implant[.]exe | Triage™

General

Target
implant.exe
Size 178KB
Sample260714-xtz2daev3v
SHA256 146a2ad452b4923998275409ab7ccf0987e9d7dba1e23f5c6a785eac6a234368
MD5 e41fcbed33eca139669c97f1c2502bf4
SHA1 fea677141c67bce309a1be35447c6edf9f6f760e
SHA512 308ace407d7a933fb31237f2966907b52555b13d31227920f32ae7c751969c155ebe2649e9ffaed74baa95675cb7f9d2141c929846564c538ce988bdb05dd5c4
SSDEEP 3072:c9n+nMjLBT8IpLxnbKZUk/czXohMZ0Xg5MfMXwFag0CGuP:ch+nMHB4CLhE0UiZwMzu
TLSH
T176047D15FBA510FAD1BB8574C9410906EB737C4647A0AADF17900EF69F23AE09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
implant.exe

File Explorer

implant.exe

.exe 178KB

implant.exe

IMPHASH 9774a58b7bdba0594d36f45f43fa7208
SHA256 146a2ad452b4923998275409ab7ccf0987e9d7dba1e23f5c6a785eac6a234368
MD5 e41fcbed33eca139669c97f1c2502bf4
SHA1 fea677141c67bce309a1be35447c6edf9f6f760e
SHA512 308ace407d7a933fb31237f2966907b52555b13d31227920f32ae7c751969c155ebe2649e9ffaed74baa95675cb7f9d2141c929846564c538ce988bdb05dd5c4
SSDEEP 3072:c9n+nMjLBT8IpLxnbKZUk/czXohMZ0Xg5MfMXwFag0CGuP:ch+nMHB4CLhE0UiZwMzu
TLSH
T176047D15FBA510FAD1BB8574C9410906EB737C4647A0AADF17900EF69F23AE09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect inet_pton WSACleanup WSAStartup socket send select recv htons closesocket

advapi32

RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey GetUserNameA RegSetValueExW

kernel32

HeapReAlloc FlushFileBuffers SetFilePointerEx GetConsoleOutputCP GetConsoleMode CreateFileW WriteConsoleW HeapSize EncodePointer ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW ReadFile CloseHandle CreatePipe WaitForSingleObject Sleep GetCurrentProcessId ExitProcess CreateProcessA CreateProcessW GetTickCount64 GetModuleFileNameW CopyFileW GetComputerNameA WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess GetStringTypeW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap SetStdHandle

Name

.text

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

implant.exe

ws2_32

advapi32

kernel32

generic