RajaWareElite[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RajaWareElite.exe
Size 11.7MB
Sample260708-vbkgvsdz7v
SHA256 402473ced4052af52f141a35490d3bc66fd0c31896ed57b13993583ea8177478
MD5 070bbf16c009ba598a53e114b8653877
SHA1 481f552577d150807d97a7f2e0e4d6f5810d582f
SHA512 16fdfdadfb405d7c1b03afa58f430522188b905e41c73a727c72890d1525a5023f6aab6793dc8062bb7fa9f552f33af8b29ec3ccb2a486bd83d9584d289277b8
SSDEEP 98304:CiyLWGuTHgswG1w1M8T+ObFcRMPPfdwZgIrNuUPgS7ghickgTMJi4a18huz/BDdc:/gswGS1JXPquaihahuz/BDd/VT
TLSH
T154C60721BB5B99ACD19BC47483474A724A7170CB0B35B9FF449482382FAABF45F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RajaWareElite.exe

File Explorer

RajaWareElite.exe

.exe 11.7MB

RajaWareElite.exe

IMPHASH 40166b28c7eca16163ca4c3238a73bc8
SHA256 402473ced4052af52f141a35490d3bc66fd0c31896ed57b13993583ea8177478
MD5 070bbf16c009ba598a53e114b8653877
SHA1 481f552577d150807d97a7f2e0e4d6f5810d582f
SHA512 16fdfdadfb405d7c1b03afa58f430522188b905e41c73a727c72890d1525a5023f6aab6793dc8062bb7fa9f552f33af8b29ec3ccb2a486bd83d9584d289277b8
SSDEEP 98304:CiyLWGuTHgswG1w1M8T+ObFcRMPPfdwZgIrNuUPgS7ghickgTMJi4a18huz/BDdc:/gswGS1JXPquaihahuz/BDd/VT
TLSH
T154C60721BB5B99ACD19BC47483474A724A7170CB0B35B9FF449482382FAABF45F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7543488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RajaWareElite.pdb

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW RegCloseKey EventUnregister RegOpenKeyExW RegGetValueW EventRegister EventSetInformation EventWriteTransfer

ntdll

RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtReadFile NtWriteFile RtlGetVersion

kernel32

lstrlenW EncodePointer LCIDToLocaleName RaiseException WaitForSingleObject TlsAlloc TlsGetValue FindNextFileW RtlVirtualUnwind TlsSetValue RtlCaptureContext TerminateProcess GetProcessId GetExitCodeProcess GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW RtlPcToFileHeader IsProcessorFeaturePresent GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar CancelIo QueryPerformanceFrequency ReadFile SleepEx ReadFileEx WaitForMultipleObjects ExitProcess GetTempPathW GetFullPathNameW SetEnvironmentVariableW IsDebuggerPresent FindClose GetSystemTimeAsFileTime GetFinalPathNameByHandleW GetOverlappedResult ResetEvent LoadLibraryA CreateEventW SwitchToThread GetFileInformationByHandleEx CreateDirectoryW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW FreeLibrary SetEvent DuplicateHandle SetFileInformationByHandle ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx WideCharToMultiByte GetCurrentProcess HeapReAlloc GetEnvironmentVariableW TlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId DeleteCriticalSection GetModuleHandleW GetUserDefaultUILanguage InitializeSListHead UnhandledExceptionFilter LoadLibraryW SetUnhandledExceptionFilter GetModuleHandleA Sleep GetProcAddress LoadLibraryExA CloseHandle HeapAlloc RtlUnwindEx FormatMessageW FindFirstFileExW RtlLookupFunctionEntry CreatePipe GetFileAttributesW CreateFileW GetFileInformationByHandle GetConsoleMode

user32

SetWindowPlacement AppendMenuW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable DrawIconEx DrawMenuBar MapVirtualKeyW SetMenu DrawTextW GetWindowDC OffsetRect GetMenuBarInfo GetMenuItemInfoW CreateIcon GetAsyncKeyState GetKeyboardState MapVirtualKeyExW GetWindowPlacement SetWindowPos InvalidateRgn LoadCursorW SetCursor SetMenuItemInfoW RegisterClassExW CreateWindowExW GetMessageA ToUnicodeEx GetKeyState SystemParametersInfoA SetPropW PeekMessageW GetMenu IsWindowVisible SetWindowLongW EnableMenuItem CreateMenu GetSystemMenu DispatchMessageA FlashWindowEx ClipCursor GetClipCursor CreatePopupMenu RemoveMenu GetRawInputData EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SendInput SetForegroundWindow DefWindowProcW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RedrawWindow PostThreadMessageW RegisterWindowMessageA SetParent MapWindowPoints GetKeyboardLayout ChangeDisplaySettingsExW CheckMenuItem GetWindow SetFocus ShowWindow ReleaseDC EnableWindow IsWindowEnabled GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn PostMessageW IsProcessDPIAware GetDC DispatchMessageW DestroyMenu TranslateMessage TranslateAcceleratorW DestroyWindow GetForegroundWindow EnumChildWindows RegisterTouchWindow IsWindow AdjustWindowRectEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos GetMessageW GetUpdateRect ValidateRect GetMonitorInfoW MonitorFromWindow GetCursorPos GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect MonitorFromRect ClientToScreen GetClientRect GetWindowLongW ScreenToClient IsIconic SendMessageW AdjustWindowRect ShowCursor DestroyIcon

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass TaskDialogIndirect

ole32

CoInitializeEx CoCreateFreeThreadedMarshaler RevokeDragDrop RegisterDragDrop CoTaskMemAlloc OleInitialize CoTaskMemFree CoUninitialize CoInitialize CoCreateInstance

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

gdi32

SetTextColor BitBlt CreateRectRgn GetDeviceCaps DeleteObject CombineRgn SetBkMode CreateSolidBrush CreateDIBSection SelectObject DeleteDC CreateCompatibleDC

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shell32

SHGetKnownFolderPath ShellExecuteW DragQueryFileW DragFinish SHAppBarMessage SHCreateItemFromParsingName SHOpenFolderAndSelectItems ord190 ShellExecuteExW ord155

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

api-ms-win-crt-math-l1-1-0

pow __setusermatherr roundf trunc floor round

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp strcpy_s wcscmp wcsncmp wcsncat

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initterm _initialize_narrow_environment _seh_filter_exe _configure_narrow_argv _initterm_e exit _exit abort __p___argc __p___argv _cexit _set_app_type terminate _c_exit _crt_atexit _get_initial_narrow_environment _initialize_onexit_table _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

Name

.text

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

416KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taubndl

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RajaWareElite.exe

bcryptprimitives

advapi32

ntdll

kernel32

user32

comctl32

ole32

shlwapi

api-ms-win-core-synch-l1-2-0

gdi32

dwmapi

shell32

oleaut32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic