taroloader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
taroloader.exe
Size 703KB
Sample260603-nt9fdaft2l
SHA256 dfbc0af7f5abb3e9d1c0bf7d5c412d403a2a962212933dfbeba9c1d855b92576
MD5 648406c59820d26cf975423ceb010c4c
SHA1 b3a5b3704ed11586f09a66608a8fdb30cb3963b7
SHA512 e8c24b165f8a16d429088cd1553b1ee49a57591afff039a7391cac91e37fc15bb515fff44e0e4751c33bb00e784700b5e56c493b0719062c68f27d3ea2dd6e9c
SSDEEP 12288:VXchzjyRx3VP6Lu4IjJqnNF+NZzdZRiwwsYiqVjnfZQZ:NoyRx3HSF+NZzVN6iOjnfZQ
TLSH
T1F6E4BF47F6A682E5C42A8539D697970BFBB578181720C7CF63E859782FD31E04A7B302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
taroloader.exe

File Explorer

taroloader.exe

.exe 703KB

taroloader.exe

IMPHASH 1a113bcdf81a48419c104e8e78ba98de
SHA256 dfbc0af7f5abb3e9d1c0bf7d5c412d403a2a962212933dfbeba9c1d855b92576
MD5 648406c59820d26cf975423ceb010c4c
SHA1 b3a5b3704ed11586f09a66608a8fdb30cb3963b7
SHA512 e8c24b165f8a16d429088cd1553b1ee49a57591afff039a7391cac91e37fc15bb515fff44e0e4751c33bb00e784700b5e56c493b0719062c68f27d3ea2dd6e9c
SSDEEP 12288:VXchzjyRx3VP6Lu4IjJqnNF+NZzdZRiwwsYiqVjnfZQZ:NoyRx3HSF+NZzVN6iOjnfZQ
TLSH
T1F6E4BF47F6A682E5C42A8539D697970BFBB578181720C7CF63E859782FD31E04A7B302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

405396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\arian\Music\taro\taroupdater\exe\taroloader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpReceiveResponse

kernel32

GetCurrentThreadId Sleep SleepConditionVariableSRW GetModuleHandleW TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle WideCharToMultiByte MultiByteToWideChar CopyFileA OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter IsDebuggerPresent AcquireSRWLockExclusive RtlCaptureContext ReleaseSRWLockExclusive GetFileInformationByHandleEx MoveFileExW GetLastError AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent WakeAllConditionVariable

user32

SetClipboardData CloseClipboard OpenClipboard DefWindowProcW EmptyClipboard GetClipboardData CreateWindowExA GetKeyState GetMessageExtraInfo SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture GetWindowRect ScreenToClient DestroyWindow SetWindowPos ShowWindow DispatchMessageW PeekMessageW MessageBoxA PostMessageW SetLayeredWindowAttributes TranslateMessage SystemParametersInfoA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow GetCursorPos

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteExA

ole32

CoCreateInstance

msvcp140

_Query_perf_counter _Query_perf_frequency ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Xbad_function_call@std@@YAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __current_exception_context __std_exception_destroy memmove _CxxThrowException memchr __std_exception_copy __C_specific_handler memset memcmp __current_exception memcpy

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _initialize_onexit_table _invoke_watson _c_exit _cexit __p___argv __p___argc _beginthreadex _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _set_app_type _seh_filter_exe abort terminate _errno _register_thread_local_exe_atexit_callback _configure_narrow_argv

api-ms-win-crt-string-l1-1-0

strcmp tolower

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vsprintf fputc __stdio_common_vsscanf _wfopen fflush __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fclose

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtod strtoll strtoull

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf cosf sinf fmodf acosf _dclass sqrtf