inferno[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
inferno.exe
Size 4.0MB
Sample260706-3d63msdt2w
SHA256 c014f6fcfdd765f9afd32876363df95b14184f8e10a80966fcb522ad5326e5ce
MD5 85ba37054e34e605517f06915205f184
SHA1 19b3748f358e03abbbe3f179a25e2645fff43b63
SHA512 7248d6420005cd02b5db5c6e22a769ccf5dae87ce28b1d247c86e4626f9e0361f842ed0ae6353814b2c344f9b9b18238b9851bb53c64775a954e955bdd8eae5e
SSDEEP 49152:q7NgY9Svej0QC4JW2D/XWUn9jRjtPkO0Ervx0b9lZqA9P0FRS1ICQvj9QAHO:q76vu0QHzWU9jBWlZqA9P0FRZNZbO
TLSH
T1F916AE02B291D294C52A9538CD51DAEBD231BC055F2297DB32A87F2B3F732D11E3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
inferno.exe

File Explorer

inferno.exe

.exe 4.0MB

inferno.exe

IMPHASH 2467a4ee023b62b73dddf7ec9e07ad56
SHA256 c014f6fcfdd765f9afd32876363df95b14184f8e10a80966fcb522ad5326e5ce
MD5 85ba37054e34e605517f06915205f184
SHA1 19b3748f358e03abbbe3f179a25e2645fff43b63
SHA512 7248d6420005cd02b5db5c6e22a769ccf5dae87ce28b1d247c86e4626f9e0361f842ed0ae6353814b2c344f9b9b18238b9851bb53c64775a954e955bdd8eae5e
SSDEEP 49152:q7NgY9Svej0QC4JW2D/XWUn9jRjtPkO0Ervx0b9lZqA9P0FRS1ICQvj9QAHO:q76vu0QHzWU9jBWlZqA9P0FRZNZbO
TLSH
T1F916AE02B291D294C52A9538CD51DAEBD231BC055F2297DB32A87F2B3F732D11E3A791
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1272312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\EXPLOITS\SOURCES\BLOODSTRIKE\emsabk\inferno\x64\Release\inferno.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winmm

PlaySoundA

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpSetTimeouts WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpSendRequest WinHttpConnect

kernel32

SetConsoleTextAttribute GetStdHandle VirtualAlloc OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle K32GetModuleBaseNameA K32EnumProcessModules MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter VirtualProtect EnterCriticalSection GetCurrentProcess OutputDebugStringA TerminateProcess SetThreadPriority LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableA GetFileAttributesW Sleep Process32NextW GetCurrentThread Process32FirstW RaiseException CreateThread AddVectoredExceptionHandler GetThreadContext ExitProcess SleepConditionVariableSRW FlushInstructionCache GetLocaleInfoEx IsDebuggerPresent GetComputerNameA CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead FormatMessageA LocalFree VirtualQuery AcquireSRWLockExclusive GetCurrentThreadId ReleaseSRWLockExclusive GetCurrentProcessId

user32

GetWindowTextW DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow GetCursorPos CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW EnumWindows IsWindowVisible SetWindowLongA SetWindowDisplayAffinity GetMonitorInfoA MoveWindow GetAsyncKeyState ScreenToClient FindWindowA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SendInput ShowWindow SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture MonitorFromWindow LoadCursorA GetMessageExtraInfo GetKeyState UpdateWindow PostQuitMessage PeekMessageA TranslateMessage

advapi32

RegQueryValueExA GetUserNameA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteW

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

shlwapi

StrStrIA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __std_exception_destroy __std_exception_copy memcpy strstr strchr _CxxThrowException __C_specific_handler strrchr __intrinsic_setjmp __current_exception_context __current_exception memcmp memchr memset memmove longjmp

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh realloc

api-ms-win-crt-runtime-l1-1-0

__p___argv _c_exit _register_thread_local_exe_atexit_callback system _exit abort _initterm_e _invoke_watson _beginthreadex __p___argc terminate _initterm _get_initial_narrow_environment _set_app_type exit _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _errno

api-ms-win-crt-string-l1-1-0

strncpy strncmp isalnum strncpy_s tolower isdigit strcmp _wcsicmp

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf __stdio_common_vsprintf_s __p__commode _fseeki64 fsetpos ungetc ftell setvbuf fgetpos _get_stream_buffer_pointers fgetc __acrt_iob_func fflush fclose fseek fputc __stdio_common_vfprintf __stdio_common_vsscanf fread _wfopen fwrite

api-ms-win-crt-math-l1-1-0

ilogb sqrtf powf pow logf log fmodf floorf expf ceilf _dsign round nearbyint sinf _dclass ldexp __setusermatherr _fdclass acosf atan2f ceil cosf

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-convert-l1-1-0

strtoll atoi strtol atof strtod strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_time64