External[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
External.exe
Size 2.9MB
Sample260704-bhncjset2k
SHA256 48f5ab3215f80159dd6e29ead2221dbac54df81aabb21babe66c77f375a80cbc
MD5 93eb0f3a31aa902af3d5b1423e042609
SHA1 643ea29a56115f1f6a5e0a6a562cc4ea32c4c6fc
SHA512 ebb3495c1b290d498e9a2a98f7214e4cd1b209596d77ba1b88e48e1ceecdb6099ecae734fe3ee215302c5a9087c9298fa8f8e8d8a5612f41a4facc5465dea81b
SSDEEP 49152:Mn2lwTlPXTgW7Dn+fy6Rj7zBPdmS60ErvRPJrQUNs:5KHDkyPtrp
TLSH
T165D5AF4BF3A641EDD226C57CCA165317E7B47418033166EB6BD10E56AF93BE0ABB9300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
External.exe

File Explorer

External.exe

.exe 2.9MB

External.exe

IMPHASH 1ce60e82dcb8c04e3c8cc22a07ec2fc0
SHA256 48f5ab3215f80159dd6e29ead2221dbac54df81aabb21babe66c77f375a80cbc
MD5 93eb0f3a31aa902af3d5b1423e042609
SHA1 643ea29a56115f1f6a5e0a6a562cc4ea32c4c6fc
SHA512 ebb3495c1b290d498e9a2a98f7214e4cd1b209596d77ba1b88e48e1ceecdb6099ecae734fe3ee215302c5a9087c9298fa8f8e8d8a5612f41a4facc5465dea81b
SSDEEP 49152:Mn2lwTlPXTgW7Dn+fy6Rj7zBPdmS60ErvRPJrQUNs:5KHDkyPtrp
TLSH
T165D5AF4BF3A641EDD226C57CCA165317E7B47418033166EB6BD10E56AF93BE0ABB9300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

Gelo

Minor OS version

Major OS version

Entry point

1737888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ahmet\Desktop\Quantum com Login\x64\Release\External.pdb

d3dx9_43

D3DXVec3Normalize D3DXMatrixTranspose D3DXVec3Transform

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetTickCount64 CreateThread GetCurrentProcessId OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter OutputDebugStringW WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA SetLastError WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetProcessId WaitForSingleObjectEx MoveFileExA VerifyVersionInfoA GetSystemDirectoryA CreateRemoteThreadEx LeaveCriticalSection EnterCriticalSection CreateFileMappingA UnmapViewOfFile MapViewOfFile ReadFile GetFileSizeEx CreateFileA MultiByteToWideChar VerSetConditionMask ExitProcess DeleteCriticalSection GetStartupInfoA GetProcAddress HeapAlloc QueryPerformanceCounter FreeLibrary DuplicateHandle TerminateProcess VirtualAlloc GetEnvironmentVariableA VirtualProtect QueryPerformanceFrequency LoadLibraryA GetLastError GetCommandLineA GetModuleHandleA InitializeCriticalSectionEx GetCurrentProcess HeapFree GlobalUnlock GetTickCount CreateRemoteThread GetLocaleInfoA WideCharToMultiByte SleepEx GlobalFree GlobalLock GlobalAlloc Sleep ReadProcessMemory VirtualProtectEx CloseHandle Process32Next K32GetModuleFileNameExA CreateToolhelp32Snapshot OpenProcess Module32First Module32Next WriteProcessMemory Process32First VirtualFreeEx VirtualAllocEx GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead

user32

CallNextHookEx UnregisterClassW GetWindowRect DispatchMessageA RegisterClassExW ShowWindow SetWindowsHookExA IsWindowUnicode MoveWindow UnhookWindowsHookEx DefWindowProcA GetCursorPos GetForegroundWindow ReleaseCapture TranslateMessage PeekMessageA GetWindowLongPtrA PostQuitMessage SetWindowLongPtrA FindWindowA GetClientRect UpdateWindow SetCursorPos PostMessageA SetWindowPos SetLayeredWindowAttributes GetAsyncKeyState GetKeyboardLayout mouse_event SetClipboardData OpenClipboard GetWindowThreadProcessId IsWindowVisible GetWindowTextA EnumWindows FindWindowW SetWindowsHookA GetWindowTextLengthA GetKeyState GetMessageExtraInfo LoadCursorA CloseClipboard SetCursor SetCapture TrackMouseEvent ClientToScreen GetCapture ScreenToClient EmptyClipboard SetWindowDisplayAffinity GetClipboardData DestroyWindow

advapi32

OpenServiceA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash QueryServiceStatus CloseServiceHandle OpenSCManagerA ControlService CryptHashData RevertToSelf CreateProcessAsUserA RegGetValueA PrivilegeCheck SetTokenInformation LookupPrivilegeValueA SetThreadToken DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken GetTokenInformation CryptAcquireContextA CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

ole32

CoInitializeEx

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z _Query_perf_frequency ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xbad_function_call@std@@YAXXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringW ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ws2_32

send ntohl gethostname recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSAGetLastError recv closesocket sendto

normaliz

IdnToAscii

crypt32

CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertOpenStore CertFindExtension CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext

wldap32

ord211 ord46 ord217 ord45 ord50 ord41 ord22 ord26 ord60 ord27 ord200 ord32 ord30 ord79 ord35 ord33 ord143 ord301

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __C_specific_handler memcmp memchr memmove memcpy longjmp strrchr __RTtypeid strchr wcsstr __std_type_info_compare strstr __std_terminate __std_exception_copy __std_exception_destroy __intrinsic_setjmp memset _CxxThrowException __current_exception_context

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode realloc calloc

api-ms-win-crt-string-l1-1-0

strcspn tolower toupper strspn strncmp wcslen strcmp strncpy isupper _strdup strlen strpbrk

api-ms-win-crt-convert-l1-1-0

strtoll strtol atoi mbstowcs strtoull atof strtoul strtod

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_narrow_winmain_command_line _initterm _initterm_e _exit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv exit _beginthreadex terminate _getpid _crt_atexit _errno _register_onexit_function strerror __sys_nerr

api-ms-win-crt-math-l1-1-0

atan2f _dsign ceilf cosf pow acosf _hypotf logf log powf sinf fmodf sqrtf __setusermatherr

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_locale_name_func _configthreadlocale

api-ms-win-crt-stdio-l1-1-0

_open _wfopen _close fopen fputs feof _read fread fsetpos ungetc _get_stream_buffer_pointers setvbuf fgetpos fwrite fgetc fclose fflush fputc __stdio_common_vsprintf ftell __stdio_common_vsscanf _lseeki64 __p__commode __stdio_common_vfprintf _set_fmode _fseeki64 fseek __acrt_iob_func fgets _write

api-ms-win-crt-filesystem-l1-1-0

_unlink _access _unlock_file _lock_file _fstat64 _stat64

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv