f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe
Size 2.3MB
Sample240917-kcnksstdkl
SHA256 f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c
MD5 9fb83bee6ff97065c498f48fc094f848
SHA1 860112de5e833eb5fd9abaaf6db7c881c13220f8
SHA512 103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96
SSDEEP 49152:YMLtHPldWW5afLAUCweyFI0ZBAFCGLcRe2xTIYLEs:j5aMUzRe2M
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

File Explorer

f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

.exe 2.3MB

f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

IMPHASH 6d8ae0d2e04c00f81a9b4bcd9a56d1d6
SHA256 f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c
MD5 9fb83bee6ff97065c498f48fc094f848
SHA1 860112de5e833eb5fd9abaaf6db7c881c13220f8
SHA512 103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96
SSDEEP 49152:YMLtHPldWW5afLAUCweyFI0ZBAFCGLcRe2xTIYLEs:j5aMUzRe2M
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

613616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\3ec84b7238d5b18a\BUILDS\Release\x64\overseer.pdb

shell32

ShellExecuteExW SHGetFolderPathW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ntdll

RtlPcToFileHeader NtDeleteKey NtQueryKey NtOpenKey NtClose RtlVirtualUnwind RtlNtStatusToDosError VerSetConditionMask RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlUnwind

kernel32

CreateProcessW ReadFile VerifyVersionInfoW FileTimeToSystemTime GetSystemTimeAsFileTime InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA TlsAlloc TlsGetValue TlsSetValue FreeLibrary CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore GetSystemInfo GetTickCount QueryPerformanceFrequency QueryPerformanceCounter ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW LoadLibraryExW GetWindowsDirectoryW GetSystemDirectoryW VirtualAlloc VirtualFree GlobalMemoryStatusEx GetExitCodeThread TlsFree GetDriveTypeW SetFilePointer K32GetProcessImageFileNameW LockFileEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesExW FindClose CreateDirectoryW GetCurrentDirectoryW FindFirstFileExW GetCurrentThread QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetEnvironmentVariableW GetDateFormatW GetTimeFormatW InitializeCriticalSectionAndSpinCount GetVersion LockResource FindResourceExW SetEnvironmentVariableW UnlockFileEx K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GetSystemTimes RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive GetSystemDirectoryA GetModuleHandleA LoadLibraryA MoveFileExA GetEnvironmentVariableA SleepEx CreateFileA ExpandEnvironmentStringsA GetWindowsDirectoryA GetVersionExA WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent InitOnceBeginInitialize CompareStringW UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList InitOnceComplete FreeLibraryWhenCallbackReturns SetFileAttributesW GetFileSizeEx SetFilePointerEx WriteFile SetEndOfFile GetExitCodeProcess WaitForSingleObject FormatMessageW GetModuleHandleExW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc HeapReAlloc HeapSize InitializeCriticalSectionEx HeapFree GetCommandLineW OpenMutexW GetComputerNameW GetLocaleInfoA GetDiskFreeSpaceExW GetNativeSystemInfo GetVersionExW SetLastError ReleaseMutex MultiByteToWideChar OutputDebugStringW GetCurrentProcessId GetCurrentThreadId DeviceIoControl CopyFileW MoveFileExW FlushFileBuffers CreateFileW GetCurrentProcess SetPriorityClass HeapSetInformation CreateMutexW LocalFree GetProcAddress SetDllDirectoryW GetSystemPowerStatus QueryUnbiasedInterruptTime SizeofResource LoadResource FindResourceW GetModuleHandleW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcessTimes WideCharToMultiByte TerminateProcess CloseHandle OpenProcess GetLastError Sleep GetTickCount64 FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FormatMessageA FlsAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime TryAcquireSRWLockExclusive GetStringTypeW FreeEnvironmentStringsW SetStdHandle WriteConsoleW PeekNamedPipe GetFileType ExitProcess GetStdHandle FreeLibraryAndExitThread ExitThread CreateThread InterlockedPushEntrySList GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead IsDebuggerPresent GetCPInfo LCMapStringEx EncodePointer GetLocaleInfoEx WaitForSingleObjectEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FindNextFileW SetFileInformationByHandle

user32

LoadStringW RegisterClassExW GetClassInfoExW

advapi32

ConvertStringSidToSidW OpenServiceW QueryServiceStatusEx CloseServiceHandle ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW RegSetValueExW RegCloseKey QueryServiceStatus ControlService StartServiceW SystemFunction036 RegQueryValueExA RegOpenKeyExA RegEnumKeyExA CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextA CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegDeleteKeyExW RegEnumKeyW RegQueryInfoKeyW RegDeleteValueW RegQueryValueExW RegOpenKeyExW OpenSCManagerW FreeSid EqualSid LookupAccountSidW AllocateAndInitializeSid RevertToSelf ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW OpenThreadToken GetTokenInformation OpenProcessToken

ole32

CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

bcrypt

BCryptGenRandom

ws2_32

getsockopt WSAResetEvent send getservbyname recvfrom gethostname ioctlsocket recv getsockname getpeername connect bind htonl WSAGetLastError select __WSAFDIsSet WSAIoctl setsockopt socket htons closesocket WSACleanup WSAStartup WSASetLastError ntohs ntohl WSAWaitForMultipleEvents WSACloseEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent

crypt32

CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore

winhttp

WinHttpCrackUrl

iphlpapi

GetBestRoute2 GetUnicastIpAddressTable FreeMibTable GetAdaptersAddresses

shlwapi

PathMatchSpecW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

525KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=213, id=261, version=29395,

count=11, id=253, version=33030,

count=19, id=260, version=33030,

count=116, id=261, version=33030,

count=18, id=259, version=33030,

count=16, id=259, version=29395,

count=32, id=260, version=29395,

count=166, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=259, productName=VS2019 v16.4.0 build 28314, version=28314,

count=12, id=260, productName=VS2019 v16.4.0 build 28314, version=28314,

count=13, productName=Unmarked objects (old),

count=1, id=262, version=29395,

count=4, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=477, id=1, productName=Unmarked objects,

count=31, id=257, version=29395,

count=162, id=265, version=33130,

count=1, id=256, version=33130,

count=1, id=255, version=33130,

count=2, id=151,

count=1, id=258, version=33130,