launcher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
launcher.exe
Size 937KB
Sample260709-mgqbashw31
SHA256 343b58fde0b7f9da08d7401905b513fc29eedd48c7cf6d4c006fa766230b4295
MD5 e920e053dd1e4dbe627587bf3a7f746c
SHA1 da69262c7a596e476f12693a5b7676f81d0e7a85
SHA512 2c3862b753fef947eb490c51fbe4a9e1b6e6927e17881e5b7fa2e78b4fcae78adea7a4aca7de2d1ca715beed19d1f9ec3d6746b6122fbbad9185a1d2a3b7ed66
SSDEEP 24576:FzU9QaRolgepXs4gFy6UC4AWoLu64po3UF:WMSepXs4gQ6UC4AWuGo
TLSH
T145157C1174C28071D5A30171782FBF788BADBD145B3C16FB27947A2E9A372F22935A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

launcher.exe

.exe 937KB

launcher.exe

IMPHASH 895bfefd897022b8027664dab4eb0d78
SHA256 343b58fde0b7f9da08d7401905b513fc29eedd48c7cf6d4c006fa766230b4295
MD5 e920e053dd1e4dbe627587bf3a7f746c
SHA1 da69262c7a596e476f12693a5b7676f81d0e7a85
SHA512 2c3862b753fef947eb490c51fbe4a9e1b6e6927e17881e5b7fa2e78b4fcae78adea7a4aca7de2d1ca715beed19d1f9ec3d6746b6122fbbad9185a1d2a3b7ed66
SSDEEP 24576:FzU9QaRolgepXs4gFy6UC4AWoLu64po3UF:WMSepXs4gQ6UC4AWuGo
TLSH
T145157C1174C28071D5A30171782FBF788BADBD145B3C16FB27947A2E9A372F22935A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

d4:11:22:fc:6e:ea:1a:a7:fe:9e:b1:4f:31:89:4a:0f:8f:9e:d2:43:bb:2c:2b:ba:04:10:09:0f:6a:cd:d2:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Skutta\, Kristjan,O=Skutta\, Kristjan,L=Berlin,C=DE

Chains

Feb 8, 2021

CN=Skutta\, Kristjan,O=Skutta\, Kristjan,L=Berlin,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Skutta\, Kristjan,O=Skutta\, Kristjan,L=Berlin,C=DE

Serial Number

06:94:f5:f6:0b:0b:46:22:d3:39:78:dd:4b:ce:e5:69

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 17, 2020 - Nov 21, 2023

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

268987

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dev\we\build\make\launcherx86\launcher\Release\launcher.pdb

kernel32

TerminateProcess IsWow64Process GetCurrentProcess LoadLibraryW FreeLibrary VerSetConditionMask VerifyVersionInfoW GetProcAddress GetModuleFileNameW GetLongPathNameW VirtualQuery LoadLibraryExW GetCurrentThreadId IsDebuggerPresent SetUnhandledExceptionFilter CreateProcessW GetExitCodeProcess GetModuleHandleW LoadLibraryA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW IsProcessorFeaturePresent UnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead FormatMessageA CreateDirectoryW FindFirstFileW GetFullPathNameW FindNextFileW DeviceIoControl RemoveDirectoryW SetEndOfFile FindClose GetFileAttributesW DeleteFileW GetCurrentDirectoryW SetFilePointerEx CopyFileW GetDriveTypeW AreFileApisANSI FatalAppExitA UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue lstrcmpW LocalAlloc GetModuleHandleA GetSystemDirectoryW GetVersion ExpandEnvironmentStringsW InitializeCriticalSection HeapSize GetTimeZoneInformation SetStdHandle GetProcessHeap Process32Next GetCurrentProcessId Process32First WideCharToMultiByte FormatMessageW LocalFree GetLastError CreateToolhelp32Snapshot CreateFileW Sleep WaitForSingleObject CloseHandle OpenProcess SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale MultiByteToWideChar GetVolumePathNamesForVolumeNameW GetStringTypeW TryEnterCriticalSection SwitchToThread GetExitCodeThread EncodePointer DecodePointer GetCPInfo SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CompareStringW LCMapStringW GetLocaleInfoW RtlUnwind RaiseException InterlockedPushEntrySList InterlockedFlushSList GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess WriteFile GetCurrentThread OutputDebugStringW GetFileSizeEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapAlloc HeapFree ReadFile ReadConsoleW GetDateFormatW GetTimeFormatW

user32

GetWindowThreadProcessId EnumWindows GetClassNameW GetWindowLongW PostMessageW MessageBoxA DestroyIcon DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW LoadImageW MoveWindow CreateDialogParamW EndDialog FindWindowW PostQuitMessage DestroyWindow ShowWindow EnableWindow LoadBitmapW SetWindowTextW SetWindowPos GetSystemMetrics SetWindowLongW ScreenToClient GetWindowRect SendMessageW GetClientRect GetDlgItem SetDlgItemTextW MessageBoxW wsprintfW IsWindow FindWindowExW

shell32

ShellExecuteExW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteKeyW CloseServiceHandle QueryServiceStatus ControlService OpenServiceW OpenSCManagerW RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegOpenKeyExW RegOpenKeyW

d3d11

D3D11CreateDevice

comctl32

ord17

Sharing

General

Malware Config

Signatures

File Explorer

launcher.exe

kernel32

user32

shell32

advapi32

d3d11

comctl32

generic