ExitLoader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ExitLoader.exe
Size 263KB
Sample260629-xffetad16k
SHA256 4e154314e60c6b717ad777c67fead2dc9cf6a9965cd0dfee18adaa5f3dd17068
MD5 2f223e6dcdd155ecdc91630d2a0703f7
SHA1 3e631b0c3c2d5440abb266f9ba063b3e05adceb6
SHA512 5f50b18c892c0772b336c507c49fd6a9454755e5d35c544c411a7871ac890555913c5645c770097bf72d9531e8f7d732917c4b3951869f8c5efafdffb8a195b2
SSDEEP 6144:ZC212AVc8pA27dryrvlVuk0mY8gZ8waH:k2148pA2dryrqk5bO8w
TLSH
T139447C5A77A40CF9ECA7923DC8524A06E7B2BC164760E7CF03A0465B5F232D1AD3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExitLoader.exe

File Explorer

ExitLoader.exe

.exe 263KB

ExitLoader.exe

IMPHASH 115d8650fad19c4e59d8440b8dabeafe
SHA256 4e154314e60c6b717ad777c67fead2dc9cf6a9965cd0dfee18adaa5f3dd17068
MD5 2f223e6dcdd155ecdc91630d2a0703f7
SHA1 3e631b0c3c2d5440abb266f9ba063b3e05adceb6
SHA512 5f50b18c892c0772b336c507c49fd6a9454755e5d35c544c411a7871ac890555913c5645c770097bf72d9531e8f7d732917c4b3951869f8c5efafdffb8a195b2
SSDEEP 6144:ZC212AVc8pA27dryrvlVuk0mY8gZ8waH:k2148pA2dryrqk5bO8w
TLSH
T139447C5A77A40CF9ECA7923DC8524A06E7B2BC164760E7CF03A0465B5F232D1AD3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\user\Desktop\patches\ExitLag\x64\Release\ExitLoader.pdb

kernel32

CreateToolhelp32Snapshot Sleep LoadLibraryA Process32Next OpenProcess VirtualAllocEx CreateRemoteThread VirtualFreeEx SetEndOfFile GetCurrentProcess GetFullPathNameA WriteProcessMemory CloseHandle Process32First WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode WaitForSingleObject GetExitCodeProcess CreateProcessW ReadFile ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

comdlg32

GetOpenFileNameA

advapi32

GetTokenInformation OpenProcessToken

shell32

SHGetKnownFolderPath ShellExecuteW

ole32

CoTaskMemFree