m/5HKz+QJMgwCpNVjFh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
usermode.exe

Files

usermode.exe
.exe windows:6 windows x64 arch:x64

2b3ee6d1d549da4da86ee6a599f405d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\peter\Desktop\!1A FN-Ext\build\usermode\usermode.pdb

Imports

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetFileInformationByHandleEx
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetCurrentThreadId
AreFileApisANSI
GetLastError
VerSetConditionMask
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageA
Sleep
CreateFileW
GetStdHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
QueryPerformanceCounter
Process32Next
FindFirstFileW
FindClose
GetLocaleInfoEx
WideCharToMultiByte
GetFileSizeEx
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetEnvironmentVariableA
MultiByteToWideChar
WaitForSingleObjectEx
MoveFileExA
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDirectoryA
CreateFileA
GetTickCount64
CreateToolhelp32Snapshot
Process32First
CheckRemoteDebuggerPresent
IsDebuggerPresent
FreeLibrary
GetProcessHeap
GetProcAddress
GetThreadContext
CloseHandle
LoadLibraryA
GetCurrentThread
GetModuleHandleA
HeapWalk
GetCurrentProcess
GetModuleHandleW
SetLastError
WriteProcessMemory
VerifyVersionInfoA
GetTickCount

user32

GetSystemMetrics

advapi32

GetUserNameA
OpenSCManagerA
CloseServiceHandle
EnumServicesStatusA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
_Query_perf_frequency
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?good@ios_base@std@@QEBA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

normaliz

IdnToAscii

wldap32

ord41
ord50
ord45
ord60
ord211
ord26
ord27
ord46
ord217
ord143
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord22

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptStringToBinaryA
CertOpenStore
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertEnumCertificatesInStore

ws2_32

accept
ntohl
closesocket
htonl
recv
send
WSAGetLastError
bind
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
WSAStartup
connect
WSAIoctl
getpeername
getsockname
getsockopt
sendto
htons
ntohs
setsockopt
socket
gethostname
WSASetLastError
WSACleanup

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy
strstr
strchr
__std_exception_destroy
memchr
memcmp
memcpy
memmove
memset
__std_terminate
_CxxThrowException
strrchr
__C_specific_handler
__current_exception
__current_exception_context

api-ms-win-crt-heap-l1-1-0

_set_new_mode
realloc
malloc
calloc
_callnewh
free

api-ms-win-crt-string-l1-1-0

strcmp
strspn
isupper
_strdup
strncmp
strcspn
tolower
strpbrk
strncpy

api-ms-win-crt-runtime-l1-1-0

__sys_nerr
_errno
_beginthreadex
system
_getpid
exit
_invalid_parameter_noinfo_noreturn
abort
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_configure_narrow_argv
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
strerror

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-stdio-l1-1-0

fread
__stdio_common_vsscanf
_read
_write
__p__commode
_lseeki64
_open
__acrt_iob_func
fflush
_close
feof
fputs
fopen
fclose
__stdio_common_vsprintf
fseek
_set_fmode
ftell
fputc
fgets
fwrite

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi
strtol
strtoll
strtoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-filesystem-l1-1-0

_unlink
_fstat64
_access
_stat64

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
_configthreadlocale

Sections

.text
Size: 314KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b3ee6d1d549da4da86ee6a599f405d2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

msvcp140

normaliz

wldap32

crypt32

ws2_32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 314KB - Virtual size: 313KB

.rdata Size: 99KB - Virtual size: 98KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 14KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 314KB - Virtual size: 313KB

.rdata
Size: 99KB - Virtual size: 98KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 2KB - Virtual size: 1KB