Loader99[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader99.exe
Size 6.2MB
Sample260419-sdchxsdv2m
SHA256 0eafa5549808b43e9ff8223034ac8c9c5c10333dafff9a534923de76817784e0
MD5 a6ec7dede485d1f72b06b62ab0adfa86
SHA1 8da754785df92eccfd38de807b9a0d7edea34a2f
SHA512 53c5d7edc8a0f17025337a60f566849c1185efde8ceac5183672b37859474a56b484d7f328f8cb9ab7f44a1b68052f1a8f42709bc809a1af37f47fe1865a768b
SSDEEP 49152:oVdbcZiQ59a3EbEMUn6RVR4SME9ca+35SEGHL+/o+wiofnxaPKq5wMJn7q4TUEk5:ok2+Uns+NFOfnxiKE1TO8TIzVRJI
TLSH
T13756D01AA7B501ECC0E7D5B88A175D13EAB2784913329BEB57E089552F23AF05F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader99.exe

File Explorer

Loader99.exe

.exe 6.2MB

Loader99.exe

IMPHASH e5a2c85b0f13d6d706a027c875e2df5b
SHA256 0eafa5549808b43e9ff8223034ac8c9c5c10333dafff9a534923de76817784e0
MD5 a6ec7dede485d1f72b06b62ab0adfa86
SHA1 8da754785df92eccfd38de807b9a0d7edea34a2f
SHA512 53c5d7edc8a0f17025337a60f566849c1185efde8ceac5183672b37859474a56b484d7f328f8cb9ab7f44a1b68052f1a8f42709bc809a1af37f47fe1865a768b
SSDEEP 49152:oVdbcZiQ59a3EbEMUn6RVR4SME9ca+35SEGHL+/o+wiofnxaPKq5wMJn7q4TUEk5:ok2+Uns+NFOfnxiKE1TO8TIzVRJI
TLSH
T13756D01AA7B501ECC0E7D5B88A175D13EAB2784913329BEB57E089552F23AF05F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1828152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpWebSocketClose WinHttpOpen WinHttpWebSocketSend WinHttpConnect WinHttpCrackUrl WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSetTimeouts WinHttpWebSocketReceive WinHttpSendRequest WinHttpQueryDataAvailable

crypt32

CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptCreateHash

gdiplus

GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipSaveImageToStream GdipCreateBitmapFromScan0 GdipDeleteGraphics GdipGetImageGraphicsContext GdipSetPixelOffsetMode GdipSetInterpolationMode GdipDisposeImage GdipGetImageEncodersSize GdipSetCompositingQuality GdipFree GdipDrawImageRectI GdiplusStartup

kernel32

GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FlsFree FlsSetValue RtlCaptureContext FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry FlsGetValue RtlVirtualUnwind IsDebuggerPresent GetLastError ExitProcess SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA SizeofResource GetModuleFileNameW EnumResourceNamesW SetFileAttributesW GetLogicalDriveStringsW EndUpdateResourceW LockResource LoadResource FindResourceW UpdateResourceW FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW GetDriveTypeW LoadLibraryExW ReadFile FindFirstFileW FindNextFileW WriteFile CreateNamedPipeW PeekNamedPipe GetTempPathW FindClose GetCurrentThreadId GetCurrentProcessId CreateProcessW GetTickCount ConnectNamedPipe FlushFileBuffers GetVolumeInformationW GetFileSizeEx UnhandledExceptionFilter CreateFileW DeleteFileW GetComputerNameW GetFileAttributesExW GetSystemTime CreateMutexW GetVersionExW ExitThread GetTickCount64 GetFileSize SetUnhandledExceptionFilter GetTimeZoneInformation GetSystemInfo CreateDirectoryW QueryDosDeviceW GetCurrentProcess RemoveDirectoryW GetEnvironmentVariableW WaitForSingleObject MultiByteToWideChar TerminateThread CreateThread GetLocalTime CopyFileW GetFileAttributesW LoadLibraryW GetProcAddress SetDllDirectoryW GetLogicalDrives GetDriveTypeA CreatePipe SetErrorMode FileTimeToSystemTime SetFilePointerEx CreateProcessA GetDiskFreeSpaceExA AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy RtlUnwind CreateFileMappingA LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW IsValidCodePage GetConsoleOutputCP GetConsoleMode VirtualProtect CompareStringW GlobalMemoryStatusEx GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW SetFilePointer UnlockFile

user32

EnumDisplayMonitors GetMonitorInfoW ReleaseDC SendInput GetSystemMetrics EnumDisplayDevicesW GetDC

gdi32

CreateCompatibleBitmap DeleteObject GetDeviceCaps BitBlt CreateCompatibleDC SelectObject DeleteDC

advapi32

OpenProcessToken RegGetValueW GetTokenInformation CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegEnumKeyExW RegQueryValueExA RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW GetUserNameW RegSetValueExW CryptAcquireContextA RegOpenKeyExW

shell32

ShellExecuteExW

ole32

CreateStreamOnHGlobal CoTaskMemFree

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceRegistryPropertyW SetupDiGetDevicePropertyW SetupDiGetClassDevsW SetupDiOpenDevRegKey

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

iphlpapi

GetAdaptersInfo

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetExitCodeThread

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-file-l1-1-0

FindFirstFileExW GetFinalPathNameByHandleW SetFileInformationByHandle

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx LCMapStringEx GetCPInfo

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx AcquireSRWLockExclusive TryAcquireSRWLockExclusive ReleaseSRWLockExclusive

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringEx

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtRender EvtQuery EvtClose EvtCreateRenderContext EvtNext

ntdll

RtlInitUnicodeString

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mf

MFEnumDeviceSources

mfplat

MFShutdown MFCreateMediaType MFCreateAttributes MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Loader99.exe

winhttp

crypt32

bcrypt

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

setupapi

api-ms-win-core-realtime-l1-1-1

iphlpapi

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

ntdll

d3d11

dxgi

mf

mfplat

mfreadwrite

generic