ioctl-injector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ioctl-injector.exe
Size 1.1MB
Sample260626-pgmxaaa18w
SHA256 dab492cd3c75ea3040fb693ca245391577b00d787447bd29b93153b07a097d73
MD5 4cd141f5de09b1fffa6c2bab715d85dc
SHA1 5fa5afb0b5ab302e640b406a28fda48afac62d4a
SHA512 47593b9fc36e86ecf0495cb4156d9926c70879d932494cf9b60f25b33a4bdce8ac97bb4f0a19cb827ecc65e7b776a964efffe100251edb58cd592648342e759e
SSDEEP 6144:PGGpKuGoYxkG+8yfZhKgIT+9LKSbKNmUL4wWV+8O5aFSHZNoO9gfBTirePBWBsfo:PGakoKdWlL+9gfBT14IwjCYrCJuk
TLSH
T160451AC69C0357E9E6E2E739766A3313F8673BA90A28C77F24C41D72510978052EB74E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ioctl-injector.exe

File Explorer

ioctl-injector.exe

.exe 1.1MB

ioctl-injector.exe

IMPHASH b5d27c4ef2ae17d21e68467c77d14f36
SHA256 dab492cd3c75ea3040fb693ca245391577b00d787447bd29b93153b07a097d73
MD5 4cd141f5de09b1fffa6c2bab715d85dc
SHA1 5fa5afb0b5ab302e640b406a28fda48afac62d4a
SHA512 47593b9fc36e86ecf0495cb4156d9926c70879d932494cf9b60f25b33a4bdce8ac97bb4f0a19cb827ecc65e7b776a964efffe100251edb58cd592648342e759e
SSDEEP 6144:PGGpKuGoYxkG+8yfZhKgIT+9LKSbKNmUL4wWV+8O5aFSHZNoO9gfBTirePBWBsfo:PGakoKdWlL+9gfBT14IwjCYrCJuk
TLSH
T160451AC69C0357E9E6E2E739766A3313F8673BA90A28C77F24C41D72510978052EB74E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1041020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zen\Desktop\stuff\stuff\Brutal\brutal inj\builds\ioctl-injector.pdb

kernel32

GetProcAddress GetCurrentProcess Sleep GetModuleFileNameA WriteProcessMemory FindFirstFileA SetConsoleTitleA GetStdHandle SetConsoleMode TerminateProcess GetEnvironmentVariableA FindClose WaitForSingleObject CreateFileW GetCurrentThreadId OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetConsoleMode GetTickCount64 K32GetModuleFileNameExA GetLastError GetFileAttributesA Process32NextW CreateFileA GetCurrentThread GetSystemDirectoryA LoadLibraryA DeleteFileA Process32FirstW LoadLibraryW Module32FirstW VirtualProtectEx GetThreadContext GetSystemWow64DirectoryA GetCurrentProcessId GetModuleHandleW FreeLibrary GetConsoleWindow CreateRemoteThread Module32NextW CreateDirectoryA IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent MapViewOfFile CreateFileMappingW CloseHandle UnmapViewOfFile GetLargePageMinimum VirtualAlloc VirtualFree VirtualProtect DeleteCriticalSection InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleA ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemInfo UnhandledExceptionFilter

user32

GetActiveWindow EnumChildWindows MoveWindow GetWindowRect GetWindowThreadProcessId GetWindowTextA MessageBoxA EnumWindows

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

msvcp140

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ

dbghelp

SymCleanup SymLoadModule64 SymUnloadModule64 SymInitialize SymSetOptions SymEnumSymbols

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtQuerySystemInformation

wininet

InternetSetOptionA InternetConnectA HttpOpenRequestA InternetOpenA HttpSendRequestA InternetCloseHandle

crypt32

CertCloseStore CertEnumCertificatesInStore CertGetNameStringA CertOpenSystemStoreA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memcpy memcmp memmove __std_terminate __std_exception_destroy __std_exception_copy wcsstr strstr strchr strrchr __current_exception __current_exception_context __C_specific_handler _CxxThrowException

api-ms-win-crt-stdio-l1-1-0

fclose fwrite _get_stream_buffer_pointers _fseeki64 fread _kbhit getchar fflush ungetc setvbuf fgetpos _set_fmode fopen_s __stdio_common_vsprintf __stdio_common_vsprintf_s fgets __stdio_common_vfprintf __p__commode __acrt_iob_func fgetc fputc fsetpos

api-ms-win-crt-runtime-l1-1-0

exit system terminate _invoke_watson _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _initialize_narrow_environment _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _beginthreadex _cexit _crt_atexit _register_onexit_function _configure_narrow_argv _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode realloc _callnewh

api-ms-win-crt-string-l1-1-0

toupper strncpy_s _wcsicmp strcat_s _stricmp strcpy_s strncmp towlower tolower

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file remove

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-math-l1-1-0

tan sinf sin sqrt __setusermatherr expf cos

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1337

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

796B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ioctl-injector.exe

kernel32

user32

advapi32

msvcp140

dbghelp

ntdll

wininet

crypt32

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic