net1[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

net1.exe
Size

179KB
MD5

78e53d5ae8839c58fa40bea32b775999
SHA1

886622877afb2f110abfaab79c107119a7e569ab
SHA256

e62071aa18768dd88acaf97fa7b1f2fec9fcce89736c1ee9a800699328d196ea
SHA512

935f3ecb42f6ec28453547036fc1ea39f5005abad40097428df52e90914e9afe475348c03c9cbf47bdaf89f0f6a7c7b3e289030e33b07f56433ca79a385868bd
SSDEEP

3072:5rvJn0jLYI03DcRwkyNDzf1bFQsZ/fVrHK4zAIO0FkArdGeR657nHZ81zKbHqsV9:5rJI0zcRwkyNDzf1bC+/lHK4zAIO0FkB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
net1.exe

Files

net1.exe
.exe windows:10 windows x64 arch:x64

537aef5b177e3302247dab07a052b2d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

net1.pdb

Imports

msvcrt

_snwprintf_s
_vsnwprintf_s
putchar
_wcsdup
wcstok
wcspbrk
_local_unwind
memcpy
memmove
_wcsicmp
memset
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
__iob_func
__getmainargs
_amsg_exit
_XcptFilter
wcscspn
iswctype
wcsrchr
calloc
_wcsrev
malloc
free
realloc
swprintf_s
_ultow
wcsstr
wcsncat_s
_vsnwprintf
wcschr
sprintf_s
_wcsnicmp
_fileno
_setmode
setlocale
exit
wcsspn
qsort
wcsncmp
wcscpy_s
_wcsupr
wcsncpy_s
__set_app_type
_wcslwr
wcscat_s
wcstod
wcscmp

samcli

NetGroupGetInfo
NetGroupSetInfo
NetUserDel
NetGroupAdd
NetGroupGetUsers
NetGroupEnum
NetGroupAddUser
NetGroupDel
NetUserAdd
NetUserSetInfo
NetUserGetGroups
NetUserEnum
NetUserGetInfo
NetUserModalsSet
NetUserModalsGet
NetGroupDelUser

netutils

NetApiBufferAllocate
NetpwNameValidate
NetapipBufferAllocate
NetApiBufferFree
NetpwListCanonicalize
NetpwNameCompare
NetpwListTraverse
NetpwPathType
NetpwNameCanonicalize
NetApiBufferReallocate

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
SetLocalTime
GetTickCount
GetComputerNameExW

api-ms-win-core-synch-l1-2-0

Sleep

srvcli

NetFileGetInfo
NetFileClose
NetFileEnum
NetSessionEnum
NetServerTransportEnum
NetServerSetInfo
NetServerGetInfo
NetConnectionEnum
NetSessionGetInfo
NetSessionDel
NetShareGetInfo
NetShareCheck
NetShareEnum
NetShareSetInfo
NetShareDel
NetShareAdd
NetShareDelSticky
NetRemoteTOD

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetCPInfo
FormatMessageW
SetThreadUILanguage
GetUserDefaultLCID

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetStdHandle

api-ms-win-core-console-l1-1-0

GetConsoleMode
SetConsoleMode
ReadConsoleW
GetConsoleOutputCP
WriteConsoleW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapSetInformation

wkscli

NetUseDel
NetWkstaUserGetInfo
NetWkstaTransportEnum
NetWkstaGetInfo
NetUseEnum
NetWkstaStatisticsGet

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryExW

api-ms-win-security-base-l1-1-0

InitializeAcl
GetLengthSid
CopySid
GetSidLengthRequired
AddAccessAllowedAce
CreateWellKnownSid
GetSidSubAuthority
GetAce
EqualSid
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSidSubAuthorityCount

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
GlobalFree
GlobalAlloc

api-ms-win-core-file-l1-1-0

GetDriveTypeW
GetFileType
WriteFile

api-ms-win-core-sysinfo-l1-2-0

SetSystemTime

logoncli

DsGetDcNameW

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

cryptbase

SystemFunction036

api-ms-win-service-management-l1-1-0

OpenSCManagerW
StartServiceW
OpenServiceW
CloseServiceHandle

api-ms-win-service-core-l1-1-2

GetServiceKeyNameW
GetServiceDisplayNameW

api-ms-win-service-core-l1-1-1

EnumServicesStatusExW
EnumDependentServicesW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlCompareMemory
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-console-l1-2-0

PeekConsoleInputW

api-ms-win-core-privateprofile-l1-1-0

GetProfileStringW

api-ms-win-security-activedirectoryclient-l1-1-0

DsUnBindW
DsFreeNameResultW
DsBindWithSpnExW
DsCrackNamesW

ntdll

NtQuerySystemTime
RtlLengthSid
RtlTimeToSecondsSince1970
RtlAllocateHeap
RtlCopySid
RtlxOemStringToUnicodeSize
RtlInitString
RtlOemStringToUnicodeString
RtlInitUnicodeString
RtlInitAnsiString
RtlQueryTimeZoneInformation
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
RtlTimeFieldsToTime
RtlNtStatusToDosError
RtlSubAuthorityCountSid
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlGetNtProductType
NtOpenProcessToken
NtClose

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

537aef5b177e3302247dab07a052b2d8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

samcli

netutils

api-ms-win-core-registry-l1-1-0

dsrole

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

srvcli

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

wkscli

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

logoncli

api-ms-win-core-datetime-l1-1-0

cryptbase

api-ms-win-service-management-l1-1-0

api-ms-win-service-core-l1-1-2

api-ms-win-service-core-l1-1-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-security-activedirectoryclient-l1-1-0

ntdll

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 130KB - Virtual size: 129KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 15KB - Virtual size: 60KB

.pdata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 288B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 852B

.text
Size: 130KB - Virtual size: 129KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 15KB - Virtual size: 60KB

.pdata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 288B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 852B