system-net-diag[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
system-net-diag.exe
Size 18.9MB
Sample260709-18dcpsas7p
SHA256 eb7bdbb21a676debb66f8d2d59c07562c0cb08f35432947e081b73b6db2ed3a9
MD5 b2bab7512120558e50ac06d33b1fc115
SHA1 0e55012a2dbd4bc688f8ba8cb80a3b96e742bc64
SHA512 cdd95e3ca9d011505b6b84d88ade9d4513833b1cf59aa2b5a4fe54c1d97f20de7d2fbad4b5ca3c0121775ef0d5920f8b80b12419682bbd479e4a9d11794dc69b
SSDEEP 98304:RuaEgdklMc/FnEn0RxjWz4ZKYrob3pzaW2psJRoiwKhXedTiRkClxvcpR7sgkG3Z:RzEgc12ZzVFHjGUQo6ascTw
TLSH
T164175A21BB4A99ADC05AC47483468A735A7170CB0B35BAFF45D486393FA9AF41F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
system-net-diag.exe

File Explorer

system-net-diag.exe

.exe 18.9MB

system-net-diag.exe

IMPHASH 56ca31016cf5359379e291463d5ee613
SHA256 eb7bdbb21a676debb66f8d2d59c07562c0cb08f35432947e081b73b6db2ed3a9
MD5 b2bab7512120558e50ac06d33b1fc115
SHA1 0e55012a2dbd4bc688f8ba8cb80a3b96e742bc64
SHA512 cdd95e3ca9d011505b6b84d88ade9d4513833b1cf59aa2b5a4fe54c1d97f20de7d2fbad4b5ca3c0121775ef0d5920f8b80b12419682bbd479e4a9d11794dc69b
SSDEEP 98304:RuaEgdklMc/FnEn0RxjWz4ZKYrob3pzaW2psJRoiwKhXedTiRkClxvcpR7sgkG3Z:RzEgc12ZzVFHjGUQo6ascTw
TLSH
T164175A21BB4A99ADC05AC47483468A735A7170CB0B35BAFF45D486393FA9AF41F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11955764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

system_net_diag.pdb

kernel32

ReadProcessMemory GetProcessIoCounters GetSystemTimes GetProcessTimes SetHandleInformation OpenProcess GetExitCodeProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot VirtualQueryEx K32GetPerformanceInfo GlobalMemoryStatusEx GetCurrentProcessId SetConsoleCtrlHandler GetCurrentProcess DuplicateHandle CreateIoCompletionPort SetFileCompletionNotificationModes TerminateProcess PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetOverlappedResult ReadFile WriteFile CancelIoEx QueryPerformanceCounter GetSystemInfo LoadLibraryExW SetThreadErrorMode FreeLibrary GetModuleFileNameW Sleep GetModuleHandleA GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetModuleHandleW GetFileAttributesW LocalFree CreateFileW FormatMessageW FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW CancelIo QueryPerformanceFrequency SleepEx ReadFileEx WaitForMultipleObjects GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter ExitProcess GetFullPathNameW FindClose FindFirstFileExW GetCurrentThreadId DeleteFileW GetFileInformationByHandle SwitchToThread GetFileInformationByHandleEx GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler IsProcessorFeaturePresent SetFileInformationByHandle GetSystemTimeAsFileTime HeapFree ReleaseMutex LoadLibraryW CreateMutexA WaitForSingleObjectEx lstrlenW HeapReAlloc GetProcAddress GlobalLock GlobalAlloc SetLastError GetFinalPathNameByHandleW InitializeSListHead GlobalUnlock GetConsoleMode CompareStringOrdinal IsDebuggerPresent HeapAlloc GlobalSize WideCharToMultiByte GetProcessHeap SetNamedPipeHandleState CloseHandle CreateEventW GlobalFree MultiByteToWideChar WaitForSingleObject LoadLibraryA GetCurrentThread

advapi32

RegCloseKey OpenProcessToken SystemFunction036 RegQueryValueExW CopySid GetLengthSid RegOpenKeyTransactedW IsValidSid RegCreateKeyExW RegCreateKeyTransactedW RegSetValueExW RegOpenKeyExW GetTokenInformation RevertToSelf ImpersonateAnonymousToken

oleaut32

SafeArrayPutElement SafeArrayCreateVector GetErrorInfo SysAllocStringLen SysStringLen SysFreeString SetErrorInfo

ws2_32

accept setsockopt recvfrom ioctlsocket connect getsockopt bind listen send WSASend getpeername WSADuplicateSocketW recv WSASocketW socket WSAIoctl closesocket WSAGetLastError getsockname WSACleanup WSAStartup select freeaddrinfo getaddrinfo WSARecv shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

secur32

EncryptMessage DecryptMessage ApplyControlToken InitializeSecurityContextW DeleteSecurityContext QueryContextAttributesW FreeCredentialsHandle AcquireCredentialsHandleA AcceptSecurityContext FreeContextBuffer

iphlpapi

GetIpForwardTable GetExtendedTcpTable GetAdaptersAddresses GetExtendedUdpTable

pdh

PdhOpenQueryA PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCloseQuery PdhRemoveCounter PdhEnumObjectsA PdhCollectQueryData

powrprof

CallNtPowerInformation

ole32

RegisterDragDrop RevokeDragDrop CoInitializeEx OleInitialize CoCreateInstance CoUninitialize

ntdll

RtlGetVersion RtlLookupFunctionEntry NtCreateFile RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtQueryInformationProcess RtlVirtualUnwind NtReadFile NtOpenFile NtCreateNamedPipeFile NtWriteFile RtlCaptureContext

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW DragQueryFileW DragFinish

bcryptprimitives

ProcessPrng

crypt32

CertFreeCertificateChain CertCloseStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertOpenStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateStore CertAddCertificateContextToStore

bcrypt

BCryptGenRandom

wininet

InternetSetOptionW

gdi32

CreateRectRgn DeleteObject SwapBuffers ChoosePixelFormat DescribePixelFormat SetPixelFormat GetDeviceCaps

user32

PeekMessageW CreateWindowExW RegisterClassExW GetKeyboardState InvalidateRgn SetWindowPos GetClientRect SetWindowDisplayAffinity IsProcessDPIAware RegisterTouchWindow DestroyWindow MapVirtualKeyExW GetKeyboardLayout SendMessageW GetSystemMetrics GetActiveWindow ToUnicodeEx ReleaseDC RedrawWindow PostMessageW GetKeyState CreateIcon DispatchMessageW DestroyIcon KillTimer GetAsyncKeyState GetMessageW ReleaseCapture SetCapture SetWindowLongPtrW GetWindowLongPtrW RegisterWindowMessageA EmptyClipboard RegisterClipboardFormatW IsClipboardFormatAvailable OpenClipboard ChangeDisplaySettingsExW GetClipboardData TranslateMessage SetClipboardData EnableMenuItem SystemParametersInfoA IsIconic GetWindowRect AdjustWindowRectEx GetWindowLongW GetWindowPlacement SetWindowLongW SetWindowPlacement ShowWindow MapVirtualKeyW GetMenu SendInput SetForegroundWindow GetSystemMenu CloseTouchInputHandle ScreenToClient GetCursorPos MonitorFromRect RemovePropW ShowCursor CallWindowProcW MonitorFromWindow GetMonitorInfoW LoadCursorW SetCursor ValidateRect GetClassNameW GetClassInfoExW GetDC FlashWindowEx ClientToScreen GetForegroundWindow GetTouchInputInfo SetCursorPos GetPropW SetPropW ClipCursor GetClipCursor SetTimer RegisterRawInputDevices GetRawInputData EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateIconFromResourceEx DefWindowProcW CloseClipboard TrackMouseEvent

opengl32

wglDeleteContext wglGetCurrentContext wglGetProcAddress wglShareLists wglCreateContext wglMakeCurrent wglGetCurrentDC

dwmapi

DwmEnableBlurBehindWindow

shlwapi

AssocQueryStringW

uiautomationcore

UiaRaiseAutomationPropertyChangedEvent UiaLookupId UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent

uxtheme

SetWindowTheme

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmAssociateContextEx

vcruntime140

memset _CxxThrowException memcmp __C_specific_handler __CxxFrameHandler3 memmove __current_exception __current_exception_context memcpy

api-ms-win-crt-math-l1-1-0

acos _hypot atan2 fmod tan atan2f acosf cosf fmodf _hypotf ceilf floor log10 exp2f cbrtf trunc expf ceil pow roundf round floorf sinf truncf sin powf __setusermatherr cos

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _get_initial_narrow_environment _set_app_type _configure_narrow_argv terminate _initterm _initterm_e _seh_filter_exe exit _exit __p___argc __p___argv _cexit _crt_atexit _c_exit strerror _register_thread_local_exe_atexit_callback _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale