lomonew[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

lomonew.exe
Size

465KB
MD5

fb6620979486e4ee94fcf7253489dfe9
SHA1

e3d7a92da65120af76eafe5bc6633721140d7c91
SHA256

4950fe3939a193513f65b1dd014c62d750b98e882b4b5e57eed97912baa542cb
SHA512

9088cc1b7181c53e309a82e3f8e38a33eda9092d0f17357ecb76f57e9534e7d64d4a5e3ca78bcc666a93b9ff6e510d4a0848413d371256d203a5dc1aaf513e16
SSDEEP

6144:FqnVO3Dm6RbPhHjhIm4xQ7qnVO3Dm6RbPhHjhIm4xQ0qnVO3Dm6RbPhHjhIm4xQI:InV2agOnV2agnnV2aglnV2ag4nV2ag

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lomonew.exe

Files

lomonew.exe
.exe windows:10 windows x86 arch:x86

f18bf641045d05fc3844480267d2e273

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dccw.pdb

Imports

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EventRegister
EventUnregister
EventWrite
RegQueryValueExW

kernel32

WaitForSingleObject
CreateMutexW
HeapSetInformation
InitializeCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
ReleaseMutex
MultiByteToWideChar
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetLastError
CloseHandle
CreateFileW
GetCurrentProcessId
LockResource
FindResourceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
FormatMessageW
GetSystemDirectoryW
WriteFile
lstrlenW
WideCharToMultiByte
GetSystemTime
CopyFileW
SizeofResource
EnterCriticalSection
LeaveCriticalSection
RaiseException
DeleteCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
OutputDebugStringA
TerminateProcess
SetUnhandledExceptionFilter
HeapFree
VirtualFree
GetCurrentProcess
VirtualAlloc
LoadLibraryExA
EncodePointer
HeapAlloc
DecodePointer
IsProcessorFeaturePresent
GetProcessHeap
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
GetStartupInfoW
UnhandledExceptionFilter
QueryPerformanceCounter

gdi32

StretchBlt
CreateCompatibleBitmap
SetStretchBltMode
SelectObject
CreateCompatibleDC
GetObjectW
GetTextExtentPoint32W
SetDeviceGammaRamp
GetDeviceGammaRamp
GetStockObject
SetBkMode
SetBkColor
SetTextColor
CreateSolidBrush
GetDeviceCaps
CreateDCW
DeleteDC
DeleteObject

user32

LoadStringW
GetWindow
ShowWindow
MessageBoxW
ReleaseDC
GetWindowTextW
GetWindowTextLengthW
GetDC
KillTimer
SetTimer
SetWindowTextW
PostMessageW
MapDialogRect
EnumChildWindows
DisplayConfigGetDeviceInfo
QueryDisplayConfig
GetDisplayConfigBufferSizes
EnumDisplayDevicesW
ShowCursor
LoadCursorW
SetCursor
GetMonitorInfoW
EnumDisplayMonitors
MonitorFromWindow
GetParent
InvalidateRect
MapWindowPoints
GetWindowRect
GetDlgItem
DefWindowProcW
SendMessageW
CallWindowProcW
SetWindowPos
SetForegroundWindow
OpenIcon
SetWindowLongW
GetWindowLongW
MonitorFromRect
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowThreadProcessId
FindWindowW
RegisterWindowMessageW
GetActiveWindow
GetSystemMetrics
CharNextW
DestroyWindow
UnregisterClassA
MoveWindow

msvcrt

_ftol2
memcpy
_controlfp
?terminate@@YAXXZ
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_callnewh
swscanf_s
wcsstr
_wcsupr
_purecall
memcpy_s
malloc
wcsncpy_s
free
_ftol2_sse
_vsnwprintf
towlower
iswupper
_CIpow
memset

ntdll

WinSqmAddToStream

dxva2

GetNumberOfPhysicalMonitorsFromHMONITOR
GetPhysicalMonitorsFromHMONITOR
DestroyPhysicalMonitors
GetMonitorBrightness
SetMonitorBrightness
GetMonitorContrast
SetMonitorContrast
GetVCPFeatureAndVCPFeatureReply
SetVCPFeature

mscms

GetColorProfileFromHandle
UninstallColorProfileW
WcsCreateIccProfile
GetColorDirectoryW
InstallColorProfileW
CloseColorProfile
DccwSetDisplayProfileAssociationList
WcsGetUsePerUserProfiles
WcsGetDefaultColorProfile
WcsOpenColorProfileW
DccwGetGamutSize
DccwCreateDisplayProfileAssociationList
DccwGetDisplayProfileAssociationList
WcsGetCalibrationManagementState
SetColorProfileElement
SetColorProfileElementSize
DccwReleaseDisplayProfileAssociationList
WcsDisassociateColorProfileFromDevice
WcsSetCalibrationManagementState
WcsSetDefaultColorProfile

shell32

ShellExecuteW

gdiplus

GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipCloneImage
GdipFree
GdipCreateLineBrushI
GdipFillRectangleI
GdipCloneBrush
GdipAlloc
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStream

comctl32

TaskDialogIndirect
DestroyPropertySheetPage
CreatePropertySheetPageW
PropertySheetW

oleaut32

SysFreeString
VarUI4FromStr
SysAllocString

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoTaskMemFree
CreateStreamOnHGlobal
CoTaskMemAlloc
StringFromCLSID
CoCreateInstance

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f18bf641045d05fc3844480267d2e273

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

dxva2

mscms

shell32

gdiplus

comctl32

oleaut32

api-ms-win-core-com-l1-1-0

Sections

.text Size: 62KB - Virtual size: 62KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 7KB - Virtual size: 6KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 62KB - Virtual size: 62KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 4KB