Become Opsec[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Become Opsec.exe
Size 134KB
Sample260719-aesx7aav21
SHA256 11becfb00ac0ba0fad72eb7b7312e413a0b9b83dba5d0451376468a3fdc7a297
MD5 3941de00995f9c3ad9b36c413b26dcf2
SHA1 79eddcc3653e29b387ebbb6d18355cd1b66f99bb
SHA512 084ea9509af157228c1f40a482b106d87c1ab5a762b13c72aa4041ce36b98cd20d450cf5474b4187e84a04cbc0c0bc3acb09e2bf545d9af2f85b52f294907bb6
SSDEEP 1536:7IfPhCms0eM09nRl8foQ7noOpBXfWLCDZwJ+F:7AhCmbeMKRl2oOpBXfWLCDF
TLSH
T1ACD3B71932A514B2D9A6C07AEC864367CDB13046033C95FF9182CADDEB717ECBA78E51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Become Opsec.exe

File Explorer

Become Opsec.exe

.exe 134KB

Become Opsec.exe

IMPHASH dd9ac0ef64378359b5c0d6e4add4c60c
SHA256 11becfb00ac0ba0fad72eb7b7312e413a0b9b83dba5d0451376468a3fdc7a297
MD5 3941de00995f9c3ad9b36c413b26dcf2
SHA1 79eddcc3653e29b387ebbb6d18355cd1b66f99bb
SHA512 084ea9509af157228c1f40a482b106d87c1ab5a762b13c72aa4041ce36b98cd20d450cf5474b4187e84a04cbc0c0bc3acb09e2bf545d9af2f85b52f294907bb6
SSDEEP 1536:7IfPhCms0eM09nRl8foQ7noOpBXfWLCDZwJ+F:7AhCmbeMKRl2oOpBXfWLCDF
TLSH
T1ACD3B71932A514B2D9A6C07AEC864367CDB13046033C95FF9182CADDEB717ECBA78E51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69687

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\wjeri\source\repos\Become Opsec\Become Opsec\x64\Debug\Become Opsec.pdb

kernel32

Sleep SetConsoleCP SetConsoleOutputCP FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar RaiseException IsDebuggerPresent GetTickCount64 GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetProcAddress

shell32

ShellExecuteA

msvcp140d

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Thrd_join _Thrd_yield _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ _Query_perf_counter _Query_perf_frequency ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

vcruntime140d

__std_exception_copy __std_exception_destroy _CxxThrowException __C_specific_handler __C_specific_handler_noexcept __std_type_info_destroy_list __current_exception __current_exception_context __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcpy

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode strcpy_s strcat_s __stdio_common_vsprintf_s _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _wmakepath_s _wsplitpath_s wcscpy_s malloc _callnewh _beginthreadex terminate toupper wcslen system _CrtDbgReport _calloc_dbg _c_exit __p___argc _set_fmode _exit exit _free_dbg _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argv __setusermatherr _set_app_type _seh_filter_exe _crt_at_quick_exit _CrtDbgReportW _initterm_e strlen

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

830B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

988B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Become Opsec.exe

kernel32

shell32

msvcp140d

vcruntime140d

vcruntime140_1d

ucrtbased

generic