iz3lne[.]zip | Triage™

Resubmissions

19/09/2024, 06:30

240919-g9r3psvepe7

19/09/2024, 06:27

240919-g7tthsvdrg5

19/09/2024, 06:21

240919-g4a71avcma7

19/09/2024, 06:17

240919-g127bavejl7

Sharing

Copy URL Twitter E-mail

General

Target
iz3lne.zip
Size 882KB
Sample240919-g4a71avcma
SHA256 14ce93ae01d50b9d2ff3c36c3edd574a9f8bcec56451f3a865fcc210c617a77b
MD5 6b104ba9deb749a6b6ce88b9c6997dae
SHA1 19d9b52477606b78bdce568235c0acb9321c1bc4
SHA512 26c804cca16e78016bead5fb43b5c2bca279beaf7edc062f756b43788dba89c49b9054028a271fe70bb1657ac61c704c0ddec38595b885cbd0d94cec1aedd885
SSDEEP 24576:5hQFuAEOVU1lerCPl2AWo44sBMG468LDnm:5hQFFQerCPl3jeh4Lnm
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/GenP-3.4.14.1.exe	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/GenP-3.4.14.1.exe
unpack001/SOURCE/NSudoLG.exe

File Explorer

iz3lne.zip

.zip 882KB
GenP-3.4.14.1.exe

.exe 1.2MB
SOURCE/COMPILE.txt

2KB
SOURCE/GenP-3.4.14.1.au3

.ps1 61KB
SOURCE/ICONS/Logo.ico

156KB
SOURCE/NSudoLG.exe

.exe 156KB
SOURCE/README.txt

463B
SOURCE/config.ini

7KB

iz3lne.zip

SHA256 14ce93ae01d50b9d2ff3c36c3edd574a9f8bcec56451f3a865fcc210c617a77b
MD5 6b104ba9deb749a6b6ce88b9c6997dae
SHA1 19d9b52477606b78bdce568235c0acb9321c1bc4
SHA512 26c804cca16e78016bead5fb43b5c2bca279beaf7edc062f756b43788dba89c49b9054028a271fe70bb1657ac61c704c0ddec38595b885cbd0d94cec1aedd885
SSDEEP 24576:5hQFuAEOVU1lerCPl2AWo44sBMG468LDnm:5hQFFQerCPl3jeh4Lnm
MD5 SHA1 SHA512 SSDEEP

Password

12345password

GenP-3.4.14.1.exe

IMPHASH 8e94250c88a6c0e478828f96bcbb1662
SHA256 3bddb83344219a07a43e53f68a0f6920fdd51b7412540d0daaeac353b6ab11a2
MD5 5aa73ce6297b35aac0067529a47b44c5
SHA1 48238c0c52990ab1f64ca8faa7fc310fd729af49
SHA512 ceb9d4c9f364b0c2411623a911a02a491364be5e8a35a7823a7fe8ff71b34ba29fa54963a2be32efd6df763af09f3eb66019d8778b4d49c70133b81bd5397ff7
SSDEEP 24576:orORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvarx8mfm0G:o2EYTb8atv1orq+pEiSDTj1VyvBarxpl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Password

12345password

Minor OS version

Major OS version

Entry point

152732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

gethostbyname recv send socket inet_ntoa setsockopt ntohs WSACleanup WSAStartup sendto htons __WSAFDIsSet select accept listen bind inet_addr ioctlsocket recvfrom WSAGetLastError closesocket gethostname connect

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetGetConnectionW WNetCancelConnection2W WNetUseConnectionW WNetAddConnection2W

wininet

HttpOpenRequestW InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW InternetConnectW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetQueryDataAvailable

psapi

GetProcessMemoryInfo

iphlpapi

IcmpSendEcho IcmpCloseHandle IcmpCreateFile

userenv

DestroyEnvironmentBlock LoadUserProfileW CreateEnvironmentBlock UnloadUserProfile

uxtheme

IsThemeActive

kernel32

WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose GetLongPathNameW GetShortPathNameW DeleteFileW FindNextFileW CopyFileExW GetFullPathNameW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency LoadResource LockResource SizeofResource OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl LoadLibraryW GetLocalTime CompareStringW EnterCriticalSection DuplicateHandle GetStdHandle CreatePipe TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass VirtualAlloc SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetSystemTimeAsFileTime CreateThread GetCurrentProcess GetCurrentThread LeaveCriticalSection InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError TlsAlloc ResetEvent WaitForSingleObjectEx TlsGetValue TlsSetValue TlsFree EncodePointer ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetACP GetDateFormatW GetTimeFormatW LCMapStringW GetStringTypeW GetFileType SetStdHandle GetConsoleCP GetConsoleMode ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CloseHandle WriteConsoleW MoveFileW RtlCaptureContext

user32

GetMenuStringW GetSubMenu GetCaretPos IsZoomed GetWindowLongW GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongPtrW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics SetWindowLongPtrW GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture BlockInput GetMessageW LockWindowUpdate DispatchMessageW TranslateMessage PeekMessageW GetInputState UnregisterHotKey CharLowerBuffW MonitorFromPoint MonitorFromRect LoadImageW mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows IsCharUpperW InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW GetClipboardData keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW IsCharLowerW IsCharAlphaNumericW IsCharAlphaW GetKeyboardLayoutNameW ClientToScreen RegisterHotKey GetCursorInfo SetWindowPos CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats SetMenuDefaultItem CloseClipboard GetWindowRect SetUserObjectSecurity IsClipboardFormatAvailable CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon SystemParametersInfoW OpenClipboard GetWindowLongPtrW

gdi32

EndPath DeleteObject GetDeviceCaps ExtCreatePen StrokePath SetPixel CloseFigure LineTo AngleArc MoveToEx Ellipse PolyDraw GetTextExtentPoint32W CreateCompatibleBitmap BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject CreateDCW GetPixel DeleteDC GetDIBits StretchBlt SelectObject CreateCompatibleDC StrokeAndFillPath

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation RegSetValueExW GetSecurityDescriptorDacl GetAclInformation RegCreateKeyExW AddAce SetSecurityDescriptorDacl InitiateSystemShutdownExW GetUserNameW

shell32

DragFinish DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket

oleaut32

VariantChangeType DispCallFunc CreateStdDispatch CreateDispTypeInfo UnRegisterTypeLi UnRegisterTypeLibForUser RegisterTypeLibForUser RegisterTypeLi LoadTypeLibEx VariantCopyInd VariantTimeToSystemTime SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData VariantInit VariantClear VariantCopy SysAllocString SafeArrayCreateVector VarR8FromDec SafeArrayAllocDescriptorEx SafeArrayAllocData SysStringLen SafeArrayGetVartype OleLoadPicture QueryPathOfRegTypeLi SysReAllocString SafeArrayAccessData

SOURCE/NSudoLG.exe

IMPHASH 21c5088120f053f6a67b20e86076cca2
SHA256 871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8
MD5 7aacfd85b8dff0aa6867bede82cfd147
SHA1 e783f6d4b754ea8424699203b8831bdc9cbdd4e6
SHA512 59cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0
SSDEEP 3072:uwEUNZLRS8gLI7qwnKE6Cv/89RvD7c5Q9a88QuA6337p:/NBRS8AzdC3Qvr9aDQuA6b
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

12345password

Minor OS version

Major OS version

Entry point

55296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\MouriNaruto\NSudoPrivate\Source\Native\Output\Binaries\Release\x64\NSudoLG.pdb

kernel32

CreateEventW MultiByteToWideChar GetTickCount64 LockResource QueryPerformanceFrequency FindResourceExW LoadResource GetOverlappedResult GetProcAddress VerSetConditionMask FreeLibrary SleepEx VerifyVersionInfoW QueryPerformanceCounter LoadLibraryExW SetPriorityClass GetCurrentProcess OpenProcess WaitForSingleObjectEx GetLocalTime GetCurrentProcessId GetModuleHandleExW ExitProcess Sleep TerminateProcess OutputDebugStringW LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW InitializeCriticalSection ExpandEnvironmentStringsW GetFileInformationByHandleEx SizeofResource ReadFile MulDiv GetModuleHandleW GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException CloseHandle GetThreadUILanguage GetLastError GetCurrentThreadId GetFileAttributesW CreateFileW InitializeCriticalSectionEx LeaveCriticalSection SetThreadUILanguage HeapFree GetCommandLineW EnterCriticalSection SetLastError ResumeThread RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

user32

SendMessageW GetWindowTextW EndPaint BeginPaint DrawIconEx LoadImageW EndDialog ChangeWindowMessageFilter DestroyIcon UnregisterClassW SetWindowLongPtrW MonitorFromWindow GetDC SetWindowTextW GetDlgItem LoadIconW DialogBoxParamW GetClientRect

gdi32

DeleteDC GetDeviceCaps

comdlg32

GetOpenFileNameW

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW SetThreadToken CreateProcessAsUserW GetAce CloseServiceHandle OpenSCManagerW SetTokenInformation AllocateAndInitializeSid IsWellKnownSid AddAce OpenProcessToken CreateRestrictedToken FreeSid StartServiceW InitializeAcl OpenServiceW GetLengthSid DuplicateTokenEx AddAccessAllowedAce QueryServiceStatusEx GetTokenInformation

shell32

DragQueryFileW DragFinish

ole32

CoInitializeEx

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateProcessesW WTSEnumerateSessionsW

msvcrt

memset memmove __DestructExceptionObject _msize __set_app_type _wcmdln abort _initterm_e _commode _XcptFilter realloc _initterm __setusermatherr __C_specific_handler _CxxThrowException ??0exception@@QEAA@AEBQEBD@Z _wcsnicmp wcsstr malloc wcsrchr free strncmp ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ ??2@YAPEAX_K@Z _wcsicmp __CxxFrameHandler3 ??3@YAXPEAX@Z __wgetmainargs _amsg_exit _errno ?terminate@@YAXXZ _set_fmode ___mb_cur_max_func memcpy __pctype_func tolower wcstol _mbtowc_l wcsnlen localeconv strrchr strcpy_s ceil log10 _clearfp memcmp

generic

count=1, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=2, id=257, productName=VS2019 v16.7.0 build 29110, version=29110,

count=13, id=199, version=41118,

count=3, id=260, version=30034,

count=4, id=259, version=30034,

count=4, id=260, version=27412,

count=7, id=261, version=27412,

count=22, id=261, version=29912,

count=6, id=261, version=30034,

count=7, id=260, productName=VS2019 v16.10.0 build 30037, version=30037,

count=24, id=261, productName=VS2019 v16.10.0 build 30037, version=30037,

count=21, id=257, version=27412,

count=268, id=1, productName=Unmarked objects,

count=5, id=265, version=30037,

count=1, id=255, productName=VS2019 v16.10.0 build 30037, version=30037,

count=4, id=151,

count=1, id=258, productName=VS2019 v16.10.0 build 30037, version=30037,

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

iz3lne.zip

GenP-3.4.14.1.exe

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

SOURCE/COMPILE.txt

SOURCE/GenP-3.4.14.1.au3

SOURCE/ICONS/Logo.ico

SOURCE/NSudoLG.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

userenv

wtsapi32

msvcrt

generic

SOURCE/README.txt

SOURCE/config.ini