RunAsTI64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RunAsTI64.exe
Size 2.2MB
Sample260706-wtb4waez3m
SHA256 92a75d619744fc9559d50eac77537c89a829ff63de23162d6d63fca15ca947de
MD5 0e62fc7ceae46df907c0c5464de0edc6
SHA1 d5540fe7961d00a40f20d3ba5aba176bea42b211
SHA512 a0e88fe160e3f80c7e7f8218e91f017ae61d941e6f3d151a31ec35ccde23c364e8911a05af3e7e0d4336f4a83f9fca31863f440e946e902ccd87fec609417569
SSDEEP 24576:bdlQAEYvIg8Ru+SsN8VpVQfLd/ZHjI+SXjVRHL+dTf7V5Fz6dZNJCVlNVV2OukCD:MTi3NZKXTQ2SWVh
TLSH
T1D1B550D99AD1D0F0EA00E47702721733D93035BA55389E93D5AF4A1DA53E63E2BAC36C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RunAsTI64.exe

File Explorer

RunAsTI64.exe

.exe 2.2MB

RunAsTI64.exe

IMPHASH 0df6b403952cd9d8606570e05d480b95
SHA256 92a75d619744fc9559d50eac77537c89a829ff63de23162d6d63fca15ca947de
MD5 0e62fc7ceae46df907c0c5464de0edc6
SHA1 d5540fe7961d00a40f20d3ba5aba176bea42b211
SHA512 a0e88fe160e3f80c7e7f8218e91f017ae61d941e6f3d151a31ec35ccde23c364e8911a05af3e7e0d4336f4a83f9fca31863f440e946e902ccd87fec609417569
SSDEEP 24576:bdlQAEYvIg8Ru+SsN8VpVQfLd/ZHjI+SXjVRHL+dTf7V5Fz6dZNJCVlNVV2OukCD:MTi3NZKXTQ2SWVh
TLSH
T1D1B550D99AD1D0F0EA00E47702721733D93035BA55389E93D5AF4A1DA53E63E2BAC36C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24043

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

advapi32

RegQueryValueExW RegOpenKeyW RegCloseKey RegSetKeyValueW RegCreateKeyW

gdi32

EnumFontsW GetPaletteEntries SetTextColor SetBkMode CreateFontIndirectW ExcludeClipRect CreateSolidBrush SelectClipRgn CreateRectRgn GetDeviceCaps PatBlt GetStockObject SelectObject SetViewportOrgEx GetViewportOrgEx DeleteObject GetObjectW DeleteDC CreateDIBSection CreateCompatibleDC

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString StringFromGUID2 CoCreateInstance

user32

MessageBoxIndirectW WinHelpW CopyImage RegisterClassW WindowFromPoint GetSysColor SystemParametersInfoW GetClassInfoW CharLowerBuffW DefMDIChildProcW DefFrameProcW GetMenuBarInfo SetWindowContextHelpId GetWindowPlacement IsWindow BringWindowToTop AttachThreadInput EnableWindow IsWindowEnabled SetForegroundWindow GetForegroundWindow SetWindowLongW MoveWindow PeekMessageA GetMessageW PeekMessageW DispatchMessageW TranslateMessage TranslateMDISysAccel PrintWindow GetClassNameA FillRect DrawMenuBar CreateMenu ModifyMenuW GetMenuItemInfoW GetSystemMenu GetDlgItem SetWindowLongA SetWindowLongPtrA SetWindowLongPtrW CallWindowProcA GetActiveWindow CallWindowProcW GetWindowLongA GetClassNameW GetWindowThreadProcessId GetKeyState GetAsyncKeyState IsChild GetClassWord IsWindowUnicode SetClassLongA GetClassLongA AdjustWindowRectEx LoadCursorW GetClassLongPtrA InvalidateRect SetFocus GetWindow GetWindowLongW GetParent GetFocus EnumChildWindows SendMessageW ReleaseCapture SetCursorPos ClientToScreen GetCursorPos GetDCEx MapWindowPoints RedrawWindow SetCursor SetCapture UpdateWindow SetWindowPos GetIconInfo GetCursor GetMonitorInfoA MonitorFromPoint SetWindowTextW ReleaseDC DrawTextW GetDC ShowWindow IsWindowVisible ScreenToClient GetWindowRect EndPaint BeginPaint GetClientRect KillTimer SetTimer CreateWindowExW DefWindowProcW DestroyWindow MessageBoxA GetSystemMetrics MessageBoxW PostMessageW

kernel32

GetProcessHeap ExitProcess FindFirstFileW FindNextFileW GetVolumePathNameW GetVolumeInformationW FindClose GetCommandLineW GetModuleHandleA CompareStringW GetUserDefaultLCID GetLastError GetVersionExW GetCurrentThreadId LoadLibraryA LCMapStringW PostQueuedCompletionStatus GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryW VirtualAlloc VirtualFree WideCharToMultiByte SetFilePointer CreateFileW GetFullPathNameW SetFilePointerEx ReadFile CloseHandle HeapFree MultiByteToWideChar lstrlenA Sleep VirtualQuery lstrlenW FormatMessageW HeapAlloc

oleaut32

VarDecFromI2 VarAdd SafeArrayGetVartype VarIdiv VarDiv VarMul VarOr VarInt VarRound SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate VarAbs VarSu SafeArrayDestroyData SafeArrayAllocDescriptor SafeArrayCopy VarBstrCat LoadTypeLi VarBstrCmp VarCmp VarCat VariantCopy SafeArrayPtrOfIndex SafeArrayUnlock SafeArrayLock SafeArrayRedim VariantCopyInd VarBstrFromR8 SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayDestroy OleCreatePictureIndirect OleLoadPictureEx VariantClear VariantChangeTypeEx VarBstrFromI4 SysAllocStringLen SetErrorInfo GetErrorInfo SysAllocString SysAllocStringByteLen SysFreeString