retrac[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
retrac.exe
Size 340KB
Sample260709-cv2ldacy8y
SHA256 86b6795d4ca5ecb17efffe9638a7798d78f6494cf40088a6abb264222437d08d
MD5 bc0686dd1c721b4e52f6ba47040f9bb9
SHA1 8d89edf17c1986ccf0c513421055f22047f40914
SHA512 50835a7ce43f37200be9c069f7e910594ee8b69f842ebafbdde8965e5dead04161958064d64fae2e7f1358632de582795b2e2d315c101f93b97a4f658e902667
SSDEEP 6144:sivDEqer0oCwyTrkjjYnu/0BFiCoN9YtXHbiAPR1DqFmdSnYDlG:vvDEqeHyPnY2iCoAtXHbDdSnSG
TLSH
T1AA747C81F2E451E5E06BA034A0AAF71FF535344847245AC763E488593FF27E0AAFB752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
retrac.exe

File Explorer

retrac.exe

.exe 340KB

retrac.exe

IMPHASH 0319c8c1896568c2c01165123f30bd8b
SHA256 86b6795d4ca5ecb17efffe9638a7798d78f6494cf40088a6abb264222437d08d
MD5 bc0686dd1c721b4e52f6ba47040f9bb9
SHA1 8d89edf17c1986ccf0c513421055f22047f40914
SHA512 50835a7ce43f37200be9c069f7e910594ee8b69f842ebafbdde8965e5dead04161958064d64fae2e7f1358632de582795b2e2d315c101f93b97a4f658e902667
SSDEEP 6144:sivDEqer0oCwyTrkjjYnu/0BFiCoN9YtXHbiAPR1DqFmdSnYDlG:vvDEqeHyPnY2iCoAtXHbDdSnSG
TLSH
T1AA747C81F2E451E5E06BA034A0AAF71FF535344847245AC763E488593FF27E0AAFB752
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

281504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\exech1\Downloads\12.41_[unknowncheats.me]_\build\pasteee.pdb

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9Ex

kernel32

Sleep CloseHandle CreateThread ReadProcessMemory GetConsoleWindow AllocConsole OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW Module32NextW VirtualQueryEx GlobalAlloc GlobalFree AcquireSRWLockExclusive GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter ReleaseSRWLockExclusive SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WakeAllConditionVariable GlobalLock

user32

GetKeyState LoadCursorA ScreenToClient GetActiveWindow GetCapture SetCapture SetCursor ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindow DispatchMessageA DestroyWindow SetWindowPos GetForegroundWindow TranslateMessage PeekMessageA GetCursorPos GetKeyNameTextA FindWindowA RegisterClassExA MapVirtualKeyA DefWindowProcA PostQuitMessage MoveWindow GetWindowLongA ClientToScreen SetWindowLongA ShowWindow GetWindowRect CreateWindowExA UpdateWindow GetAsyncKeyState SendInput GetWindowThreadProcessId GetClientRect IsWindowVisible EnumWindows

msvcp140

??Bios_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memset __current_exception_context __current_exception memmove memcpy memcmp memchr __C_specific_handler strstr __std_exception_copy __std_exception_destroy __std_terminate

api-ms-win-crt-runtime-l1-1-0

exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _invoke_watson _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _get_initial_narrow_environment _set_app_type _exit _seh_filter_exe terminate _cexit _crt_atexit _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fflush __stdio_common_vfprintf __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite freopen_s __p__commode fseek fclose __stdio_common_vsprintf_s ftell

api-ms-win-crt-string-l1-1-0

isprint _wcsicmp strncpy strcmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

tanf powf pow ceilf sqrtf cosf floorf atan2f __setusermatherr sinf asinf fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale