CREED[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CREED.exe
Size 46.6MB
Sample260722-lbkm7ada85
SHA256 ea53d3da9adad0a5f46d5c0a9bd18a844c09c2ec36c7c886cd93b2bfdb47b5fd
MD5 16b7f9bef4e52ff6fa49399ff527ee2a
SHA1 2a63391db805a3c5987b392a54fb02cc9616803c
SHA512 bca4423ab53dda655d96bc9db658e7a6fbb7371ffa4f8ccf4d21188e3963fcd41f39bf37c600a912e0540de5657c64824cba53c6eebbb866945acb587feb3e3a
SSDEEP 786432:aAQzEwHMwmfc3qibgAJgmCn+J8wO3m3DBja2hqgu2ulJnYUhXLKZKwfP:RQ7zo85gsOs97UfXLKZKO
TLSH
T130B723C795B6E6A4C4820464788201CB78C8E5DDD5ED8B292DCECC1276C4DBE68CE7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CREED.exe

File Explorer

CREED.exe

.exe 46.6MB

CREED.exe

IMPHASH 1f2444be510fdcb5c7a88f7a5de5c210
SHA256 ea53d3da9adad0a5f46d5c0a9bd18a844c09c2ec36c7c886cd93b2bfdb47b5fd
MD5 16b7f9bef4e52ff6fa49399ff527ee2a
SHA1 2a63391db805a3c5987b392a54fb02cc9616803c
SHA512 bca4423ab53dda655d96bc9db658e7a6fbb7371ffa4f8ccf4d21188e3963fcd41f39bf37c600a912e0540de5657c64824cba53c6eebbb866945acb587feb3e3a
SSDEEP 786432:aAQzEwHMwmfc3qibgAJgmCn+J8wO3m3DBja2hqgu2ulJnYUhXLKZKwfP:RQ7zo85gsOs97UfXLKZKO
TLSH
T130B723C795B6E6A4C4820464788201CB78C8E5DDD5ED8B292DCECC1276C4DBE68CE7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40190945

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

closesocket

kernel32

FormatMessageA GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

EnumWindows

gdi32

SetStretchBltMode

advapi32

RegCreateKeyExA

shell32

ShellExecuteA

ole32

CreateStreamOnHGlobal

msvcp140

?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

gdiplus

GdipGetImageEncodersSize

psapi

GetModuleInformation

iphlpapi

GetAdaptersInfo

shlwapi

StrCmpIW

ntdll

RtlCaptureContext

bcrypt

BCryptGenRandom

urlmon

URLDownloadToFileW

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_local_unwind

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_wsystem

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

wcspbrk

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

crypt32

CertFreeCertificateChain

Name

.text

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

309KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.x'M

Size

Virtual Size

35.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.3E)

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.X{g

Size

46.6MB

Virtual Size

46.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CREED.exe

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

gdiplus

psapi

iphlpapi

shlwapi

ntdll

bcrypt

urlmon

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

crypt32

generic