Xorio[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Xorio.exe
Size 1.2MB
Sample260705-nptjcsb15v
SHA256 6270accf77115bf6b915a2840fe4aaf87b0d97d57b776d856490bf255acd4a8f
MD5 23dc068bda881db9eeee2483c1cf8865
SHA1 59e793b04a3c655f167419648a8cfb4990a2304e
SHA512 807a3ba51d1007122da4f6c1e0f8fc75b587a29003eb8ef152e017ccb24b7887170467f28857a4d22f13312e5e3b8f7df7a41385e0af785fc9c411a6d0322b91
SSDEEP 24576:AKme/p8+98pce3CwxFh5s2QYGvZckeTzR8kt8AUWE+rhisnvaqPSlpEcCtH:mk8+on3C2tsJYqckeP9Drhiaiqmm
TLSH
T1BE4533DF598B95EEF4C5B53071107804022BF4C21711699FABE213BF99FB7C8189B6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Xorio.exe

File Explorer

Xorio.exe

.exe 1.2MB

Xorio.exe

IMPHASH ebadcfc3585f3992ed507ecc1fc7e6b9
SHA256 6270accf77115bf6b915a2840fe4aaf87b0d97d57b776d856490bf255acd4a8f
MD5 23dc068bda881db9eeee2483c1cf8865
SHA1 59e793b04a3c655f167419648a8cfb4990a2304e
SHA512 807a3ba51d1007122da4f6c1e0f8fc75b587a29003eb8ef152e017ccb24b7887170467f28857a4d22f13312e5e3b8f7df7a41385e0af785fc9c411a6d0322b91
SSDEEP 24576:AKme/p8+98pce3CwxFh5s2QYGvZckeTzR8kt8AUWE+rhisnvaqPSlpEcCtH:mk8+on3C2tsJYqckeP9Drhiaiqmm
TLSH
T1BE4533DF598B95EEF4C5B53071107804022BF4C21711699FABE213BF99FB7C8189B6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\brat\Desktop\Project\Xorio\x64\Release\Xorio.pdb

kernel32

SizeofResource VirtualProtect VirtualAlloc WaitForSingleObject GetLastError LockResource CreateThread LoadResource FindResourceW CreateSemaphoreA GetModuleHandleW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _CxxThrowException __current_exception __current_exception_context memset memmove

api-ms-win-crt-runtime-l1-1-0

_get_initial_wide_environment _initialize_wide_environment _initterm_e _set_app_type _configure_wide_argv _seh_filter_exe __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit _invalid_parameter_noinfo_noreturn terminate _initterm _initialize_onexit_table _register_onexit_function _crt_atexit exit

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode getchar __stdio_common_vfprintf __acrt_iob_func __p__commode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale