Registry[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Registry.exe
Size

47.6MB
MD5

b16181d4ad0da57024cc3cc5935147e8
SHA1

5ca16ea55827db634cd570ac3952bc4a31ec27f5
SHA256

1f39254002bc937c4ac94701dc1f033102cf2b00533eb99a30fba3db87148bfc
SHA512

93b79f3577c895eaa662edcfc7ac7c46ed2c10c57aa6cad164ac6208e94a74ba6092f45c6e77fce3bcc52f1e875d65189f846a12db4273e69a7adfefc30fe00e
SSDEEP

786432:2inB7YtysOsApEGkEi2I/jbh8S36ipzROU8Bwrm3Ov+GFcOmFAFW1f2u:DnB7YtrOBg2I/jbh8VQt8erzHmFIWR2u

Score

1^/10

Malware Config

Signatures

Files

Registry.exe
.exe windows:6 windows x64 arch:x64

39ec057abd44be4694481a26cb5de2b9

Code Sign

7c:af:69:0a:25:b7:39:fe:7b:9b:44:7a:c1:78:c5:ee
Certificate

Issuer

CN=Apple Root CA,OU=Apple Certification Authority,O=Apple Inc.,C=US

Not Before

19-02-2020 18:13

Not After

20-02-2030 00:00

Subject

CN=Apple Worldwide Developer Relations Certification Authority,OU=G3,O=Apple Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:3b:bd:61:0f:b8:8b:19:52:95:21:1c:eb:94:b6:9e
Certificate

Issuer

CN=Apple Worldwide Developer Relations Certification Authority,OU=G3,O=Apple Inc.,C=US

Not Before

18-04-2023 03:42

Not After

17-04-2026 03:42

Subject

CN=iPhone Distribution: TVMining Media Technology Co.\, Ltd.,OU=B7ASWPLEQP,O=TVMining Media Technology Co.\, Ltd.,C=CN,0.9.2342.19200300.100.1.1=#130a4237415357504c455150

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7c:af:69:0a:25:b7:39:fe:7b:9b:44:7a:c1:78:c5:ee
Certificate

Issuer

CN=Apple Root CA,OU=Apple Certification Authority,O=Apple Inc.,C=US

Not Before

19-02-2020 18:13

Not After

20-02-2030 00:00

Subject

CN=Apple Worldwide Developer Relations Certification Authority,OU=G3,O=Apple Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:3b:bd:61:0f:b8:8b:19:52:95:21:1c:eb:94:b6:9e
Certificate

Issuer

CN=Apple Worldwide Developer Relations Certification Authority,OU=G3,O=Apple Inc.,C=US

Not Before

18-04-2023 03:42

Not After

17-04-2026 03:42

Subject

CN=iPhone Distribution: TVMining Media Technology Co.\, Ltd.,OU=B7ASWPLEQP,O=TVMining Media Technology Co.\, Ltd.,C=CN,0.9.2342.19200300.100.1.1=#130a4237415357504c455150

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:94:09:46:de:08:f9:e6:96:17:e9:3f:a5:f9:74:9e:6e:4e:ed:ee:40:76:05:f0:b2:6d:16:55:67:63:51:04
Signer

Actual PE Digest

95:94:09:46:de:08:f9:e6:96:17:e9:3f:a5:f9:74:9e:6e:4e:ed:ee:40:76:05:f0:b2:6d:16:55:67:63:51:04

Digest Algorithm

sha256

PE Digest Matches

true

fc:12:56:c4:5a:d9:39:04:54:f3:b7:8c:d0:c3:1d:5e:2d:2a:33:6c
Signer

Actual PE Digest

fc:12:56:c4:5a:d9:39:04:54:f3:b7:8c:d0:c3:1d:5e:2d:2a:33:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\zafkielontop\Desktop\External\Valorant Loader\x64\Release\Registry.pdb

Imports

ws2_32

WSAGetLastError

advapi32

RegCloseKey

kernel32

RtlAddFunctionTable
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

FindWindowA

ntdll

NtUnloadDriver

urlmon

URLDownloadToFileA

ole32

CoSetProxyBlanket

oleaut32

VariantClear

Sections

.text
Size: - Virtual size: 496KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text .d
Size: - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vlizer
Size: - Virtual size: 46.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text .d
Size: - Virtual size: 15.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text .d
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text .d
Size: 47.5MB - Virtual size: 47.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39ec057abd44be4694481a26cb5de2b9

Code Sign

7c:af:69:0a:25:b7:39:fe:7b:9b:44:7a:c1:78:c5:eeCertificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

43:3b:bd:61:0f:b8:8b:19:52:95:21:1c:eb:94:b6:9eCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

7c:af:69:0a:25:b7:39:fe:7b:9b:44:7a:c1:78:c5:eeCertificate

Key Usages

43:3b:bd:61:0f:b8:8b:19:52:95:21:1c:eb:94:b6:9eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

95:94:09:46:de:08:f9:e6:96:17:e9:3f:a5:f9:74:9e:6e:4e:ed:ee:40:76:05:f0:b2:6d:16:55:67:63:51:04Signer

fc:12:56:c4:5a:d9:39:04:54:f3:b7:8c:d0:c3:1d:5e:2d:2a:33:6cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

advapi32

kernel32

user32

ntdll

urlmon

ole32

oleaut32

Sections

.text Size: - Virtual size: 496KB

.rdata Size: - Virtual size: 144KB

.data Size: - Virtual size: 57KB

.pdata Size: - Virtual size: 20KB

_RDATA Size: - Virtual size: 348B

.text .d Size: - Virtual size: 50KB

.reloc Size: - Virtual size: 4KB

.vlizer Size: - Virtual size: 46.0MB

.text .d Size: - Virtual size: 15.2MB

.text .d Size: 3KB - Virtual size: 3KB

.text .d Size: 47.5MB - Virtual size: 47.5MB

.rsrc Size: 50KB - Virtual size: 50KB

7c:af:69:0a:25:b7:39:fe:7b:9b:44:7a:c1:78:c5:ee
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

43:3b:bd:61:0f:b8:8b:19:52:95:21:1c:eb:94:b6:9e
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

7c:af:69:0a:25:b7:39:fe:7b:9b:44:7a:c1:78:c5:ee
Certificate

43:3b:bd:61:0f:b8:8b:19:52:95:21:1c:eb:94:b6:9e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

95:94:09:46:de:08:f9:e6:96:17:e9:3f:a5:f9:74:9e:6e:4e:ed:ee:40:76:05:f0:b2:6d:16:55:67:63:51:04
Signer

fc:12:56:c4:5a:d9:39:04:54:f3:b7:8c:d0:c3:1d:5e:2d:2a:33:6c
Signer

.text
Size: - Virtual size: 496KB

.rdata
Size: - Virtual size: 144KB

.data
Size: - Virtual size: 57KB

.pdata
Size: - Virtual size: 20KB

_RDATA
Size: - Virtual size: 348B

.text .d
Size: - Virtual size: 50KB

.reloc
Size: - Virtual size: 4KB

.vlizer
Size: - Virtual size: 46.0MB

.text .d
Size: - Virtual size: 15.2MB

.text .d
Size: 3KB - Virtual size: 3KB

.text .d
Size: 47.5MB - Virtual size: 47.5MB

.rsrc
Size: 50KB - Virtual size: 50KB