FadeSEC[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FadeSEC.exe
Size 674KB
Sample260720-th4nmsfw7k
SHA256 53035eeb3567411e8f6dea058e979823a01c1e731a570bd24fb38ae419521f96
MD5 b530bd3a0175736385ad31291734452b
SHA1 4ff9c22ed0f384d84a90205f5c3a63021f1c6c41
SHA512 300bb6e28ee36d2fb1722d58236045877eaec688c39bdde9f392ac966a0644dbd6b5b4ed2e19a22244e0a708b815224c3b8b4b7da0b9535540946ef6e4373919
SSDEEP 6144:413FJrl6e3VtT1tCRAs8H1FAfLTH+8TZd4ED4i4rVvcRxYA6rvMrDM0wpGvMdCar:413FfPBwv8HOTe8jDv4JcROA6rwZ+L
TLSH
T1E1E41997665000E8F03AC136E907176996227C46A3A377BB22984DF26F331A71F7DB71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FadeSEC.exe

File Explorer

FadeSEC.exe

.exe 674KB

FadeSEC.exe

IMPHASH 3d0aa609c03e97dd883e45483a799673
SHA256 53035eeb3567411e8f6dea058e979823a01c1e731a570bd24fb38ae419521f96
MD5 b530bd3a0175736385ad31291734452b
SHA1 4ff9c22ed0f384d84a90205f5c3a63021f1c6c41
SHA512 300bb6e28ee36d2fb1722d58236045877eaec688c39bdde9f392ac966a0644dbd6b5b4ed2e19a22244e0a708b815224c3b8b4b7da0b9535540946ef6e4373919
SSDEEP 6144:413FJrl6e3VtT1tCRAs8H1FAfLTH+8TZd4ED4i4rVvcRxYA6rvMrDM0wpGvMdCar:413FfPBwv8HOTe8jDv4JcROA6rwZ+L
TLSH
T1E1E41997665000E8F03AC136E907176996227C46A3A377BB22984DF26F331A71F7DB71
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

181664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

offreg

ORCloseHive ORGetValue OROpenHive ORCloseKey OROpenKey OREnumKey ORQueryInfoKey

bcrypt

BCryptDestroyKey BCryptEncrypt BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey

user32

EndPaint BeginPaint DefWindowProcW SetForegroundWindow FindWindowA SystemParametersInfoW PostQuitMessage GetClientRect wsprintfW SetWindowsHookExW LoadCursorW FindWindowW TranslateMessage SetFocus CreateWindowExA UnhookWindowsHookEx RegisterClassA GetMessageW InvalidateRect SetTimer DispatchMessageW GetAsyncKeyState ShowWindow GetSystemMetrics CallNextHookEx FillRect SetWindowPos PostMessageW

gdi32

Rectangle CreatePen LineTo SetBkMode TextOutA SetTextColor GetStockObject SelectObject CreateFontA SelectClipRgn MoveToEx DeleteObject CreateSolidBrush IntersectClipRect

advapi32

LookupPrivilegeValueA OpenProcessToken RegSetValueExA GetUserNameA CryptDestroyKey CreateProcessWithLogonW RevertToSelf CryptAcquireContextW LogonUserExW SetTokenInformation LsaLookupNames CreateWellKnownSid CryptDecrypt DeleteService ConvertStringSidToSidW IsWellKnownSid CryptCreateHash CryptHashData ImpersonateLoggedOnUser CryptDestroyHash StartServiceW RegQueryInfoKeyA CheckTokenMembership RegOpenKeyExW CryptSetKeyParam CryptImportKey OpenServiceW LsaQueryInformationPolicy GetLengthSid CryptGetHashParam LsaOpenPolicy GetUserNameW LsaClose QueryServiceStatusEx CryptReleaseContext GetTokenInformation AdjustTokenPrivileges CreateServiceW RegCloseKey CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W RegOpenKeyExA

rpcrt4

UuidToStringW UuidCreate NdrServerCallAll NdrServerCall2 RpcStringBindingComposeW RpcBindingFromStringBindingW NdrClientCall3

wininet

InternetOpenW HttpQueryInfoW InternetCloseHandle InternetReadFile InternetOpenUrlW

shlwapi

PathFindFileNameW

ntdll

NtCreateFile RtlPcToFileHeader RtlUnwindEx RtlInitUnicodeString NtClose RtlNtStatusToDosError RtlUnwind

cabinet

ord23 ord20 ord22

cldapi

CfConnectSyncRoot CfRegisterSyncRoot CfDisconnectSyncRoot CfExecute CfUnregisterSyncRoot

ole32

StringFromGUID2 CLSIDFromProgID CoCreateInstance CoUninitialize CoInitialize CoCreateGuid

oleaut32

SysAllocString SysStringLen

netapi32

NetShareEnum NetApiBufferFree

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpCloseHandle WinHttpSendRequest WinHttpOpen WinHttpQueryDataAvailable

kernel32

GetStdHandle SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc ExitProcess GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize WriteConsoleW SetEndOfFile WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind QueryPerformanceCounter OpenProcess IsValidCodePage RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetSystemTimeAsFileTime GetFileInformationByHandleEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection ReadFile SizeofResource GetFileSizeEx SetPriorityClass GetCurrentProcess WriteFile DeviceIoControl TerminateProcess GetDriveTypeA GetModuleFileNameW WaitForMultipleObjects GetTempPathW WaitForSingleObject CreateFileW CreateToolhelp32Snapshot Sleep GetLastError Process32NextW MoveFileExA CreateFileA LockResource DeleteFileA Process32FirstW CloseHandle CreateThread GetWindowsDirectoryA LoadResource FindResourceW GetLogicalDriveStringsA CreateProcessW GetComputerNameA CreateDirectoryW HeapFree SetLastError lstrlenW ExpandEnvironmentStringsW RemoveDirectoryW GetCurrentThreadId SuspendThread ResumeThread CreateEventW MultiByteToWideChar GetExitCodeThread ProcessIdToSessionId SetFileInformationByHandle SetEvent DeleteFileW LoadLibraryW HeapAlloc GetOverlappedResult UnlockFile GetThreadContext ReadDirectoryChangesW GetProcAddress LocalFree LockFileEx GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW GetSystemTime SetThreadContext MoveFileW OpenThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetNativeSystemInfo FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI EnterCriticalSection

Name

.text

Size

343KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

236KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FadeSEC.exe

offreg

bcrypt

user32

gdi32

advapi32

rpcrt4

wininet

shlwapi

ntdll

cabinet

cldapi

ole32

oleaut32

netapi32

winhttp

kernel32

generic