234[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
234.exe
Size 1.4MB
Sample260727-ebenlsgn81
SHA256 cb22ecf141895afa986c898edd2961d8ddbbd8f4515cd8bb48e36a93d582dd81
MD5 603c906ec78696432246cff6f1f54422
SHA1 a3834604f63f9696b1151c10c785650fe705f7a4
SHA512 745a7b7695eccb1a1a35b36fd45f1b651416ade1c283db9183c9c107c638643d6776612b8a9c560d67e911945380bc1fd79888b014cac4930530164369bbc29a
SSDEEP 24576:4sn+WMSDlfDCtQvbsfHOSeGpHMQzhI4TFHF92hSelWb:9nPMGWteGpsQzWiBoSel
TLSH
T1C2659C16E3D812ACE527E638CA619332E67178464371EACF0B98D6591F73ED06B3B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
234.exe

File Explorer

234.exe

.exe 1.4MB

234.exe

IMPHASH 801c5f9b0970bce33d5f7bd4c1a61ee7
SHA256 cb22ecf141895afa986c898edd2961d8ddbbd8f4515cd8bb48e36a93d582dd81
MD5 603c906ec78696432246cff6f1f54422
SHA1 a3834604f63f9696b1151c10c785650fe705f7a4
SHA512 745a7b7695eccb1a1a35b36fd45f1b651416ade1c283db9183c9c107c638643d6776612b8a9c560d67e911945380bc1fd79888b014cac4930530164369bbc29a
SSDEEP 24576:4sn+WMSDlfDCtQvbsfHOSeGpHMQzhI4TFHF92hSelWb:9nPMGWteGpsQzWiBoSel
TLSH
T1C2659C16E3D812ACE527E638CA619332E67178464371EACF0B98D6591F73ED06B3B311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

921116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Mesho\AppData\Local\Temp\JhnmExe_e2b14374\bin\Release\net9.0\win-x64\native\payload.pdb

advapi32

DeregisterEventSource RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

TlsFree TlsSetValue CloseHandle CompareStringEx CompareStringOrdinal CreateEventExW CreateMutexExW CreateRemoteThread DuplicateHandle EnumCalendarInfoExEx EnumTimeFormatsEx ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNLSStringEx FindStringOrdinal FormatMessageW FreeLibrary GetCalendarInfoEx GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetFileAttributesExW GetFullPathNameW GetLastError GetLocaleInfoEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetProcAddress GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation GetUserPreferredUILanguages IsDebuggerPresent LCMapStringEx LoadLibraryExW LocalFree LocaleNameToLCID MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ResolveLocaleName SetEvent SetLastError SetThreadErrorMode Sleep SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualAllocEx VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile WriteProcessMemory FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime DeleteCriticalSection EnterCriticalSection InitializeCriticalSectionEx LeaveCriticalSection ResetEvent SleepEx DebugBreak InitializeCriticalSection WaitForSingleObject GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoTaskMemFree CoTaskMemAlloc CoInitializeEx CoGetApartmentType CoUninitialize CoWaitForMultipleHandles

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc malloc free

api-ms-win-crt-math-l1-1-0

modf __setusermatherr

api-ms-win-crt-string-l1-1-0

strlen strcmp _stricmp wcsncmp strncpy_s strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _crt_atexit terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv abort __p___argc _exit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vfprintf __stdio_common_vsprintf_s __p__commode __stdio_common_vsscanf __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale