Usermode[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Usermode.exe
Size 550KB
Sample260719-ryptbafv6z
SHA256 dc8949a291d347bcac79866817bb50ddc0c2644a4c6010bb8c41a20fc948c598
MD5 714e5427cccc0894392c5c08e8a6d5bd
SHA1 d1741e417f3b1719c57765e0eada1fec3c5b665e
SHA512 e06616b447baf7589ecc8b180e63afe712d1b83e1e851aff252f2c9e6f3288331d264da13db2fe5fcbd961e9167c5d0a0d11dae581cb430d62af6305eb054bfa
SSDEEP 12288:ODIvvSrzjFbEeXDQs1FDbppFExE1e4jviAnCC:ODrzRE+DtF/DFPLiAnCC
TLSH
T1A6C4AF46F1E952F9C07BA1389A66D51BED3638141B7445CF33D408A81BB37F09BBA722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Usermode.exe

File Explorer

Usermode.exe

.exe 550KB

Usermode.exe

IMPHASH e6f74ce5e1039a7fa35746504a8bb94a
SHA256 dc8949a291d347bcac79866817bb50ddc0c2644a4c6010bb8c41a20fc948c598
MD5 714e5427cccc0894392c5c08e8a6d5bd
SHA1 d1741e417f3b1719c57765e0eada1fec3c5b665e
SHA512 e06616b447baf7589ecc8b180e63afe712d1b83e1e851aff252f2c9e6f3288331d264da13db2fe5fcbd961e9167c5d0a0d11dae581cb430d62af6305eb054bfa
SSDEEP 12288:ODIvvSrzjFbEeXDQs1FDbppFExE1e4jviAnCC:ODrzRE+DtF/DFPLiAnCC
TLSH
T1A6C4AF46F1E952F9C07BA1389A66D51BED3638141B7445CF33D408A81BB37F09BBA722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

384692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sxxw\Desktop\q9pwzs7\x64\Release\Usermode.pdb

kernel32

CreateThread GetModuleHandleW OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter SetPriorityClass CloseHandle Sleep SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead Process32FirstW Process32NextW GetCurrentThread CreateFileW SetThreadPriority AcquireSRWLockExclusive GetCurrentProcess CreateToolhelp32Snapshot ReleaseSRWLockExclusive DeviceIoControl

user32

GetKeyState GetMessageExtraInfo ScreenToClient SetClipboardData ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect GetCapture GetAsyncKeyState SetWindowLongW GetWindowLongW GetCursorPos UpdateWindow IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard PostQuitMessage GetClipboardData EmptyClipboard DispatchMessageA DestroyWindow CreateWindowExW GetSystemMetrics RegisterClassExW ShowWindow SetLayeredWindowAttributes TranslateMessage LoadCursorW PeekMessageA DefWindowProcW

shell32

ShellExecuteW

msvcp140

_Query_perf_counter _Query_perf_frequency _Thrd_yield ?good@ios_base@std@@QEBA_NXZ _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Xlength_error@std@@YAXPEBD@Z _Thrd_hardware_concurrency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Mtx_unlock ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __C_specific_handler memset memcpy memcmp memmove __std_terminate __std_exception_copy __std_exception_destroy memchr _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_beginthreadex __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback exit _initterm_e terminate _configure_narrow_argv _initialize_narrow_environment _initterm _invoke_watson _get_initial_narrow_environment _exit _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table system

api-ms-win-crt-string-l1-1-0

strncmp strcmp _wcsicmp strncpy

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf _set_fmode __stdio_common_vsscanf fread _wfopen fwrite __p__commode ftell fseek fclose fflush __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

atan2 asin logf tanf cosf powf sinf sqrtf ceilf __setusermatherr acosf _dclass fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale