isabelle-rw[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
isabelle-rw.exe
Size 3.9MB
Sample260716-qgercaas2x
SHA256 d8383119f8cae7ddb47456082090bcd3c5358c1724bb3fdbabbd3b0b27bf151e
MD5 f8e7b05a78deb93986e49db03d39f765
SHA1 5d30cdff3a2450a17bf521b75886fff694a4f5bc
SHA512 3851ca48fdc66492b72a052a22313a736e35f04c607c52b251971b018ee410827034e1c043f073dcc558d50d252fddf11e0686e544b77d7c8d1afbd555d7a710
SSDEEP 98304:T4juZulXdAdKM78szR/F/YxBWvZLgue+svj1:T2pwzoMR/F/YxBWvZLEp
TLSH
T1DB16BF5677A900E9C1BBD138CA5B9527E772380903315BEB12E04A672F63AE05F7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
isabelle-rw.exe

File Explorer

isabelle-rw.exe

.exe 3.9MB

isabelle-rw.exe

IMPHASH 74e87b6c6368a23471a2060cd904066b
SHA256 d8383119f8cae7ddb47456082090bcd3c5358c1724bb3fdbabbd3b0b27bf151e
MD5 f8e7b05a78deb93986e49db03d39f765
SHA1 5d30cdff3a2450a17bf521b75886fff694a4f5bc
SHA512 3851ca48fdc66492b72a052a22313a736e35f04c607c52b251971b018ee410827034e1c043f073dcc558d50d252fddf11e0686e544b77d7c8d1afbd555d7a710
SSDEEP 98304:T4juZulXdAdKM78szR/F/YxBWvZLgue+svj1:T2pwzoMR/F/YxBWvZLEp
TLSH
T1DB16BF5677A900E9C1BBD138CA5B9527E772380903315BEB12E04A672F63AE05F7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2658160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nick_\source\repos\isabelle-rw-3\x64\Release\isabelle-rw.pdb

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

freeaddrinfo closesocket WSAGetLastError recvfrom sendto WSAWaitForMultipleEvents __WSAFDIsSet WSAIoctl gethostname socket setsockopt getaddrinfo WSAResetEvent WSAEnumNetworkEvents listen htonl WSACreateEvent WSACloseEvent send select accept recv htons ioctlsocket WSACleanup inet_pton WSAStartup WSAEventSelect inet_ntop getsockname ntohs getpeername connect WSASetLastError bind getsockopt

kernel32

GetModuleHandleA GetProcAddress ExitProcess GetCurrentProcessId GetModuleHandleW FlushInstructionCache VirtualQuery GetModuleFileNameA QueryPerformanceFrequency GetSystemInfo QueryPerformanceCounter MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA VerSetConditionMask FreeLibrary LoadLibraryExA FormatMessageA Process32First Module32Next Module32First Process32Next WriteProcessMemory K32QueryWorkingSetEx ReadProcessMemory VirtualQueryEx K32GetModuleInformation CreateToolhelp32Snapshot OpenProcess InitializeCriticalSectionEx CreateFileA GetFileSizeEx ReadFile MapViewOfFile UnmapViewOfFile ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW CreateFileW InitializeCriticalSection SetThreadPriority GetFileInformationByHandleEx ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetProcessHeap DeleteCriticalSection LocalFree HeapDestroy HeapAlloc CloseHandle HeapReAlloc GetCurrentThread GetCurrentProcess VirtualAlloc GetLastError Sleep CreateFileMappingA HeapSize HeapFree SetThreadAffinityMask AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx

user32

GetKeyState GetMessageExtraInfo GetCapture ClientToScreen ScreenToClient GetWindow GetWindowThreadProcessId GetCursorPos LoadCursorA EnumWindows TrackMouseEvent GetKeyNameTextA SetCapture SetCursor GetClientRect GetForegroundWindow MapVirtualKeyA SetForegroundWindow UpdateWindow RegisterClassExA PostQuitMessage FindWindowA TranslateMessage CreateWindowExA DefWindowProcA MoveWindow GetMonitorInfoA MessageBoxA SetWindowDisplayAffinity GetWindowLongA SetWindowLongA IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard SetTimer ShowWindow MonitorFromWindow GetKeyboardLayout GetWindowRect GetAsyncKeyState GetClipboardData SetClipboardData SendInput GetMessageA SetProcessDpiAwarenessContext CreateIconFromResourceEx DispatchMessageA

advapi32

GetLengthSid RegDeleteKeyA CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ConvertSidToStringSidA CopySid IsValidSid OpenProcessToken SystemFunction036 GetTokenInformation

shell32

ShellExecuteW SHGetFolderPathA ShellExecuteA

ole32

CoInitialize CoUninitialize CoCreateInstance

msvcp140

_Strxfrm ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Random_device@std@@YAIXZ _Xtime_get_ticks ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_counter ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z _Thrd_hardware_concurrency ?_Xbad_function_call@std@@YAXXZ _Cnd_wait _Thrd_id _Thrd_join _Cnd_broadcast ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Cnd_signal ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$numpunct@D@std@@2V0locale@2@A ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

winmm

PlaySoundA

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

userenv

UnloadUserProfile

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler_noexcept memset __std_exception_destroy __std_exception_copy __std_terminate _purecall __std_type_info_compare __C_specific_handler strchr strstr longjmp strrchr memcpy memmove memchr memcmp wcschr _CxxThrowException __current_exception __current_exception_context __intrinsic_setjmp

api-ms-win-crt-runtime-l1-1-0

abort _invalid_parameter_noinfo _resetstkoflw _errno _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_narrow_winmain_command_line _initterm _initterm_e _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback strerror exit _invoke_watson __sys_nerr system __sys_errlist

api-ms-win-crt-stdio-l1-1-0

_close _write _read _get_stream_buffer_pointers __stdio_common_vsprintf_s fread __p__commode ftell fsetpos ferror fputc ungetc fputs _fileno _set_fmode fseek _wopen feof _lseeki64 __stdio_common_vsprintf __acrt_iob_func fflush fclose setvbuf _ftelli64 _popen tmpfile fwrite _pclose clearerr fgetpos fgets _fseeki64 __stdio_common_vfprintf tmpnam getc fopen freopen fgetc _wfopen __stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

_callnewh realloc free malloc _set_new_mode calloc

api-ms-win-crt-convert-l1-1-0

strtoll strtof strtod wcstombs strtol strtoull strtoul atoi atof

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _gmtime64 _difftime64 strftime clock _mktime64 _localtime64_s

api-ms-win-crt-string-l1-1-0

strncpy isspace strspn toupper isdigit isxdigit _stricmp strpbrk tolower isgraph isblank isupper isalpha strncmp iscntrl ispunct islower strcoll strcmp _wcsdup isalnum _strdup strcspn wcspbrk wcsncmp strlen wcsncpy

api-ms-win-crt-filesystem-l1-1-0

_unlock_file rename _lock_file remove _wstat64 _unlink _fstat64

api-ms-win-crt-math-l1-1-0

nearbyint _ldsign _fdsign _dsign llround ldexp _fdclass _ldclass acos acosf asin atan2 ceil ceilf cos frexp cosf exp floor floorf tan fmod fmodf log log10 _fdopen logf pow powf roundf tanf sqrtf __setusermatherr sqrt sinf atan2f sin _dclass

api-ms-win-crt-locale-l1-1-0

setlocale ___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore