3[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
3.exe
Size 1.5MB
Sample241019-tkrrvswgpm
SHA256 b39e4ddf7c57a6c85196e27ddf255811bd3bb3a73363227e455059008468d4b8
MD5 eb2687ee1d80d507b550f9c02523db06
SHA1 5b80a6c46dd5cd85001486ea4d09ebf8c674f802
SHA512 1b96045d8537e989e94a66fa578a3ff42b36aa3643d34b2f791ed3b0f4e5849faac2856640eab3fdb38746b827a9450f583a3e311781516564ba615a293668d5
SSDEEP 24576:cioa9QayPNalHGq8e27bb0hfgmvYXbNqaDQeXX/X3qwiRfDdzijgnLpv:cippYNQHGq87b7mv4Es/3qwiVDdz/h
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

3.exe

.exe 1.5MB

3.exe

IMPHASH 7fc8b8051e1eb2634e414f8113b802bd
SHA256 b39e4ddf7c57a6c85196e27ddf255811bd3bb3a73363227e455059008468d4b8
MD5 eb2687ee1d80d507b550f9c02523db06
SHA1 5b80a6c46dd5cd85001486ea4d09ebf8c674f802
SHA512 1b96045d8537e989e94a66fa578a3ff42b36aa3643d34b2f791ed3b0f4e5849faac2856640eab3fdb38746b827a9450f583a3e311781516564ba615a293668d5
SSDEEP 24576:cioa9QayPNalHGq8e27bb0hfgmvYXbNqaDQeXX/X3qwiRfDdzijgnLpv:cippYNQHGq87b7mv4Es/3qwiVDdz/h
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

PE Signature issue

Digest

7c:5b:83:71:b3:72:2c:cd:27:d2:44:63:cd:56:16:99:a7:5d:6b:b8

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Stratesave Systems GmbH in Liquidation,O=Stratesave Systems GmbH in Liquidation,POSTALCODE=8706,STREET=Mühlerain 29,L=Meilen,C=CH

Chains

Oct 14, 2024

Subject

CN=Stratesave Systems GmbH in Liquidation,O=Stratesave Systems GmbH in Liquidation,POSTALCODE=8706,STREET=Mühlerain 29,L=Meilen,C=CH

Serial Number

75:96:c9:55:d4:ce:1e:da:76:01:fe:3f:5f:47:49:9f

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 5, 2020 - Nov 4, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Minor OS version

Major OS version

Entry point

11420

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\tmp\geruest\tabbedsdisplitter-3.0i\x64\Release\chamy64.pdb

iphlpapi

GetAdaptersAddresses

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

secur32

LsaFreeReturnBuffer LsaGetLogonSessionData LsaEnumerateLogonSessions

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW

winsta

WinStationEnumerateW WinStationFreeMemory WinStationQueryInformationW

kernel32

GetProcessHeap WriteFile GetUserDefaultLangID OpenProcess GlobalAlloc GetSystemDirectoryW WideCharToMultiByte LoadLibraryW GetConsoleMode Sleep GetConsoleWindow GetVersionExW WriteConsoleW TerminateProcess ReadFile GetModuleFileNameW GetTimeZoneInformation CreateFileW lstrcmpW lstrlenW SetThreadPriority GlobalUnlock GetTempPathW GetLastError SetLastError GetProcAddress GlobalFree FindClose Process32FirstW AddVectoredExceptionHandler SetConsoleCtrlHandler GlobalHandle Process32NextW GetProcessShutdownParameters lstrcatW FindNextFileW CreateToolhelp32Snapshot GetCurrentThreadId SetProcessShutdownParameters CloseHandle DeleteFileW GetCurrentProcessId LocalFree WriteProcessMemory lstrcpyW SetFileAttributesW LCMapStringW RtlZeroMemory CreateThread GetFullPathNameW GetFullPathNameA HeapReAlloc CreateFileA CreateMutexW HeapCompact SetFilePointer TryEnterCriticalSection MapViewOfFile UnmapViewOfFile SetEndOfFile FreeLibrary SystemTimeToFileTime QueryPerformanceCounter UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW UnlockFileEx GetSystemTimeAsFileTime FormatMessageA InitializeCriticalSection FormatMessageW HeapDestroy LeaveCriticalSection GetFileAttributesA HeapCreate HeapValidate GetFileAttributesW MultiByteToWideChar FlushFileBuffers HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection OutputDebugStringA GetVersionExA GetTempPathA GetSystemTime AreFileApisANSI DeleteFileA ReadConsoleW SetFilePointerEx CompareStringW GetCurrentThread CreateNamedPipeW GetTickCount GetModuleHandleW ConnectNamedPipe SleepEx SetThreadExecutionState SetEvent WaitForSingleObject GlobalLock HeapFree GetCurrentProcess SetUnhandledExceptionFilter HeapAlloc CreateProcessW SetErrorMode GetDriveTypeW FindFirstFileW SetPriorityClass GetFileSize GetTempFileNameW ExitProcess SetStdHandle SetEnvironmentVariableW GetConsoleCP GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx GetCommandLineW GetFileType GetStdHandle GetModuleHandleExW IsProcessorFeaturePresent IsDebuggerPresent LoadLibraryExW SetEnvironmentVariableA ExitThread DecodePointer EncodePointer

user32

ExitWindowsEx GetShellWindow GetWindowThreadProcessId wsprintfW ShowWindow GetSystemMetrics

gdi32

LineTo MoveToEx EndPage GetTextMetricsW TextOutW StartPage SelectObject SetMapMode GetTextExtentPointW

advapi32

InitializeSecurityDescriptor CloseServiceHandle GetSecurityDescriptorDacl RegSetValueExW EnumServicesStatusExW RegCloseKey RegLoadKeyW InitiateSystemShutdownW EncryptFileW ConvertSidToStringSidW RegFlushKey AbortSystemShutdownW ControlService RegisterServiceCtrlHandlerW FreeSid OpenProcessToken CryptAcquireContextW DeleteService OpenThreadToken OpenSCManagerW StartServiceCtrlDispatcherW EnumDependentServicesW GetUserNameW RevertToSelf SetEntriesInAclW QueryServiceStatusEx SetServiceStatus AllocateAndInitializeSid RegDeleteValueW CredWriteW DuplicateTokenEx StartServiceW LookupAccountSidW ImpersonateSelf SetSecurityDescriptorDacl ConvertStringSidToSidW SetTokenInformation OpenServiceW CreateProcessAsUserW RegQueryValueExW CryptReleaseContext EqualSid GetTokenInformation CredReadW CreateServiceW

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoCreateInstance

oleaut32

SysAllocString SysFreeString

ntdll

NtRenameKey NtShutdownSystem memchr NtLoadKey NtSetThreadExecutionState NtSetInformationFile RtlGetVersion NtCreateKey RtlUnicodeToMultiByteN RtlGetSaclSecurityDescriptor NtQueryInformationFile vswprintf_s MD5Update NtQueryInformationProcess RtlTimeFieldsToTime _wcslwr RtlSetGroupSecurityDescriptor NtQueryDirectoryFile RtlGetGroupSecurityDescriptor NtWaitForSingleObject RtlSetSaclSecurityDescriptor strncpy NtQueryVolumeInformationFile wcsstr _wcsicmp RtlGetControlSecurityDescriptor NtCreateFile RtlNtStatusToDosError NtClose swprintf_s NtOpenKeyEx RtlQueryInformationAcl RtlSetLastWin32ErrorAndNtStatusFromNtStatus MD5Init RtlEqualSid RtlTimeToTimeFields swscanf_s NtQueryPerformanceCounter RtlGetDaclSecurityDescriptor RtlLeaveCriticalSection NtOpenProcessToken NtCreateSemaphore toupper NtQueryInformationToken NtSetSecurityObject NtQueryValueKey NtSetValueKey wcsncmp NtSetInformationKey towupper NtDeleteKey NtQueryObject RtlAllocateAndInitializeSid RtlMultiByteToUnicodeN RtlGetOwnerSecurityDescriptor NtOpenFile RtlInitializeCriticalSection RtlCreateUserThread NtReadFile NtDuplicateObject RtlCreateSecurityDescriptor RtlSetOwnerSecurityDescriptor strrchr strcspn RtlGetAce wcschr NtFlushKey NtEnumerateValueKey NtAllocateVirtualMemory towlower NtDeleteValueKey NtFsControlFile RtlInitUnicodeString RtlSetDaclSecurityDescriptor RtlFreeSid NtReleaseSemaphore _wcsnicmp NtUnloadKey NtQueryInformationThread NtQuerySystemInformation RtlSetLastWin32Error NtWriteFile NtDeviceIoControlFile strncmp RtlEnterCriticalSection memmove NtQuerySystemTime NtQuerySecurityObject NtEnumerateKey sscanf sprintf_s NtFlushBuffersFile NtGetTickCount MD5Final NtDelayExecution NtQueryKey RtlAdjustPrivilege RtlGetLastWin32Error

Sharing

General

Malware Config

Signatures

File Explorer

3.exe

PE Signature issue

iphlpapi

version

secur32

crypt32

winsta

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ntdll

generic