chromelevator[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
chromelevator.exe
Size 1.4MB
Sample260504-cfpy2aez7k
SHA256 293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881
MD5 d21a5d08b4614005c8fcd9d0068f0190
SHA1 9b1264eb4ff5ee8f00b8b80341fb6917dc3d3148
SHA512 f731cf4708d45bf9012972497158125c27d05db47dbeb9a446aa0b52b1157becad072b8ae95e2a34d0265fe345d788e6f45cf300d3bc9734be4c3c58a7f753f6
SSDEEP 24576:ClDnwX7Dtd3rTl4r1YMgMsbO+/I3XceQhYGgp1WGMc50e/K2Od2KosBl+gcGKrJD:qDG7/3t4qU+gcThYH2GEe/K/ZTBl+gcg
TLSH
T1AC65020B66A501F8D1B3D175C9635903DB72FC1A5F71A69F039899960F23BE08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chromelevator.exe

File Explorer

chromelevator.exe

.exe 1.4MB

chromelevator.exe

IMPHASH 061548e3501de96936395db596f4278f
SHA256 293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881
MD5 d21a5d08b4614005c8fcd9d0068f0190
SHA1 9b1264eb4ff5ee8f00b8b80341fb6917dc3d3148
SHA512 f731cf4708d45bf9012972497158125c27d05db47dbeb9a446aa0b52b1157becad072b8ae95e2a34d0265fe345d788e6f45cf300d3bc9734be4c3c58a7f753f6
SSDEEP 24576:ClDnwX7Dtd3rTl4r1YMgMsbO+/I3XceQhYGgp1WGMc50e/K2Od2KosBl+gcGKrJD:qDG7/3t4qU+gcThYH2GEe/K/ZTBl+gcg
TLSH
T1AC65020B66A501F8D1B3D175C9635903DB72FC1A5F71A69F039899960F23BE08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1300328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

bcrypt

BCryptDestroyHash BCryptHashData BCryptFinishHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptCreateHash

winhttp

WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpOpen WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData

kernel32

GetConsoleMode WriteConsoleW GetConsoleOutputCP FlushFileBuffers HeapSize SetFilePointerEx GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW ReadFile GetFileSizeEx GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetTempPathW WaitForSingleObject CreateFileW Sleep GetLastError CloseHandle GetLocalTime GetComputerNameW CreateProcessW WideCharToMultiByte SetConsoleOutputCP GetSystemTimeAsFileTime GetSystemTime ExpandEnvironmentStringsW SetFilePointer WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId GetTickCount ConnectNamedPipe GetModuleHandleW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW LoadLibraryExW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetFileType VirtualProtect

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

chromelevator.exe

version

advapi32

bcrypt

winhttp

kernel32

generic