Water[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Water.exe
Size 3.8MB
Sample260724-rnfgwsfm5v
SHA256 b1e851995b51ecba62470603251f4d8cd798197919584b6cebfc9250435844f5
MD5 50e8b84f178b56f644f196f37d717246
SHA1 3c59da3ed2802f66c6f71d55f7022673fe13f085
SHA512 20f7fd53157f8aa090fc9d5b1f749eeec013878dbb9625f3f85d07fdb0be4eb51338f8843a836e8d4ad44afc25aa45c2e960aa5b89009e0d898d7272638ad505
SSDEEP 49152:HeXd+LIdWlyOQ270XNziEflgWX7zsQtDJg0DG5kTuup0sq42IsQ8kPI+6MG5+:n10XNJX/JgqLMIsQ8kPuv+
TLSH
T1A706C006A26521E9C56AD1788A4B9607E736304507306BEB77A4F79B1FE37F00EBB701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Water.exe

File Explorer

Water.exe

.exe 3.8MB

Water.exe

IMPHASH e2143647540b1ef44d0a2f7bca34dd9c
SHA256 b1e851995b51ecba62470603251f4d8cd798197919584b6cebfc9250435844f5
MD5 50e8b84f178b56f644f196f37d717246
SHA1 3c59da3ed2802f66c6f71d55f7022673fe13f085
SHA512 20f7fd53157f8aa090fc9d5b1f749eeec013878dbb9625f3f85d07fdb0be4eb51338f8843a836e8d4ad44afc25aa45c2e960aa5b89009e0d898d7272638ad505
SSDEEP 49152:HeXd+LIdWlyOQ270XNziEflgWX7zsQtDJg0DG5kTuup0sq42IsQ8kPI+6MG5+:n10XNJX/JgqLMIsQ8kPuv+
TLSH
T1A706C006A26521E9C56AD1788A4B9607E736304507306BEB77A4F79B1FE37F00EBB701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1747968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute DwmEnableBlurBehindWindow

winhttp

WinHttpConnect WinHttpSetOption WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpCrackUrl

wininet

InternetOpenUrlA InternetOpenA InternetGetCookieA InternetCloseHandle InternetReadFile

d3dcompiler_47

D3DCompile

kernel32

FindClose CreateMutexA GetVolumeInformationA WaitForSingleObject GetCurrentThreadId GetCurrentDirectoryA GetModuleHandleA OpenProcess SetCurrentDirectoryA CreateToolhelp32Snapshot Sleep GetTempPathA GetTickCount64 CopyFileA GetLastError GetFileAttributesA Process32NextW CreateFileA GetCurrentThread LockResource QueryPerformanceFrequency DeleteFileA DeleteFileW Process32FirstW CloseHandle GetNativeSystemInfo FreeConsole GetSystemInfo LoadResource FindResourceW SetFileAttributesA SwitchToThread GetProcAddress GlobalLock LocalFree MoveFileExW GetFileSize ExitProcess ReadProcessMemory GetCurrentProcessId GlobalMemoryStatusEx GetTempPathW GetModuleHandleW CopyFileW WideCharToMultiByte QueryFullProcessImageNameW CreateProcessA TerminateProcess QueryPerformanceCounter GlobalUnlock IsDebuggerPresent VirtualQueryEx GetComputerNameA CheckRemoteDebuggerPresent VirtualFree VirtualAlloc ExpandEnvironmentStringsA VirtualAllocEx MultiByteToWideChar GlobalAlloc GlobalFree GetLocaleInfoA LoadLibraryA FreeLibrary GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA SetFilePointerEx GetFileType LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID CreateProcessW GetEnvironmentVariableW WriteFile GetCurrentProcess GetCommandLineW VirtualProtect EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile FindFirstFileA SetHandleInformation SizeofResource GetModuleFileNameA ReadFile GetCommandLineA CreatePipe SetThreadPriority FindNextFileA Module32FirstW GetModuleFileNameW RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree RtlUnwind CreateThread ExitThread FreeLibraryAndExitThread SetEvent CreateEventW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter CreateDirectoryA GetStdHandle

user32

SetWindowDisplayAffinity SetCursor SetWindowLongW GetWindowTextW GetWindowThreadProcessId DefWindowProcW PostMessageW GetWindow GetWindowRect SetCursorPos DestroyWindow GetWindowTextLengthW IsWindowVisible SetWindowPos SetWindowLongPtrW FillRect CreateWindowExW ScreenToClient SendMessageW CallNextHookEx GetSystemMetrics UnregisterClassW ReleaseCapture GetWindowLongPtrW GetWindowLongW GetKeyNameTextA SetClipboardData GetDC RegisterClassExW ShowWindow IsWindow GetAsyncKeyState OpenClipboard IsWindowUnicode SetCapture GetMessageExtraInfo EmptyClipboard DispatchMessageW CloseClipboard ExitWindowsEx PeekMessageW MapVirtualKeyA MessageBoxA BlockInput GetForegroundWindow UnhookWindowsHookEx EnumWindows SetLayeredWindowAttributes TranslateMessage GetClipboardData FindWindowW GetCapture LoadCursorW SetWindowsHookExW SystemParametersInfoA GetClientRect ClientToScreen TrackMouseEvent MsgWaitForMultipleObjects DrawTextW PostQuitMessage UpdateWindow SetForegroundWindow InvalidateRect GetAncestor ReleaseDC GetCursorPos BeginPaint EndPaint ToAscii SendInput GetKeyboardLayout GetKeyState

gdi32

CreateCompatibleBitmap SelectObject CreateRectRgn CreateCompatibleDC CreateFontW GetDIBits CreateDIBSection BitBlt DeleteDC SetTextColor SetBkMode LineTo CreatePen MoveToEx DeleteObject CreateSolidBrush RoundRect

advapi32

RegDeleteValueA RegOpenKeyExA OpenProcessToken RegSetValueExA GetUserNameA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey GetCurrentHwProfileA CredEnumerateA RegCreateKeyExA CredFree GetTokenInformation

shell32

ShellExecuteA CommandLineToArgvW ShellExecuteW

ole32

CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoCreateFreeThreadedMarshaler

oleaut32

SetErrorInfo VariantInit SysFreeString SysStringLen SysAllocString VariantClear GetErrorInfo

bcrypt

BCryptFinishHash BCryptDestroyKey BCryptGetProperty BCryptVerifySignature BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptCreateHash

msimg32

AlphaBlend

crypt32

CryptProtectData CryptUnprotectData CryptStringToBinaryA

winmm

timeEndPeriod timeBeginPeriod

iphlpapi

GetAdaptersInfo

gdiplus

GdipCloneImage GdipCreateBitmapFromStream GdiplusShutdown GdiplusStartup GdipAlloc GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveImageToStream

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx FormatMessageA GetCPInfo LCMapStringEx

api-ms-win-core-file-l1-1-0

FindFirstFileExW CreateDirectoryW FindFirstFileW SetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared EnterCriticalSection WaitForSingleObjectEx LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetExitCodeThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter RaiseException

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns SubmitThreadpoolWork CreateThreadpoolWork CloseThreadpoolWork

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

CompareStringEx GetStringTypeW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

560KB

Virtual Size

560KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1024B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Water.exe

d3d11

dwmapi

winhttp

wininet

d3dcompiler_47

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

bcrypt

msimg32

crypt32

winmm

iphlpapi

gdiplus

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-interlocked-l1-1-0

imm32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic