miner[.]exe | Triage™

General

Target
miner.exe
Size 3.1MB
Sample260602-s644msht8z
SHA256 563f52f1145a359d2c26234a596fbcd3879c0147645a87cca32fa17f058ef42b
MD5 52de3d0f4926fff5675200587182a74b
SHA1 88aa1b96c21b07eeb6748196189befb40568b790
SHA512 056503d6f1b86989aa235e10babf47e1fab9c3482999233da92221e7ef18b035e287963d661a83ba72147d2dd5ee366ac65cf6c74e6588c27925e9029cf74619
SSDEEP 49152:Ottyzacjj7+VkX1G63wownAHzxaWgsMAKJUCghlgRKlIhCA07ye:4waWKkY672AHzjgxbCzAK2toye
TLSH
T10DE523D3E28A4AF4D896B038F311AA22EE6630651356E1DF27C11E61BF53AC81F7DD14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
miner.exe

File Explorer

miner.exe

.exe 3.1MB

miner.exe

IMPHASH a04338e07c426b2fefa044b2835c73ce
SHA256 563f52f1145a359d2c26234a596fbcd3879c0147645a87cca32fa17f058ef42b
MD5 52de3d0f4926fff5675200587182a74b
SHA1 88aa1b96c21b07eeb6748196189befb40568b790
SHA512 056503d6f1b86989aa235e10babf47e1fab9c3482999233da92221e7ef18b035e287963d661a83ba72147d2dd5ee366ac65cf6c74e6588c27925e9029cf74619
SSDEEP 49152:Ottyzacjj7+VkX1G63wownAHzxaWgsMAKJUCghlgRKlIhCA07ye:4waWKkY672AHzjgxbCzAK2toye
TLSH
T10DE523D3E28A4AF4D896B038F311AA22EE6630651356E1DF27C11E61BF53AC81F7DD14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _aligned_free _aligned_malloc _amsg_exit _assert _cexit _commode _errno _fmode _initterm _lock _onexit _unlock _wcsicmp _wcsnicmp abort calloc exit fflush fprintf fputc free fwrite getenv isxdigit localeconv malloc memchr memcmp memcpy memmove memset realloc signal strcmp strerror strlen strncmp vfprintf wcscat wcscpy wcslen wcsncmp

advapi32

CreateProcessAsUserW DuplicateTokenEx

kernel32

AcquireSRWLockExclusive CloseHandle DeleteCriticalSection EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue GetLastError GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime InitOnceExecuteOnce InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW MultiByteToWideChar OpenMutexW RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WideCharToMultiByte

Name

.text

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

miner.exe

msvcrt

advapi32

kernel32

generic