SystemService[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SystemService.exe
Size 2.4MB
Sample260620-ljglhad19m
SHA256 d997af9e892a331ffdee8303baa6230862e9a032f31eb63c461445c22b5789d7
MD5 3d1d789c52750fd608cf745fce375ed4
SHA1 539a74717f2aa7b408dc8c4b2213278c6785d183
SHA512 1d441a29cb71e1bda3a603e4cfe81300e65380bdcd9a61e8bfcd063a11ecdc049645daa84786f17e68ed481d58e35894b29b89fa841f6d37d758f45837af40b6
SSDEEP 49152:FW7+UELDgqSqzAWkEYaJdgyQZuZydJ53kAwDVw3cHGRXPpTpImAED:nDgqdNOuZydJ53yVKwmA4
TLSH
T1C1B54A57F2A244ECC12BC0748666A672BA3178581134BE7F6B94CB312F61F605E6EF34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SystemService.exe

File Explorer

SystemService.exe

.exe 2.4MB

SystemService.exe

IMPHASH 8fdbea92c51959b7e312155406513ba8
SHA256 d997af9e892a331ffdee8303baa6230862e9a032f31eb63c461445c22b5789d7
MD5 3d1d789c52750fd608cf745fce375ed4
SHA1 539a74717f2aa7b408dc8c4b2213278c6785d183
SHA512 1d441a29cb71e1bda3a603e4cfe81300e65380bdcd9a61e8bfcd063a11ecdc049645daa84786f17e68ed481d58e35894b29b89fa841f6d37d758f45837af40b6
SSDEEP 49152:FW7+UELDgqSqzAWkEYaJdgyQZuZydJ53kAwDVw3cHGRXPpTpImAED:nDgqdNOuZydJ53yVKwmA4
TLSH
T1C1B54A57F2A244ECC12BC0748666A672BA3178581134BE7F6B94CB312F61F605E6EF34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext GetUserNameA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

gdi32

CreateRectRgn CreateRoundRectRgn DeleteObject GetDeviceCaps

kernel32

CloseHandle CreateDirectoryA CreateDirectoryW CreateEventA CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreateProcessW CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FreeLibrary GetCPInfo GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesA GetFileAttributesW GetFileInformationByHandle GetFileSize GetFinalPathNameByHandleW GetLastError GetLocaleInfoA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStartupInfoA GetSystemDirectoryW GetSystemFirmwareTable GetSystemTimeAdjustment GetSystemTimeAsFileTime GetSystemWindowsDirectoryA GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetVolumeInformationA GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MapViewOfFile MoveFileA MoveFileExA MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileInformationByHandle SetLastError SetProcessAffinityMask SetProcessWorkingSetSize SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VerSetConditionMask VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fdopen _fileno _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp _setmode _strtoi64 _strtoui64 _strdup _unlock _vscprintf _vsnprintf _wcsicmp _wfopen _write atexit abort atof atoi calloc exit fclose feof ferror fflush fgetc fopen fprintf fputc fputs fputwc free fread fseek fwprintf ftell fwrite getc getenv isdigit isspace iswctype isxdigit ldexp localeconv longjmp malloc memchr memcmp memcpy memmove memset qsort rand realloc remove setlocale setvbuf signal strchr strcmp strcoll strcpy_s strerror strftime strlen strncmp strncpy strstr strtol strtoul strxfrm tolower toupper towlower towupper ungetc vfprintf wcscat_s wcscmp wcscoll wcscpy wcscpy_s wcsftime wcslen wcsncmp wcsrchr wcsxfrm

shell32

SHGetFolderPathA ShellExecuteA Shell_NotifyIconW

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorInfo GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindowLongPtrW GetWindowRect IsWindowUnicode IsWindowVisible LoadCursorA LoadIconW MessageBoxA MonitorFromWindow OpenClipboard PeekMessageW PostMessageA PostQuitMessage RegisterClassExW RegisterHotKey ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetProcessDPIAware SetWindowLongPtrW SetWindowPos SetWindowRgn SetWindowTextW ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW UnregisterHotKey UpdateWindow wsprintfW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

winmm

timeBeginPeriod timeEndPeriod

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.kukk

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xittll

Size

159KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xxxr

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SystemService.exe

advapi32

d3d11

d3dcompiler_47

dwmapi

gdi32

kernel32

msvcrt

shell32

user32

winhttp

winmm

generic