althea[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
althea.exe
Size 956KB
Sample260724-fr76jagm3x
SHA256 108627866ac7477d2f2f1ee3b8e9cc42be9355d182442450b82c42109e0af136
MD5 841e3b831cf07cb46221e5fe57f04d7c
SHA1 2cb103ce610aeb315058441511c6af1922e00d11
SHA512 a107add0b3d39818b9fe07caf2b5c763a68ada1382c06edece9240c9ded132b564866b26c94f26212ceaa932802a8de17e8313314d25b8fc38a41388eeb18cf0
SSDEEP 24576:bsMvgdzMYwiDfvr6gkeGHmsokwXHUDlJfZX/qXtQafuC+3003:bsegdzWOkINXHUDlJfZX/qXt2C+300
TLSH
T1C325AE5AA7A801ECC1BBD1BCC6578607E7B27049036097DF16E0C6A52F13BE56B3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
althea.exe

File Explorer

althea.exe

.exe 956KB

althea.exe

IMPHASH a035db5db9d33c5b0f896508507cee0d
SHA256 108627866ac7477d2f2f1ee3b8e9cc42be9355d182442450b82c42109e0af136
MD5 841e3b831cf07cb46221e5fe57f04d7c
SHA1 2cb103ce610aeb315058441511c6af1922e00d11
SHA512 a107add0b3d39818b9fe07caf2b5c763a68ada1382c06edece9240c9ded132b564866b26c94f26212ceaa932802a8de17e8313314d25b8fc38a41388eeb18cf0
SSDEEP 24576:bsMvgdzMYwiDfvr6gkeGHmsokwXHUDlJfZX/qXtQafuC+3003:bsegdzWOkINXHUDlJfZX/qXt2C+300
TLSH
T1C325AE5AA7A801ECC1BBD1BCC6578607E7B27049036097DF16E0C6A52F13BE56B3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

719024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\V24\Downloads\temp src\temp src\x64\Release\althea.pdb

kernel32

FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree QueryPerformanceFrequency GetSystemDirectoryW VirtualProtect FreeLibrary GetProcAddress LoadLibraryW SleepEx CreateThread GetSystemInfo QueryFullProcessImageNameW QueryPerformanceCounter GetTickCount MultiByteToWideChar WideCharToMultiByte MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerSetConditionMask VerifyVersionInfoW GetFileSizeEx FormatMessageA GetLocaleInfoEx DeleteCriticalSection SetLastError GetModuleHandleW GetModuleHandleA GetModuleFileNameW GetModuleFileNameA UnmapViewOfFile MapViewOfFile GetCurrentProcess CreateFileMappingW SleepConditionVariableSRW GetCurrentThreadId GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW GetFileAttributesExW SetFileInformationByHandle InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy AddVectoredExceptionHandler GetLastError CloseHandle CreateFileW Sleep GetStdHandle SetConsoleTitleA OutputDebugStringW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime SetUnhandledExceptionFilter WakeAllConditionVariable GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetConsoleTextAttribute

user32

EnumWindows GetWindowTextW MessageBoxA

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantClear

msvcp140

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Xbad_function_call@std@@YAXXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??1_Lockit@std@@QEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_frequency _Query_perf_counter _Xtime_get_ticks ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ

crypt32

CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertGetNameStringW CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore PFXImportCertStore CertFreeCertificateChain CryptQueryObject

ws2_32

recv setsockopt socket WSAIoctl __WSAFDIsSet htons getpeername htonl listen getaddrinfo freeaddrinfo select sendto ioctlsocket gethostname connect bind WSACleanup getsockname WSAStartup inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt accept recvfrom

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr __current_exception_context strrchr strchr memset memmove wcschr __C_specific_handler memcmp memchr _CxxThrowException __std_terminate __std_exception_copy __std_exception_destroy memcpy __current_exception

api-ms-win-crt-runtime-l1-1-0

exit _set_app_type _configure_narrow_argv system __sys_errlist __sys_nerr terminate _invalid_parameter_noinfo_noreturn _errno abort _cexit _seh_filter_exe _crt_atexit _invalid_parameter_noinfo _beginthreadex _get_initial_narrow_environment _initterm _resetstkoflw _initterm_e _exit _register_onexit_function __p___argc _initialize_onexit_table _initialize_narrow_environment _register_thread_local_exe_atexit_callback _c_exit __p___argv

api-ms-win-crt-string-l1-1-0

strlen _wcsdup towlower _strdup wcsncpy strpbrk wcsncmp tolower strcmp strspn wcspbrk wcslen strncmp strcspn

api-ms-win-crt-filesystem-l1-1-0

_unlink _fstat64 _wstat64 _unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

_dsign _fdopen __setusermatherr

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free calloc _callnewh malloc

api-ms-win-crt-convert-l1-1-0

strtoul strtoll wcstombs atoi strtod strtol strtoull

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

_set_fmode _read _write _fileno _close __acrt_iob_func __stdio_common_vsprintf ungetc setvbuf _popen _pclose fwrite _fseeki64 fsetpos _get_stream_buffer_pointers fclose fflush fgetc fgetpos fgets _lseeki64 fputs feof fputc fseek __p__commode _wfopen _wopen ftell __stdio_common_vsscanf fread

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64 _gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort

advapi32

ConvertSidToStringSidA CryptEncrypt CryptDestroyKey SystemFunction036 CryptDestroyHash CopySid SetSecurityInfo RegDeleteKeyA RegCreateKeyExA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash IsValidSid InitializeAcl GetTokenInformation GetLengthSid AddAccessAllowedAce CryptHashData OpenProcessToken CryptImportKey

shell32

ShellExecuteA