oxtyocin[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
oxtyocin.exe
Size 2.0MB
Sample260720-c4sd3afv5y
SHA256 110c5fee530294181c07574293496a306a61c8fabf93953d84d6826869988fad
MD5 ddac70b32c21d08e25b3a8df0d9d6c7b
SHA1 329cd487695f3b1e81a62b21f97f2c26f12653a8
SHA512 7bdff5bc37bc150ab7db506f8bceda8ae2b337fce493f09f2cd4cbe9d17b87fee1baf7bf42709481f7e12d85461445e7dc711b6fdf2cb2442c16045e3d7478c2
SSDEEP 24576:qu6yvoPId6CufhXEEH19EzQb243kprQs/yeCprDkCaWfTYHMEZvh0lhSMXlmiGhi:WEdrufhUM0WEQs/ytDD3ss9fdnma
TLSH
T1B4A5BF42F2A541E8D5A7C1788A46A60BEB31780503206BDF67E45A5A2F63BF11FFF311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
oxtyocin.exe

File Explorer

oxtyocin.exe

.exe 2.0MB

oxtyocin.exe

IMPHASH 89bf9e27bc3314ff5856b47f851b789e
SHA256 110c5fee530294181c07574293496a306a61c8fabf93953d84d6826869988fad
MD5 ddac70b32c21d08e25b3a8df0d9d6c7b
SHA1 329cd487695f3b1e81a62b21f97f2c26f12653a8
SHA512 7bdff5bc37bc150ab7db506f8bceda8ae2b337fce493f09f2cd4cbe9d17b87fee1baf7bf42709481f7e12d85461445e7dc711b6fdf2cb2442c16045e3d7478c2
SSDEEP 24576:qu6yvoPId6CufhXEEH19EzQb243kprQs/yeCprDkCaWfTYHMEZvh0lhSMXlmiGhi:WEdrufhUM0WEQs/ytDD3ss9fdnma
TLSH
T1B4A5BF42F2A541E8D5A7C1788A46A60BEB31780503206BDF67E45A5A2F63BF11FFF311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1191392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sync3\Downloads\Glory\build\Glory.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Sleep GetStdHandle SetConsoleMode GetConsoleMode FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess SetConsoleScreenBufferSize TerminateProcess SetConsoleWindowInfo FillConsoleOutputAttribute ExitProcess SetConsoleCP GetConsoleWindow SetConsoleOutputCP SetConsoleCursorPosition AllocConsole Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW CloseHandle lstrcmpiW K32GetProcessMemoryInfo CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetEnvironmentStringsW GetOEMCP GetACP GetModuleHandleA GetTimeZoneInformation GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFileType ReadConsoleW SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree EnterCriticalSection GlobalAlloc MultiByteToWideChar SetEndOfFile IsValidCodePage WriteConsoleW HeapSize CreateFileW SetStdHandle FreeEnvironmentStringsW GetModuleHandleExW RaiseException RtlPcToFileHeader GetExitCodeThread SetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetSystemTimePreciseAsFileTime ReleaseSRWLockShared AcquireSRWLockShared LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx WaitForSingleObjectEx

user32

CloseClipboard OpenClipboard GetCursorPos GetClipboardData SetCursorPos ReleaseCapture IsWindowUnicode EmptyClipboard SetClipboardData DispatchMessageA GetWindowRect DestroyWindow GetSystemMetrics SetWindowDisplayAffinity MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA PostQuitMessage RegisterClassExA UpdateWindow SetWindowPos ShowWindow SetWindowLongA SetForegroundWindow GetWindowThreadProcessId IsWindow EnumWindows FindWindowA GetKeyNameTextA GetAsyncKeyState MapVirtualKeyA SendInput GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect

shell32

SHGetFolderPathA ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

566KB

Virtual Size

565KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

oxtyocin.exe

d3d11

d3dcompiler_47

kernel32

user32

shell32

imm32

dwmapi

winhttp

generic