yeniemu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
yeniemu.exe
Size 794KB
Sample260720-k722nsft8v
SHA256 1601848740312537f5a53581bfebc213aa06482b1f48adaec32898bc2ac350a7
MD5 692db56ee9b84caa1c3ce70f6d6ee57e
SHA1 382dc294aed15f2fd361ccfff0d394a7dead81cf
SHA512 d418cdc532826d6e0f54ec2424025aa6c0a7dfb218b9592869180a1aeceb40b41b4a3a806bba41f8831040aaf3eb0bba2500e5e55442905a73aff6bc9996958e
SSDEEP 24576:JdokdE/ZonTBmV0RnoUIxHVRkr4cnbABpsX+kZllnJVDQK:zoBonFRnGBkEcnbABpsX+GllnJVD
TLSH
T12A059E6EABA801F9C17BC178C6575207E7B274591330A7DB13E08AA92F13BD16B3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
yeniemu.exe

File Explorer

yeniemu.exe

.exe 794KB

yeniemu.exe

IMPHASH d5db9211d22236ea1c5442caaa0d66b7
SHA256 1601848740312537f5a53581bfebc213aa06482b1f48adaec32898bc2ac350a7
MD5 692db56ee9b84caa1c3ce70f6d6ee57e
SHA1 382dc294aed15f2fd361ccfff0d394a7dead81cf
SHA512 d418cdc532826d6e0f54ec2424025aa6c0a7dfb218b9592869180a1aeceb40b41b4a3a806bba41f8831040aaf3eb0bba2500e5e55442905a73aff6bc9996958e
SSDEEP 24576:JdokdE/ZonTBmV0RnoUIxHVRkr4cnbABpsX+kZllnJVDQK:zoBonFRnGBkEcnbABpsX+GllnJVD
TLSH
T12A059E6EABA801F9C17BC178C6575207E7B274591330A7DB13E08AA92F13BD16B3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

576996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\pack\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb

kernel32

FlushFileBuffers VirtualQueryEx ConnectNamedPipe QueryPerformanceCounter GetConsoleWindow GetCurrentProcessId ReadProcessMemory ExitProcess LocalFree CreateFileMappingA Beep SwitchToThread HeapAlloc InitializeSListHead CancelIoEx IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetFileSizeEx VerifyVersionInfoW VerSetConditionMask WaitForMultipleObjects PeekNamedPipe GetFileType GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW WideCharToMultiByte MultiByteToWideChar GetTickCount SleepEx LoadLibraryW GetProcAddress FreeLibrary LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FormatMessageW SetLastError GetModuleHandleW GetModuleHandleA GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSectionEx SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemInfo CloseHandle Process32FirstW DeleteFileA QueryPerformanceFrequency Process32NextW GetLastError GetTickCount64 Sleep CreateToolhelp32Snapshot OpenProcess DisconnectNamedPipe ReleaseMutex GetCurrentThreadId CreateFileW WaitForSingleObject GetVolumeInformationA CreateMutexA CreateNamedPipeW WriteConsoleOutputCharacterA TerminateProcess WriteFile GetStdHandle GetCurrentProcess SetConsoleTitleA SetConsoleTextAttribute HeapCreate SetConsoleCtrlHandler GetModuleFileNameA GetSystemTimeAsFileTime ReadFile

user32

GetForegroundWindow GetAsyncKeyState

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyHash CryptAcquireContextW CryptGetHashParam CryptCreateHash CryptHashData

msvcp140

??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Mtx_unlock ?tolower@?$ctype@D@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Xtime_get_ticks _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z _Strcoll ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ _Mtx_lock ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z _Strxfrm _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpConnect WinHttpOpen WinHttpReceiveResponse

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptStringToBinaryW

ws2_32

send WSAEventSelect gethostname ioctlsocket sendto recvfrom listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt WSACloseEvent htons getsockname getpeername connect bind WSASetLastError ntohs WSAGetLastError closesocket inet_ntop inet_pton freeaddrinfo getaddrinfo WSAEnumNetworkEvents recv WSACreateEvent getsockopt

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove strrchr _CxxThrowException memset memcpy memcmp strstr __current_exception __std_terminate __std_exception_copy __std_exception_destroy __current_exception_context __C_specific_handler strchr memchr wcschr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s fputc fflush _close _fileno _write _read fclose __p__commode _set_fmode __stdio_common_vsprintf_s _lseeki64 fgetc __stdio_common_vfprintf fgets _wfopen _wopen fwrite fgetpos ftell fseek feof setvbuf fputs ungetc fsetpos fread __stdio_common_vsscanf _fseeki64 _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

realloc calloc _set_new_mode malloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

abort _seh_filter_exe __sys_nerr __sys_errlist _cexit _set_app_type _crt_atexit _initterm _initterm_e _exit __p___argc exit _errno __p___argv _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv terminate system _initialize_narrow_environment _beginthreadex _invoke_watson _initialize_onexit_table _get_initial_narrow_environment _register_onexit_function

api-ms-win-crt-string-l1-1-0

strcmp isdigit strcspn strncmp _strdup _stricmp _wcsicmp wcspbrk strspn wcsncpy isalnum wcsncmp strpbrk

api-ms-win-crt-time-l1-1-0

strftime _time64 _gmtime64 _localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _unlink _unlock_file _wstat64 _lock_file

api-ms-win-crt-math-l1-1-0

_fdopen __setusermatherr

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoll strtoul wcstombs

api-ms-win-crt-locale-l1-1-0

_configthreadlocale