Belatstrap[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Belatstrap.exe
Size 29.7MB
Sample260714-rt9ypaew7p
SHA256 3f8f4a2decebd04679a52d9609f6c06de972794ad0230929d3ca56e80884aac4
MD5 8240363c1f5c9632eaf9241c8a966b61
SHA1 dfc723e3411673cf29ec0753331b1fd9dff54e32
SHA512 a90bfa4acb05594cb82f9bfbaf39e00809b9201b11c80234a94d4424bf51cb1b41e60f8dcf546695ce442af71b94f897c8577477d6658a91b1252b959a9afcb7
SSDEEP 786432:6/8Z1kB1kbKQhuS/VV8+ox+GuCcWBRR9g:o8ZWmhuSCzbcWBR/
TLSH
T14067235666E6E3C8CBC21D44264952DB22C1A8FE84FDA5293FCB6C03A434DEB458DD73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Belatstrap.exe

File Explorer

Belatstrap.exe

.exe 29.7MB

Belatstrap.exe

IMPHASH 7f0ea059814b08b0b60a85f86cc3a427
SHA256 3f8f4a2decebd04679a52d9609f6c06de972794ad0230929d3ca56e80884aac4
MD5 8240363c1f5c9632eaf9241c8a966b61
SHA1 dfc723e3411673cf29ec0753331b1fd9dff54e32
SHA512 a90bfa4acb05594cb82f9bfbaf39e00809b9201b11c80234a94d4424bf51cb1b41e60f8dcf546695ce442af71b94f897c8577477d6658a91b1252b959a9afcb7
SSDEEP 786432:6/8Z1kB1kbKQhuS/VV8+ox+GuCcWBRR9g:o8ZWmhuSCzbcWBR/
TLSH
T14067235666E6E3C8CBC21D44264952DB22C1A8FE84FDA5293FCB6C03A434DEB458DD73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21075919

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTickCount64

user32

OpenClipboard

gdi32

RoundRect

comdlg32

GetSaveFileNameA

advapi32

RegOpenKeyExW

shell32

SHCreateDirectoryExA

ole32

PropVariantClear

oleaut32

VariantClear

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

imm32

ImmSetCompositionWindow

msvcp140

?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpQueryHeaders

rpcrt4

UuidToStringW

crypt32

CryptUnprotectData

mfplay

MFPCreateMediaPlayer

d3d11

D3D11CreateDeviceAndSwapChain

winmm

PlaySoundA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-string-l1-1-0

isdigit

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-runtime-l1-1-0

_set_app_type

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

logf

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func

Name

.text

Size

Virtual Size

803KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.B<q

Size

Virtual Size

19.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.Zl_

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.f"d

Size

29.5MB

Virtual Size

29.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Belatstrap.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

d3dcompiler_47

dwmapi

imm32

msvcp140

iphlpapi

winhttp

rpcrt4

crypt32

mfplay

d3d11

winmm

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic