implant[.]exe | Triage™

General

Target
implant.exe
Size 178KB
Sample260714-xpm61set5x
SHA256 e4ceb3db7ef8d5e8cf85c04e4c6493b6cfcba141a39c493d458603b9b072c344
MD5 8d35295133f8d89ce0db882829db1498
SHA1 80818a284836622abbf27ba3483aa637db1e461a
SHA512 7cec86695c0326ee2449604d639dd72cf153ae5bdb24dca93b1f1eecaeb2390e9b5176c54f6e8f3b2438edbe31a0414cbdc1a07a82e9a1d4b829aac142ff445a
SSDEEP 3072:GnDmeGwUKsV+LkNALOy9TKERVZ/jkUzwRM3VnSCE0C617:GDmeGJH0kNArKklkEbR3
TLSH
T1A4047D15BAA510FAD1BB8574C9410906FB73BC4647A0AADF57900EF68F237E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
implant.exe

File Explorer

implant.exe

.exe 178KB

implant.exe

IMPHASH 9774a58b7bdba0594d36f45f43fa7208
SHA256 e4ceb3db7ef8d5e8cf85c04e4c6493b6cfcba141a39c493d458603b9b072c344
MD5 8d35295133f8d89ce0db882829db1498
SHA1 80818a284836622abbf27ba3483aa637db1e461a
SHA512 7cec86695c0326ee2449604d639dd72cf153ae5bdb24dca93b1f1eecaeb2390e9b5176c54f6e8f3b2438edbe31a0414cbdc1a07a82e9a1d4b829aac142ff445a
SSDEEP 3072:GnDmeGwUKsV+LkNALOy9TKERVZ/jkUzwRM3VnSCE0C617:GDmeGJH0kNArKklkEbR3
TLSH
T1A4047D15BAA510FAD1BB8574C9410906FB73BC4647A0AADF57900EF68F237E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect inet_pton WSACleanup WSAStartup socket send select recv htons closesocket

advapi32

RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey GetUserNameA RegSetValueExW

kernel32

HeapReAlloc FlushFileBuffers SetFilePointerEx GetConsoleOutputCP GetConsoleMode CreateFileW WriteConsoleW HeapSize EncodePointer ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW ReadFile CloseHandle CreatePipe WaitForSingleObject Sleep GetCurrentProcessId ExitProcess CreateProcessA CreateProcessW GetTickCount64 GetModuleFileNameW CopyFileW GetComputerNameA WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess GetStringTypeW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap SetStdHandle

Name

.text

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

implant.exe

ws2_32

advapi32

kernel32

generic