BurntSushi[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BurntSushi.exe
Size 8.3MB
Sample260705-kpbf1abs7v
SHA256 e6f951016eece124e7ba5957179d07f3420bb2b185d3fdff9fb2a10ed792cadd
MD5 887b877ab4532d4ef947d13a3aef9ec5
SHA1 b1b427b063a63893fa7a4f347e63bd1798284344
SHA512 866d87346b8c710c8f1f1f8558f216d2ef0c2d0409dc6e7cc4d0f902706c83c8faad3f4939c31e843c84fdd380bbe0fa9cc505b224fb407d9b0475dd3024c352
SSDEEP 98304:IkoFkdqXXIGYTLuk9rtleltFg1YGesO+nHYpwgX8+3ZgSvXR:IkeT4rAGeMHRgMGvXR
TLSH
T1919618253A9A9DADC05AC4B083474BA3592170CB0B3AB9FF41D495753FAABF42B3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BurntSushi.exe

File Explorer

BurntSushi.exe

.exe 8.3MB

BurntSushi.exe

IMPHASH 60787cc32059dfba096eb23d0b43d296
SHA256 e6f951016eece124e7ba5957179d07f3420bb2b185d3fdff9fb2a10ed792cadd
MD5 887b877ab4532d4ef947d13a3aef9ec5
SHA1 b1b427b063a63893fa7a4f347e63bd1798284344
SHA512 866d87346b8c710c8f1f1f8558f216d2ef0c2d0409dc6e7cc4d0f902706c83c8faad3f4939c31e843c84fdd380bbe0fa9cc505b224fb407d9b0475dd3024c352
SSDEEP 98304:IkoFkdqXXIGYTLuk9rtleltFg1YGesO+nHYpwgX8+3ZgSvXR:IkeT4rAGeMHRgMGvXR
TLSH
T1919618253A9A9DADC05AC4B083474BA3592170CB0B3AB9FF41D495753FAABF42B3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4379460

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

BurntSushi.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetModuleHandleW QueryPerformanceCounter HeapReAlloc AttachConsole FlushInstructionCache AllocConsole GetConsoleWindow GetModuleFileNameW lstrlenW OpenProcess DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee QueryFullProcessImageNameW SetLastError Thread32Next Thread32First CreateToolhelp32Snapshot GetStdHandle GetConsoleMode GetFileInformationByHandleEx SetConsoleCtrlHandler SetConsoleCursorPosition FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleMode ReleaseSemaphore GetProcAddress GetSystemWow64DirectoryW CreateSemaphoreA GetSystemInfo VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx SwitchToThread GetSystemTimeAsFileTime InitializeSListHead GetQueuedCompletionStatusEx ReleaseMutex IsDebuggerPresent CreateMutexW CreateIoCompletionPort SetFileCompletionNotificationModes MoveFileExW CopyFileExW UnhandledExceptionFilter SetUnhandledExceptionFilter CreateProcessW SetHandleInformation CreatePipe VirtualQueryEx GetExitCodeProcess IsWow64Process GetSystemWow64DirectoryA GetExitCodeThread WaitForSingleObject GetCurrentThreadId CreateRemoteThread GetProcessId GetCurrentProcess LocalFree GetTempPathW GetTempFileNameW CreateActCtxW ActivateActCtx GetCurrentThread FreeLibrary SetFileInformationByHandle SetFilePointerEx GetTimeZoneInformationForYear DeviceIoControl GetSystemTimePreciseAsFileTime PostQueuedCompletionStatus GetLastError TerminateProcess GetCommandLineW GetVolumeInformationW DeleteFileW CreateProcessA ExitProcess MultiByteToWideChar WriteConsoleW GetModuleHandleA QueryPerformanceFrequency FormatMessageW GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentVariableW CreateFileW GetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW CreateDirectoryW FindFirstFileW FindClose GetDriveTypeW GetDiskFreeSpaceExW GetLogicalDrives FreeConsole GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx HeapAlloc GetProcessHeap CloseHandle GetProcessTimes GetSystemTimes GetProcessIoCounters GetTickCount64 GlobalMemoryStatusEx HeapFree GetConsoleScreenBufferInfo IsProcessorFeaturePresent

advapi32

RegQueryValueExW RegOpenKeyExW GetTokenInformation CopySid LookupAccountSidW GetNamedSecurityInfoW IsValidSid GetSidIdentifierAuthority ImpersonateSelf OpenProcessToken OpenThreadToken RevertToSelf SystemFunction036 AccessCheck RegCloseKey GetLengthSid MapGenericMask

ws2_32

WSAIoctl bind getsockname WSACleanup setsockopt WSAGetLastError getsockopt connect WSASocketW socket WSAStartup freeaddrinfo shutdown WSASend getpeername recv send closesocket ioctlsocket getaddrinfo

user32

GetCursorPos SetMenuItemInfoW RegisterClassExW SetForegroundWindow LoadCursorW DeleteMenu DestroyMenu GetParent DrawMenuBar SetMenu CreateMenu SetParent SetMenuInfo CreatePopupMenu GetMenuItemCount AppendMenuW DefWindowProcW ShowWindow TrackPopupMenu GetSubMenu GetMenuItemID DestroyIcon PostMessageW EnumThreadWindows EnumChildWindows GetWindowThreadProcessId PostThreadMessageW LoadImageW CheckMenuItem GetClassNameW GetWindowTextW GetWindowTextLengthW CreateWindowExW GetMenu UnhookWinEvent DestroyWindow MsgWaitForMultipleObjects PeekMessageW CreateWindowExA SetWinEventHook DispatchMessageW TranslateMessage IsDialogMessageW GetAncestor GetMessageW SendMessageW

shell32

Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteW CommandLineToArgvW DragFinish

comctl32

InitCommonControlsEx SetWindowSubclass GetWindowSubclass RemoveWindowSubclass DefSubclassProc

ole32

CoTaskMemFree CoInitializeSecurity CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateInstance CoInitialize

ntdll

RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile NtQueryInformationProcess NtCancelIoFileEx NtWriteFile NtQuerySystemInformation RtlGetVersion NtReadFile

bcrypt

BCryptGenRandom

pdh

PdhCollectQueryData PdhRemoveCounter PdhOpenQueryA PdhCloseQuery PdhGetFormattedCounterValue PdhAddEnglishCounterW

iphlpapi

GetAdaptersAddresses GetIfEntry2 FreeMibTable GetIfTable2

netapi32

NetApiBufferFree NetUserGetLocalGroups NetUserGetInfo NetUserEnum

secur32

LsaFreeReturnBuffer LsaEnumerateLogonSessions LsaGetLogonSessionData

powrprof

CallNtPowerInformation

oleaut32

VariantClear SetErrorInfo GetErrorInfo SysStringLen SysFreeString SysAllocString

psapi

GetModuleBaseNameW EnumProcessModulesEx GetModuleFileNameExW GetPerformanceInfo

vcruntime140

memmove memcmp memcpy __CxxFrameHandler3 __current_exception_context __current_exception _CxxThrowException memset __C_specific_handler

api-ms-win-crt-math-l1-1-0

truncf ceil trunc round pow __setusermatherr

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode realloc

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit exit _initterm_e _initterm _get_initial_narrow_environment _configure_narrow_argv terminate _crt_atexit _seh_filter_exe _initialize_narrow_environment _set_app_type _initialize_onexit_table _register_onexit_function __p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale