ram_ui[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ram_ui.exe
Size 12.7MB
Sample260511-e7x5tsbt61
SHA256 caba9f6f7eb66e8c1510621b66a4f6486d147722aa6b235fe6a69d1e7e94cd4d
MD5 ddda71d4ea785de3cde5b63f3e119c4b
SHA1 1c90c68387b8f20b79f6028729ace169a387aa32
SHA512 380b71eddaab62c5119cd82c6a247aed66c7f5af706ba1e46966d17ef5178cc3539b4f160e5795679790a0d7d8098d709bd38d7be5bfd8314388d448f4b01d3e
SSDEEP 98304:3iJaN2r1Sy4kBSamJFKzwqxLFkMJQrsyRW21vr++41RJb/ssG4rm:yJ95T2qZiMJrfP1Rx
TLSH
T134D65A12BB5A99ADC06AC470834A86735A3570CB0B35B9FF45C851393FAAAF41F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ram_ui.exe

File Explorer

ram_ui.exe

.exe 12.7MB

ram_ui.exe

IMPHASH 5afa8ab58a307e5bf060853cf35b1d39
SHA256 caba9f6f7eb66e8c1510621b66a4f6486d147722aa6b235fe6a69d1e7e94cd4d
MD5 ddda71d4ea785de3cde5b63f3e119c4b
SHA1 1c90c68387b8f20b79f6028729ace169a387aa32
SHA512 380b71eddaab62c5119cd82c6a247aed66c7f5af706ba1e46966d17ef5178cc3539b4f160e5795679790a0d7d8098d709bd38d7be5bfd8314388d448f4b01d3e
SSDEEP 98304:3iJaN2r1Sy4kBSamJFKzwqxLFkMJQrsyRW21vr++41RJb/ssG4rm:yJ95T2qZiMJrfP1Rx
TLSH
T134D65A12BB5A99ADC06AC470834A86735A3570CB0B35B9FF45C851393FAAAF41F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7985284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ram_ui.pdb

advapi32

IsValidSid GetLengthSid CopySid OpenProcessToken GetTokenInformation SystemFunction036 RegGetValueW CredFree CredWriteW RegCloseKey RegQueryValueExW RegOpenKeyExW CredReadW RegOpenKeyTransactedW CredDeleteW RegCreateKeyExW RegCreateKeyTransactedW EventSetInformation EventWriteTransfer RevertToSelf ImpersonateAnonymousToken EventRegister EventUnregister

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile RtlGetVersion NtCancelIoFileEx NtReadFile NtCreateFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation NtCreateNamedPipeFile NtWriteFile

ole32

CoUninitialize CoInitializeEx CoTaskMemFree RevokeDragDrop OleInitialize CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemAlloc RegisterDragDrop

kernel32

CreateMutexW GetModuleHandleA OpenProcess ExitProcess QueryPerformanceFrequency CancelIo GetCurrentProcessId GetSystemInfo GetProcessTimes LocalFree WriteConsoleW GetStdHandle GetEnvironmentStringsW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler GetExitCodeProcess GetSystemTimes GetProcessIoCounters GetConsoleOutputCP CreateThread VirtualQueryEx CreateEventW WaitForSingleObject WaitForMultipleObjects ReadFileEx SetNamedPipeHandleState SetFileTime SleepEx FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW WriteFileEx GetSystemTimePreciseAsFileTime QueryPerformanceCounter TerminateProcess RtlCaptureContext RtlLookupFunctionEntry FindNextFileW GetFileAttributesW FindFirstFileExW GetConsoleMode CreateFileW LoadLibraryA FreeLibrary LoadLibraryExW HeapFree GetProcessHeap GetModuleFileNameW OutputDebugStringW OutputDebugStringA lstrlenW SetFileInformationByHandle GetCommandLineW GetProcAddress LoadLibraryW ReleaseMutex CreateMutexA GetLastError GetCurrentProcess DuplicateHandle WaitForSingleObjectEx HeapReAlloc CopyFileExW GetFullPathNameW SetWaitableTimer CreateWaitableTimerExW SetHandleInformation GetCurrentThread MultiByteToWideChar GlobalFree WideCharToMultiByte GlobalSize FormatMessageW MoveFileExW GlobalUnlock FindClose GetFinalPathNameByHandleW SetLastError GlobalAlloc GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx GlobalLock GetFileInformationByHandleEx SwitchToThread HeapAlloc SetFileCompletionNotificationModes GetFileInformationByHandle LoadLibraryExA DeleteFileW GetCurrentThreadId CloseHandle CreateProcessW SetThreadErrorMode Sleep ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW LCIDToLocaleName GetUserDefaultUILanguage GetSystemTimeAsFileTime IsDebuggerPresent GetModuleHandleW IsProcessorFeaturePresent InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind GetEnvironmentVariableW ReadProcessMemory CreateDirectoryW SetUnhandledExceptionFilter

user32

DispatchMessageA GetMessageW DestroyCursor RemovePropW CallWindowProcW SetWindowPos TranslateMessage GetPropW GetMessageA DispatchMessageW PostMessageW DestroyWindow CloseClipboard PeekMessageW EnumChildWindows PostThreadMessageW RedrawWindow RegisterClipboardFormatW DefWindowProcW ScreenToClient SetClipboardData GetWindowLongW GetClientRect ClientToScreen CreateWindowExW MonitorFromWindow GetClipboardData OpenClipboard IsClipboardFormatAvailable MonitorFromRect GetMonitorInfoW GetSystemMetrics FillRect SystemParametersInfoW TrackMouseEvent EmptyClipboard CreateIcon GetAsyncKeyState GetKeyboardState FlashWindowEx GetForegroundWindow GetMenu RegisterClassExW SetCursorPos GetWindowRect IsIconic GetTouchInputInfo CloseTouchInputHandle GetClassInfoExW IsWindowVisible GetRawInputData EnumDisplayMonitors MonitorFromPoint EnumWindows GetWindowTextW GetWindowTextLengthW SendInput SetForegroundWindow DestroyIcon MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx GetKeyState GetWindowLongPtrW SetWindowDisplayAffinity SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor GetActiveWindow SetWindowLongPtrW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetClassNameW GetWindowThreadProcessId GetCursorPos IsProcessDPIAware GetDC RegisterWindowMessageA SendMessageW GetWindow SetFocus ShowWindow SetWindowTextW SetCursor ReleaseDC CreateIconFromResourceEx MessageBoxW ValidateRect RegisterTouchWindow IsWindow AdjustWindowRectEx LoadCursorW InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass

shlwapi

SHCreateMemStream AssocQueryStringW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

gdi32

GetDeviceCaps CreateRectRgn SwapBuffers ChoosePixelFormat DescribePixelFormat SetPixelFormat CreateSolidBrush DeleteObject

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shell32

SHAppBarMessage DragQueryFileW DragFinish CommandLineToArgvW

imm32

ImmSetCandidateWindow ImmAssociateContextEx ImmGetContext ImmReleaseContext ImmGetCompositionStringW ImmSetCompositionWindow

oleaut32

SysAllocStringLen GetErrorInfo SafeArrayPutElement SysStringLen VariantClear SafeArrayCreateVector SetErrorInfo SysFreeString

ws2_32

shutdown WSADuplicateSocketW listen bind WSASocketW WSAIoctl WSAGetLastError ioctlsocket WSACleanup WSAStartup setsockopt select send WSASend recv WSARecv getpeername freeaddrinfo getaddrinfo connect closesocket getsockname accept getsockopt

secur32

ApplyControlToken DecryptMessage AcquireCredentialsHandleA FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext EncryptMessage

bcrypt

BCryptGenRandom

crypt32

CertDuplicateStore CertFreeCertificateContext CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertOpenStore CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore

bcryptprimitives

ProcessPrng

pdh

PdhRemoveCounter PdhCloseQuery

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

opengl32

wglMakeCurrent wglCreateContext wglDeleteContext wglShareLists wglGetCurrentContext wglGetCurrentDC wglGetProcAddress

uiautomationcore

UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaLookupId UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaRaiseAutomationEvent

uxtheme

SetWindowTheme

vcruntime140

__std_exception_destroy __std_exception_copy __current_exception_context __current_exception __C_specific_handler _CxxThrowException _purecall wcsrchr memmove memcmp memset memcpy __CxxFrameHandler3

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

expf powf cos sinf fmod ceilf pow cbrtf sin exp2f _hypotf round floor trunc __setusermatherr roundf floorf cosf atan2f ceil acosf

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen wcscmp strlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _crt_atexit _initialize_narrow_environment _configure_narrow_argv _set_app_type terminate _seh_filter_exe strerror _initterm_e _get_initial_narrow_environment _initterm _register_thread_local_exe_atexit_callback exit _exit _c_exit __p___argc __p___argv _cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale