ram_ui[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ram_ui.exe
Size 13.7MB
Sample260627-d2mlgahs7r
SHA256 f2bd030f52f19c618517077847ad1d6f261dc6c3c3c523a92befcba5464b3cf6
MD5 86f622c10955a02aa367e224617612a8
SHA1 46b21e5659c3e5136047111300728431e2c59a0d
SHA512 7dceebd47af764787d180a0833165ee5063202b86fc97c747cb5167306aeda9265d4244bc6eba8a19c563912babbd6c42e9b3755c40676afa73f3b96edef1996
SSDEEP 98304:1gjA9IKoMeipE4wS80XaNPtB/FexlW/Dt+gPYIQbSqlphMyNS:1t9NozQXStB/FnbPXQj
TLSH
T1EBE64A11BB4A99ACC15AC47483468A735A3270CB0B35B9FF45C856393F6AAF41F3C768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ram_ui.exe

File Explorer

ram_ui.exe

.exe 13.7MB

ram_ui.exe

IMPHASH 1c02818c1a437eaf09c53a261a516c10
SHA256 f2bd030f52f19c618517077847ad1d6f261dc6c3c3c523a92befcba5464b3cf6
MD5 86f622c10955a02aa367e224617612a8
SHA1 46b21e5659c3e5136047111300728431e2c59a0d
SHA512 7dceebd47af764787d180a0833165ee5063202b86fc97c747cb5167306aeda9265d4244bc6eba8a19c563912babbd6c42e9b3755c40676afa73f3b96edef1996
SSDEEP 98304:1gjA9IKoMeipE4wS80XaNPtB/FexlW/Dt+gPYIQbSqlphMyNS:1t9NozQXStB/FnbPXQj
TLSH
T1EBE64A11BB4A99ACC15AC47483468A735A3270CB0B35B9FF45C856393F6AAF41F3C768
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8770724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ram_ui.pdb

advapi32

CopySid OpenProcessToken GetTokenInformation RegQueryValueExW SystemFunction036 RegCloseKey RegGetValueW GetLengthSid CredDeleteW CredFree CredReadW CredWriteW RegOpenKeyExW RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW IsValidSid EventSetInformation EventWriteTransfer RevertToSelf ImpersonateAnonymousToken EventUnregister EventRegister

ntdll

NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile NtWriteFile NtQuerySystemInformation RtlGetVersion NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtQueryInformationProcess

kernel32

GetModuleHandleA OpenProcess CreateMutexW CopyFileExW FindFirstFileExW GetCurrentProcessId GetSystemInfo VirtualQueryEx GetProcessTimes RtlCaptureContext LocalFree FindClose ExitProcess SwitchToThread FlushFileBuffers GetExitCodeProcess GetSystemTimes GetProcessIoCounters WaitForSingleObjectEx CreateMutexA CreateEventW WaitForSingleObject ReleaseMutex ReadFileEx SetNamedPipeHandleState CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime DeleteFileW GetFileAttributesW WriteConsoleW GetConsoleOutputCP WaitForMultipleObjects FindNextFileW GetConsoleMode LoadLibraryA CreateFileW SetFileInformationByHandle RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime FreeLibrary LoadLibraryExW HeapFree GetProcessHeap GetModuleFileNameW OutputDebugStringW OutputDebugStringA lstrlenW MoveFileExW GetCommandLineW GetFullPathNameW GetProcAddress LoadLibraryW SleepEx WriteFileEx GetLastError LCIDToLocaleName GetUserDefaultUILanguage GetCurrentProcess DuplicateHandle FreeEnvironmentStringsW CompareStringOrdinal CancelIo GetFileInformationByHandle GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetWaitableTimer CreateWaitableTimerExW SetHandleInformation GetCurrentThread MultiByteToWideChar GlobalFree CreateDirectoryW WideCharToMultiByte GlobalSize GlobalUnlock FormatMessageW GetFinalPathNameByHandleW SetLastError GlobalAlloc SetUnhandledExceptionFilter GlobalLock GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW SetFileCompletionNotificationModes CreateProcessW HeapAlloc GetModuleHandleW LoadLibraryExA SetThreadErrorMode Sleep TerminateProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime IsDebuggerPresent GetCurrentThreadId IsProcessorFeaturePresent CloseHandle InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind GetEnvironmentVariableW ReadProcessMemory GetStdHandle GetEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

GetWindowLongW ScreenToClient DestroyCursor DefWindowProcW TranslateMessage RedrawWindow RemovePropW CallWindowProcW PostThreadMessageW GetPropW PostMessageW CloseClipboard GetClientRect ClientToScreen GetCursorPos RegisterClipboardFormatW MonitorFromWindow SetClipboardData GetMonitorInfoW GetSystemMetrics FillRect SystemParametersInfoW TrackMouseEvent GetClipboardData OpenClipboard IsClipboardFormatAvailable GetTouchInputInfo CloseTouchInputHandle SetCursor ValidateRect MapVirtualKeyW GetUpdateRect ChangeDisplaySettingsExW SetWindowPlacement GetMessageW GetWindowPlacement CreateIcon GetAsyncKeyState GetKeyboardState DispatchMessageW FlashWindowEx GetForegroundWindow DestroyWindow SetCursorPos MapVirtualKeyExW MonitorFromRect SetWindowPos InvalidateRgn GetClassInfoExW GetKeyboardLayout ToUnicodeEx GetKeyState GetMenu GetWindowRect EnumWindows SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor GetActiveWindow EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SendInput SetForegroundWindow GetWindowLongPtrW DestroyIcon GetRawInputData GetWindowThreadProcessId SetWindowLongPtrW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetClassNameW IsProcessDPIAware GetDC RegisterWindowMessageA SendMessageW GetWindow SetFocus ShowWindow IsIconic LoadCursorW AdjustWindowRectEx CreateIconFromResourceEx MessageBoxW PeekMessageW EnumChildWindows DispatchMessageA GetMessageA RegisterClassExW ReleaseDC EmptyClipboard IsWindowVisible RegisterTouchWindow IsWindow CreateWindowExW

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc

ole32

RegisterDragDrop CoInitializeEx RevokeDragDrop CoTaskMemFree CoUninitialize CoCreateInstance OleInitialize CoCreateFreeThreadedMarshaler CoTaskMemAlloc

gdi32

CreateSolidBrush GetDeviceCaps DeleteObject SwapBuffers ChoosePixelFormat DescribePixelFormat SetPixelFormat CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

AssocQueryStringW SHCreateMemStream

shell32

DragFinish DragQueryFileW SHCreateItemFromParsingName SHAppBarMessage CommandLineToArgvW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmAssociateContextEx ImmSetCandidateWindow ImmGetCompositionStringW ImmGetContext

oleaut32

SafeArrayPutElement SafeArrayCreateVector SysFreeString SysAllocStringLen GetErrorInfo SetErrorInfo VariantClear SysStringLen

ws2_32

WSACleanup WSAStartup WSADuplicateSocketW freeaddrinfo shutdown WSAGetLastError listen bind WSASocketW WSAIoctl connect ioctlsocket setsockopt send WSASend recv WSARecv closesocket select getaddrinfo accept getsockopt getsockname getpeername

secur32

DecryptMessage EncryptMessage ApplyControlToken InitializeSecurityContextW AcquireCredentialsHandleA FreeCredentialsHandle AcceptSecurityContext QueryContextAttributesW DeleteSecurityContext FreeContextBuffer

bcrypt

BCryptGenRandom

crypt32

CertDuplicateStore CertFreeCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertEnumCertificatesInStore CertOpenStore CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext

bcryptprimitives

ProcessPrng

pdh

PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

opengl32

wglShareLists wglCreateContext wglGetProcAddress wglDeleteContext wglGetCurrentDC wglGetCurrentContext wglMakeCurrent

uiautomationcore

UiaGetReservedNotSupportedValue UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaLookupId UiaHostProviderFromHwnd UiaReturnRawElementProvider

uxtheme

SetWindowTheme

vcruntime140

__std_exception_destroy __std_exception_copy __current_exception __current_exception_context memcmp memset __C_specific_handler _CxxThrowException _purecall wcsrchr memmove __CxxFrameHandler3 memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

cos fmodf powf _hypotf expf round sinf pow log10 cbrtf floor roundf trunc floorf cosf fmod __setusermatherr atan2f exp2f acosf ceilf ceil sin

api-ms-win-crt-string-l1-1-0

wcslen wcscmp strlen _wcsicmp

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _configure_narrow_argv _crt_atexit terminate _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _initialize_narrow_environment strerror _register_onexit_function _initterm _get_initial_narrow_environment _c_exit _cexit _initterm_e exit _exit __p___argv __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale