inferno[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
inferno.exe
Size 4.0MB
Sample260517-bt45fae13l
SHA256 c2e7a10312b5abe58a87058befb3bd795a10bd5621ec17d9518a96da5b10c48a
MD5 657eccfe53c2d33129d2e9e9a5de5476
SHA1 81557b988de612afd3af20f51047d284aac9f6cf
SHA512 9e7f92da844447634281f592f4755cf3a96bc3b1283cc821b70dde5caf9c1116030307e074fccf05c4023298e25e6591896374f2f45db6bddc2f7a4c7f6b84bb
SSDEEP 49152:gRWfkImdevIZPq6bvytF30ErvE0XSulZqA9P0FRS1ICQvj9QAHOz:zkzPq6b4eulZqA9P0FRZNZbO
TLSH
T15B16AE02B291D298C52A9538CD11DAABD331BC045F12D7EB32A87F2B7E732E11E75791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
inferno.exe

File Explorer

inferno.exe

.exe 4.0MB

inferno.exe

IMPHASH f9cf349c80202df1a817c7a7e4939715
SHA256 c2e7a10312b5abe58a87058befb3bd795a10bd5621ec17d9518a96da5b10c48a
MD5 657eccfe53c2d33129d2e9e9a5de5476
SHA1 81557b988de612afd3af20f51047d284aac9f6cf
SHA512 9e7f92da844447634281f592f4755cf3a96bc3b1283cc821b70dde5caf9c1116030307e074fccf05c4023298e25e6591896374f2f45db6bddc2f7a4c7f6b84bb
SSDEEP 49152:gRWfkImdevIZPq6bvytF30ErvE0XSulZqA9P0FRS1ICQvj9QAHOz:zkzPq6b4eulZqA9P0FRZNZbO
TLSH
T15B16AE02B291D298C52A9538CD11DAABD331BC045F12D7EB32A87F2B7E732E11E75791
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1274552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\egz\Downloads\emsabk\inferno\x64\Release\inferno.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winmm

PlaySoundA

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse

kernel32

GetLastError SetConsoleTextAttribute GetStdHandle VirtualAlloc OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle K32GetModuleBaseNameA K32EnumProcessModules MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter VirtualProtect EnterCriticalSection GetCurrentProcess OutputDebugStringA TerminateProcess SetThreadPriority LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableA GetFileAttributesW Sleep Process32NextW GetCurrentThread Process32FirstW RaiseException CreateThread AddVectoredExceptionHandler GetThreadContext GetFileInformationByHandleEx GetModuleHandleW FlushInstructionCache VirtualQuery IsDebuggerPresent GetComputerNameA CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentProcessId WakeAllConditionVariable SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead ExitProcess

user32

GetWindowTextW DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow UpdateWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW EnumWindows SetWindowLongA SetWindowDisplayAffinity IsWindowVisible GetMonitorInfoA MoveWindow TranslateMessage PeekMessageA PostQuitMessage GetKeyState GetMessageExtraInfo LoadCursorA MonitorFromWindow GetClipboardData ShowWindow EmptyClipboard FindWindowA ScreenToClient CloseClipboard OpenClipboard GetAsyncKeyState SetCursorPos ReleaseCapture GetCursorPos SendInput IsWindowUnicode SetClipboardData GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture

advapi32

RegQueryValueExA GetUserNameA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteW

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

shlwapi

StrStrIA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp _CxxThrowException __intrinsic_setjmp __std_exception_destroy __std_exception_copy __std_terminate __current_exception_context __current_exception strstr strchr __C_specific_handler strrchr longjmp memset memcpy memchr memmove

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback __p___argv __p___argc system exit terminate _exit _beginthreadex _c_exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv abort _errno

api-ms-win-crt-string-l1-1-0

strncpy strcmp tolower isalnum strlen strncmp isdigit _wcsicmp wcslen strncpy_s

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf __stdio_common_vsprintf_s _set_fmode _fseeki64 fsetpos ungetc setvbuf fgetpos _get_stream_buffer_pointers fgetc ftell __acrt_iob_func fputc __stdio_common_vsscanf fread _wfopen fwrite __stdio_common_vfprintf fseek fclose fflush

api-ms-win-crt-math-l1-1-0

_dsign _dclass nearbyint _fdclass fmodf round pow powf sinf sqrtf acosf floorf ceil expf __setusermatherr log ldexp ceilf cosf atan2f ilogb logf

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-convert-l1-1-0

strtoull strtol strtod atoi atof strtoll

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_time64