bot_x64[.]exe | Triage™

General

Target
bot_x64.exe
Size 46KB
Sample260704-phvnhsfs2x
SHA256 094c4eb7f5480fb893aa6bb24d40b1b36534c0c85ea5e3f8c485146c45328ad6
MD5 125eacdebdfc926549fb90c2a655cafc
SHA1 1b38f737003d988290cff328e42fded7249ed6bc
SHA512 8b6ddd5dc786a5c7093c08e0bb7931b2ea67bce749e8a0a96b7af00b9ec7e33535ef9d7fd7c47f303caf849452dece275a211fa6f3d3971501d1737c4cdd35f6
SSDEEP 768:+OZC/PlRFd1usW38oefcLRpOz0xiQzm4iSJCAcHe72J6YDFNxY7x9yqlEznC9:HIlHd1ZWXeELRtxdmhSI5+M17xMx9yq3
TLSH
T134235B9AB7DE0267EC739A38F6651B37EA72B041BE24690F5370C80D2F3653651A4F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bot_x64.exe

File Explorer

bot_x64.exe

.exe 46KB

bot_x64.exe

IMPHASH 8227ecfdbd3709e56e04cab0ef4c8f7c
SHA256 094c4eb7f5480fb893aa6bb24d40b1b36534c0c85ea5e3f8c485146c45328ad6
MD5 125eacdebdfc926549fb90c2a655cafc
SHA1 1b38f737003d988290cff328e42fded7249ed6bc
SHA512 8b6ddd5dc786a5c7093c08e0bb7931b2ea67bce749e8a0a96b7af00b9ec7e33535ef9d7fd7c47f303caf849452dece275a211fa6f3d3971501d1737c4cdd35f6
SSDEEP 768:+OZC/PlRFd1usW38oefcLRpOz0xiQzm4iSJCAcHe72J6YDFNxY7x9yqlEznC9:HIlHd1ZWXeELRtxdmhSI5+M17xMx9yq3
TLSH
T134235B9AB7DE0267EC739A38F6651B37EA72B041BE24690F5370C80D2F3653651A4F11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExitProcess CreateThread ProcessIdToSessionId OpenProcess GetTickCount GetSystemDirectoryW VirtualProtect IsWow64Process GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW lstrcmpiW lstrcpyW lstrcatW lstrlenW MoveFileExW CreateFileMappingW GetCurrentProcess UnmapViewOfFile WideCharToMultiByte GetComputerNameW SetFileAttributesW ResumeThread CreateProcessW GetThreadContext SetThreadContext WriteProcessMemory MultiByteToWideChar SetThreadPriority GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetCurrentProcessId Sleep OpenMutexW CreateMutexW GetProcessHeap HeapFree GetLastError HeapAlloc CloseHandle SetFileTime ReadFile GetFileTime GetFileSize DeleteFileW MapViewOfFile CreateFileW

user32

EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable CloseClipboard OpenClipboard wsprintfW GetSystemMetrics GetDC ReleaseDC GetClipboardSequenceNumber

advapi32

RegCloseKey OpenProcessToken RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW GetUserNameW GetTokenInformation

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject BitBlt

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

oleaut32

VariantInit SysFreeString SysAllocString

Sharing