renaissance[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
renaissance.exe
Size 7.6MB
Sample260620-epp2hac15j
SHA256 96c7f7f10367827d5831d86e74413fe673efc9c06cb59a099284619b9fa767d1
MD5 f5232810a1a66ab11a00736dcaa7b0db
SHA1 8b178eca6ab4bbb67d2659a90902ea19544da7af
SHA512 69eeaee73900a452e9058ebd82a8fc98da9a115482903a4a20c1c8b3cc6f618b6965abb26a9a3eb60248174e6c05d027eb08b0f4cc2e87cd8b6b920ed37e17f7
SSDEEP 196608:vMlQAZVGDmGS1unzMuyfhSk8TeUhsjpzbtU:ElaDmzyLyJS9
TLSH
T19F860106E1A786A8DF729B3984959333D6B07CC50371C3C76B9C4D61AB97AF49ABC700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
renaissance.exe

File Explorer

renaissance.exe

.exe 7.6MB

renaissance.exe

IMPHASH 219b30ae206f3c9f78b068c4b9dfd925
SHA256 96c7f7f10367827d5831d86e74413fe673efc9c06cb59a099284619b9fa767d1
MD5 f5232810a1a66ab11a00736dcaa7b0db
SHA1 8b178eca6ab4bbb67d2659a90902ea19544da7af
SHA512 69eeaee73900a452e9058ebd82a8fc98da9a115482903a4a20c1c8b3cc6f618b6965abb26a9a3eb60248174e6c05d027eb08b0f4cc2e87cd8b6b920ed37e17f7
SSDEEP 196608:vMlQAZVGDmGS1unzMuyfhSk8TeUhsjpzbtU:ElaDmzyLyJS9
TLSH
T19F860106E1A786A8DF729B3984959333D6B07CC50371C3C76B9C4D61AB97AF49ABC700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1141248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea DwmUnregisterThumbnail DwmRegisterThumbnail DwmUpdateThumbnailProperties

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

RegQueryValueExA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegEnumValueA RegDeleteValueA RegQueryValueExW RegCloseKey

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11CreateShaderResourceViewFromFileA

winhttp

WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpSendRequest WinHttpConnect WinHttpReadData

kernel32

SleepConditionVariableSRW GetCurrentThreadId LocalFree FormatMessageA GetLocaleInfoEx SetPriorityClass GetCurrentProcess WriteFile SetThreadPriority WaitForSingleObject OpenProcess Sleep GetTempPathA CreateFileA GetCurrentThread LoadLibraryA QueryPerformanceFrequency DeleteFileA CloseHandle GetProcAddress GetCurrentProcessId CreateProcessA QueryPerformanceCounter GetTickCount64 WriteProcessMemory GetSystemTimeAsFileTime VirtualFreeEx MultiByteToWideChar GlobalAlloc GlobalFree GetFileInformationByHandleEx WideCharToMultiByte GlobalUnlock FreeLibrary GetModuleHandleW VirtualProtectEx GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA InitializeSListHead FindClose FindFirstFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError WakeAllConditionVariable GetStartupInfoW GlobalLock SetUnhandledExceptionFilter AcquireSRWLockExclusive ReleaseSRWLockExclusive ReadProcessMemory

user32

SetForegroundWindow DestroyWindow EnumDisplayMonitors UnregisterClassW RegisterClassExW ShowWindow IsWindow GetMonitorInfoW EnumDisplayDevicesW EnumDisplaySettingsW DefWindowProcW CreateWindowExW MapWindowPoints SetWindowDisplayAffinity MoveWindow SetLayeredWindowAttributes GetSystemMetrics GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient CloseClipboard SetWindowLongW TranslateMessage GetCapture ClientToScreen TrackMouseEvent LoadCursorW SetCapture SetCursor GetClientRect BringWindowToTop PeekMessageW OpenClipboard GetCursorPos EmptyClipboard SetCursorPos GetClipboardData SetClipboardData SetWindowPos GetAsyncKeyState ReleaseCapture IsWindowUnicode DispatchMessageW GetForegroundWindow

gdi32

GetStockObject

comdlg32

GetOpenFileNameA

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Thrd_id _Thrd_join ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

winmm

timeBeginPeriod

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memset longjmp strrchr memmove memcmp memchr _CxxThrowException memcpy strstr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _errno _c_exit _register_thread_local_exe_atexit_callback terminate _beginthreadex abort _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

setvbuf fgetpos fwrite __p__commode __stdio_common_vsprintf ungetc fsetpos fread _set_fmode fputc fflush fclose _fseeki64 _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vsscanf _wfopen fgetc __stdio_common_vfprintf fseek ftell

api-ms-win-crt-math-l1-1-0

sqrtf atan2f log logf powf fmodf cosf roundf ceilf acosf pow _dsign sinf __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtoll atoi strtod strtol strtoull atof

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

wcslen tolower strlen _wcsicmp strncpy strcmp strncmp strcpy_s

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime _time64