_c06c3002302f47202884762c57982d86718ba4500699e9ef37d5cd513c6e8bf8[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_c06c3002302f47202884762c57982d86718ba4500699e9ef37d5cd513c6e8bf8.exe
Size 4.6MB
Sample260620-x96tvsas2w
SHA256 c06c3002302f47202884762c57982d86718ba4500699e9ef37d5cd513c6e8bf8
MD5 d0541c8b7fd74b0f5dfeae5efa574216
SHA1 006e2982a742a5085e87985e22dcff59fa5d9647
SHA512 b5b3a432c96e002fe28006d1df5217331a055e35987e15bd25a715e9ccd34923df22c8b08184daa3738b1305a47933059b92616efcfd5b6f914aea3f2aaa6432
SSDEEP 49152:riHDazMZq/LXnxsCCGByl9Ah/uN0D8dfOBVgcjKoeW7Zi5u4KW7r+Da3dtUxnkdY:2HSGrQFpgIKscOi91Ehys
TLSH
T17E264B03E2A541E8C09DC179C30BD637AB76B88A4631B29F1BE81F612F69F506F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_c06c3002302f47202884762c57982d86718ba4500699e9ef37d5cd513c6e8bf8.exe

File Explorer

_c06c3002302f47202884762c57982d86718ba4500699e9ef37d5cd513c6e8bf8.exe

.exe 4.6MB

_c06c3002302f47202884762c57982d86718ba4500699e9ef37d5cd513c6e8bf8.exe

IMPHASH a30c78a48c548a65b4846cfd9d8c7138
SHA256 c06c3002302f47202884762c57982d86718ba4500699e9ef37d5cd513c6e8bf8
MD5 d0541c8b7fd74b0f5dfeae5efa574216
SHA1 006e2982a742a5085e87985e22dcff59fa5d9647
SHA512 b5b3a432c96e002fe28006d1df5217331a055e35987e15bd25a715e9ccd34923df22c8b08184daa3738b1305a47933059b92616efcfd5b6f914aea3f2aaa6432
SSDEEP 49152:riHDazMZq/LXnxsCCGByl9Ah/uN0D8dfOBVgcjKoeW7Zi5u4KW7r+Da3dtUxnkdY:2HSGrQFpgIKscOi91Ehys
TLSH
T17E264B03E2A541E8C09DC179C30BD637AB76B88A4631B29F1BE81F612F69F506F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3527744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hstsvc.pdb

user32

CloseClipboard SendInput EnumDisplayDevicesW EnumDisplaySettingsW EmptyClipboard ReleaseDC keybd_event GetSystemMetrics FindWindowW SetClipboardData OpenClipboard SwapMouseButton GetDC ChangeDisplaySettingsExW LoadIconW LoadCursorW SetThreadDpiAwarenessContext GetWindowTextW FindWindowA EnumDisplayMonitors GetIconInfo GetCursorInfo GetLastInputInfo SetThreadDesktop GetWindowRect EnumWindows CloseDesktop GetWindow GetWindowLongW IsIconic CreateDesktopW GetThreadDesktop GetCursorPos PrintWindow RegisterClassExW CreateWindowExW IsWindow UpdateWindow SetWindowTextW ExitWindowsEx GetClipboardData GetForegroundWindow IsWindowVisible GetWindowThreadProcessId ScreenToClient SetForegroundWindow PostMessageW WindowFromPoint DestroyWindow PostQuitMessage DefWindowProcW MessageBoxW SetCursorPos GetAsyncKeyState ShowWindow SendMessageW SystemParametersInfoW CreateCursor CopyIcon SetSystemCursor LockWorkStation SetWindowPos

gdi32

DeleteObject StretchBlt SetStretchBltMode CreateDCW StartDocW StartPage GetDeviceCaps CreateFontW SelectObject EndPage TextOutW GetPixel EndDoc DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDIBits CreateSolidBrush GetStockObject PatBlt

comctl32

InitCommonControlsEx

advapi32

RegEnumValueW SystemFunction036 OpenSCManagerW OpenServiceW EnumServicesStatusExW RegEnumKeyExW RegFlushKey RegSetValueExA RegCreateKeyExA CredFree CredEnumerateW RegQueryValueExA RegOpenKeyExA RegDeleteTreeA RegDeleteTreeW RegSetValueExW RegQueryValueExW RegCreateKeyExW GetUserNameW SetKernelObjectSecurity SetSecurityDescriptorDacl ChangeServiceConfigW StartServiceW CloseServiceHandle OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges DuplicateTokenEx CreateProcessWithTokenW GetTokenInformation QueryServiceConfigW LookupAccountSidW QueryServiceStatus ControlService RegOpenKeyExW RegDeleteValueW InitializeSecurityDescriptor RegCloseKey

shell32

SHGetFolderPathW ShellExecuteW ord680 SHGetSpecialFolderPathW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize GetHGlobalFromStream CoGetObject CreateStreamOnHGlobal CoCreateGuid

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpCloseHandle WinHttpOpen

winspool.drv

EnumPrintersW

comdlg32

CommDlgExtendedError

winmm

waveInPrepareHeader waveInAddBuffer waveInOpen timeGetTime waveInStop waveInReset waveInUnprepareHeader waveInClose timeEndPeriod timeBeginPeriod waveInGetNumDevs waveInGetDevCapsW mciSendStringW waveInStart

dnsapi

DnsFlushResolverCache

kernel32

HeapAlloc WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer SetEnvironmentVariableW FormatMessageW GetModuleFileNameW CancelIo FindNextFileW SetFilePointerEx LoadLibraryExA DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx GetFileAttributesW WideCharToMultiByte GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue ExitProcess FindClose FindFirstFileExW CopyFileExW RemoveDirectoryW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW WaitForMultipleObjects GetStdHandle DuplicateHandle GetWindowsDirectoryW GetSystemDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetFileInformationByHandleEx SetFileInformationByHandle GetSystemTimePreciseAsFileTime RtlPcToFileHeader TlsSetValue TlsFree RtlLookupFunctionEntry RtlCaptureContext GetOverlappedResult CreateEventW ReadFileEx CreateThread QueryPerformanceFrequency HeapReAlloc HeapFree GetProcessHeap GetFullPathNameW SleepEx WriteFileEx CompareStringOrdinal GetQueuedCompletionStatusEx LoadLibraryExW RtlVirtualUnwind GetTimeZoneInformationForYear SwitchToThread GetLastError CloseHandle LoadLibraryA GetProcAddress GetCurrentProcessId SetThreadExecutionState GlobalLock GlobalUnlock GetModuleHandleA GetProcessId GetCurrentProcess CreateToolhelp32Snapshot Thread32First Thread32Next OpenThread QueueUserAPC OpenProcess Process32FirstW Process32NextW GetLogicalDrives GetDriveTypeW GetDiskFreeSpaceExW GetVolumeInformationW GetProcessMitigationPolicy CreatePipe SetHandleInformation CreateProcessW ReadFile GetExitCodeProcess Beep GetTempPathW GetComputerNameW GetVersionExW GetSystemDefaultLCID GetUserDefaultLangID GetTimeZoneInformation GlobalMemoryStatus LocalFree TerminateProcess ReadProcessMemory VirtualAllocEx WriteProcessMemory GetThreadContext SetThreadContext ResumeThread WaitForSingleObject VirtualQueryEx CreateRemoteThread GetExitCodeThread VirtualProtectEx SetDllDirectoryA FreeLibrary GlobalSize SetFileAttributesW CreateFileW GetFileInformationByHandle QueryFullProcessImageNameW GlobalAlloc GetFileTime SetFileTime OpenMutexW SetLastError CreateMutexW GetConsoleWindow Sleep GetModuleHandleW GetCurrentThreadId MoveFileExW ExpandEnvironmentStringsW AllocConsole SetStdHandle CopyFileW GetFileSize MultiByteToWideChar GetComputerNameExW GetSystemInfo GlobalMemoryStatusEx GetLogicalDriveStringsW GetTickCount64 K32GetProcessMemoryInfo GetTickCount GetSystemTimes IsDebuggerPresent CheckRemoteDebuggerPresent OutputDebugStringW GetSystemFirmwareTable MapViewOfFile VirtualProtect UnmapViewOfFile QueryPerformanceCounter GetDiskFreeSpaceExA K32GetModuleFileNameExA GetCurrentThread GetProcessTimes SetFileCompletionNotificationModes CreateIoCompletionPort PostQueuedCompletionStatus

mpr

WNetEnumResourceW WNetOpenEnumW WNetCloseEnum

powrprof

SetSuspendState

iphlpapi

FreeMibTable GetIfTable2 IcmpCloseHandle IcmpSendEcho IcmpCreateFile GetAdaptersAddresses

mfplat

MFStartup MFCreateAttributes MFShutdown

mfreadwrite

MFCreateSourceReaderFromMediaSource

gdiplus

GdipSaveImageToStream GdiplusShutdown GdipDisposeImage GdiplusStartup GdipCreateBitmapFromScan0

oleaut32

SysAllocStringByteLen SysFreeString SysStringByteLen SysStringLen GetErrorInfo

ntdll

NtQueryInformationProcess NtOpenFile RtlAdjustPrivilege NtRaiseHardError NtCancelIoFileEx NtDeviceIoControlFile NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile NtOpenSection NtQuerySystemInformation RtlSetProcessIsCritical NtReadFile NtCreateFile

bcrypt

BCryptOpenAlgorithmProvider BCryptHashData BCryptCreateHash BCryptDecrypt BCryptGenRandom BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptDestroyKey

crypt32

CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateStore CertCloseStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertOpenStore CertAddCertificateContextToStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateChain

winsqlite3

sqlite3_mutex_free sqlite3_mutex_alloc sqlite3_libversion_number sqlite3_extended_result_codes sqlite3_initialize sqlite3_config sqlite3_deserialize sqlite3_bind_parameter_count sqlite3_column_name sqlite3_column_count sqlite3_reset sqlite3_step sqlite3_free sqlite3_malloc sqlite3_finalize sqlite3_busy_timeout sqlite3_column_double sqlite3_close sqlite3_prepare_v3 sqlite3_errmsg sqlite3_error_offset sqlite3_column_type sqlite3_column_int64 sqlite3_column_blob sqlite3_column_bytes sqlite3_open_v2 sqlite3_column_text sqlite3_threadsafe

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

secur32

DeleteSecurityContext QueryContextAttributesW DecryptMessage EncryptMessage FreeContextBuffer AcceptSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA InitializeSecurityContextW

ws2_32

WSADuplicateSocketW closesocket setsockopt WSARecv freeaddrinfo recv send WSASend listen bind WSACleanup WSAStartup sendto accept getsockname ioctlsocket WSASocketW recvfrom select shutdown getsockopt getaddrinfo WSAGetLastError WSAIoctl connect socket

netapi32

NetApiBufferFree NetShareEnum NetGetJoinInformation

bcryptprimitives

ProcessPrng

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSEnumerateSessionsW

wevtapi

EvtNext EvtClearLog EvtRender EvtQuery EvtClose

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

mf

MFEnumDeviceSources

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW

api-ms-win-crt-math-l1-1-0

acos pow __setusermatherr ceilf

api-ms-win-crt-string-l1-1-0

wcsncmp strcmp strcpy_s strlen

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _crt_atexit terminate abort _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free calloc

Name

.tls3

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tlsx

Size

919KB

Virtual Size

919KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.texts

Size

20KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bssn

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.init3

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bssa

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.gfidsb

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

_c06c3002302f47202884762c57982d86718ba4500699e9ef37d5cd513c6e8bf8.exe

user32

gdi32

comctl32

advapi32

shell32

ole32

version

winhttp

winspool.drv

comdlg32

winmm

dnsapi

kernel32

mpr

powrprof

iphlpapi

mfplat

mfreadwrite

gdiplus

oleaut32

ntdll

bcrypt

crypt32

winsqlite3

api-ms-win-core-synch-l1-2-0

secur32

ws2_32

netapi32

bcryptprimitives

wtsapi32

wevtapi

dxgi

d3d11

mf

setupapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic