MetalWareCS2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MetalWareCS2.exe
Size 4.5MB
Sample260727-elscfsvxhs
SHA256 245b4815c72023cba6cc8d07176714706bdc3cd9ea7c539e1332c7fd4339e132
MD5 973fc8fc0e546297c79112b32a43cf38
SHA1 ddd8d04e445a73593918713527bdc7e1f00538a9
SHA512 7d58610a7ee564d36acec8b926c6e9e91d1009ab0d068273f2358ed2d36b758989b5962619486f517b45c28c4dba1b4df03be414201e0b74ec53a8dea177085b
SSDEEP 49152:DsBRe+SlwcD23bhYBpCpRF2kv66ZeGZ2K3ZX7S04cfRJds/5lKSzUmndSxe:o309bphkv66ZZ2K3jRbs/r8udS
TLSH
T1BF26AF47E39ADBAAE026543C8E01A007EEE1BC144779D6DBF7D19D09A6672D00F78F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MetalWareCS2.exe

File Explorer

MetalWareCS2.exe

.exe 4.5MB

MetalWareCS2.exe

IMPHASH 2e76eaab40be005b9012b2bda21671ca
SHA256 245b4815c72023cba6cc8d07176714706bdc3cd9ea7c539e1332c7fd4339e132
MD5 973fc8fc0e546297c79112b32a43cf38
SHA1 ddd8d04e445a73593918713527bdc7e1f00538a9
SHA512 7d58610a7ee564d36acec8b926c6e9e91d1009ab0d068273f2358ed2d36b758989b5962619486f517b45c28c4dba1b4df03be414201e0b74ec53a8dea177085b
SSDEEP 49152:DsBRe+SlwcD23bhYBpCpRF2kv66ZeGZ2K3ZX7S04cfRJds/5lKSzUmndSxe:o309bphkv66ZZ2K3jRbs/r8udS
TLSH
T1BF26AF47E39ADBAAE026543C8E01A007EEE1BC144779D6DBF7D19D09A6672D00F78F12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\metal\OneDrive\Desktop\MetalWareCS2-Internal-main\MetalWareCS2-Int+Inj\MMInjector\bin\x64\Release\MetalWareCS2.pdb

shell32

ShellExecuteW

kernel32

SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess SetConsoleScreenBufferSize GetStdHandle WriteConsoleA SetConsoleMode SetConsoleWindowInfo FindResourceA GetEnvironmentVariableA ReadConsoleA OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA Process32NextW GetCurrentThread LockResource Process32FirstW CloseHandle FreeConsole CreateThread LoadResource Module32FirstW GetThreadContext SizeofResource GetConsoleWindow Module32NextW CreateDirectoryA WriteConsoleInputA AllocConsole IsWow64Process IsDebuggerPresent CheckRemoteDebuggerPresent GetExitCodeProcess WriteProcessMemory RtlAddFunctionTable GetLastError LoadLibraryA VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx DeviceIoControl CreateFileA RtlCaptureContext GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetModuleFileNameA GetModuleHandleW ReleaseSRWLockExclusive RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId WakeAllConditionVariable AcquireSRWLockExclusive SleepConditionVariableSRW

user32

VkKeyScanA MessageBoxA

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __current_exception __current_exception_context memmove memcmp _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate strrchr __C_specific_handler memset

api-ms-win-crt-stdio-l1-1-0

fflush fclose fputc __p__commode _set_fmode fgetc fwrite __stdio_common_vfprintf __acrt_iob_func _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

isspace toupper _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_exit _configure_narrow_argv _cexit exit _initterm_e _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _seh_filter_exe _invoke_watson _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm _initialize_narrow_environment _c_exit _set_app_type

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale