TrackCast[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
TrackCast.exe
Size 6.6MB
Sample260727-pm75eaba46
SHA256 35db67ed2432b822c688937dbf85487d38100098abc35d710afb6b7118f8defd
MD5 42f444d568ae9883f9d95d8e1e072d14
SHA1 9654ce058a457cc464680c2bb8be2febf018e461
SHA512 13c73c554465c127005e12b6065fc85329a79efbfb6cd41335dd3f17d34896025768ab5ff2bc912268f2c262e7e5ce9a6e8f36ba5831b7fda8a365d6d63a8c7c
SSDEEP 196608:WVnqGEz4VN27DSt3BBBBBBBbgBBBBBU2UBnq:WtqGbKEq
TLSH
T18A668D43B37A18D5C1AAC03D86469517E7B2785D0365DBDB19A087BE7F27AE00F7A320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TrackCast.exe

File Explorer

TrackCast.exe

.exe 6.6MB

TrackCast.exe

IMPHASH e68bd4d3f8e324bcf26d73bd3131daf6
SHA256 35db67ed2432b822c688937dbf85487d38100098abc35d710afb6b7118f8defd
MD5 42f444d568ae9883f9d95d8e1e072d14
SHA1 9654ce058a457cc464680c2bb8be2febf018e461
SHA512 13c73c554465c127005e12b6065fc85329a79efbfb6cd41335dd3f17d34896025768ab5ff2bc912268f2c262e7e5ce9a6e8f36ba5831b7fda8a365d6d63a8c7c
SSDEEP 196608:WVnqGEz4VN27DSt3BBBBBBBbgBBBBBU2UBnq:WtqGbKEq
TLSH
T18A668D43B37A18D5C1AAC03D86469517E7B2785D0365DBDB19A087BE7F27AE00F7A320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1944200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetThreadPriority SetFilePointer SetEndOfFile GetTempPathW CreateMutexW FindClose GetLocaleInfoW WaitForSingleObject GetFileAttributesW ReleaseMutex GetSystemDirectoryW ResumeThread DisconnectNamedPipe GetLogicalDriveStringsW Sleep GetFileInformationByHandle GetFileAttributesExW OutputDebugStringW GetLogicalProcessorInformation GetCurrentThread TerminateThread QueryPerformanceFrequency GetThreadPriority DeleteFileW GetNativeSystemInfo GetCurrentDirectoryW GetOverlappedResult ReplaceFileW GetModuleHandleW CopyFileW CreateFileMappingW QueryPerformanceCounter MoveFileW GetDriveTypeW IsDebuggerPresent ConnectNamedPipe SetUnhandledExceptionFilter FlushFileBuffers ResetEvent GetPriorityClass CompareStringOrdinal InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetTickCount64 SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize InitOnceComplete RemoveDirectoryW TerminateProcess GetFinalPathNameByHandleW GetModuleHandleExW WriteFile GetCurrentProcess FindNextFileW SetPriorityClass GetCurrentThreadId GetModuleHandleA FormatMessageW GetLastError GlobalSize LoadLibraryA GlobalAlloc GlobalFree LoadLibraryW GetProcAddress GlobalLock GetCurrentProcessId FreeLibrary GlobalUnlock WaitForMultipleObjects CreateEventW SetEvent CloseHandle ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateFileW GetModuleFileNameW UnmapViewOfFile DeleteCriticalSection MapViewOfFile GetCommandLineW AttachConsole LocalFree CreateDirectoryW SetThreadAffinityMask GetSystemFirmwareTable ReadFile TryEnterCriticalSection GetVolumeInformationW CancelIo FindFirstFileW

user32

GetWindowRect DestroyWindow SetWindowPos EnumChildWindows SetWindowLongPtrW GetWindowLongPtrW ShowWindow DestroyIcon SetFocus DefWindowProcW AttachThreadInput GetMessageW SendMessageTimeoutW DispatchMessageW SendNotifyMessageW GetWindowTextW GetWindowThreadProcessId GetSystemMenu GetMessageExtraInfo GetUpdateRgn GetMessagePos PostMessageW MapVirtualKeyW GetFocus GetDC IsWindowVisible GetDpiForWindow MonitorFromWindow ValidateRgn EnumDisplayMonitors CreateWindowExW GetIconInfo SendMessageW CallNextHookEx EndDialog UnregisterClassW SetWindowTextW RegisterClassExW WindowFromPoint GetWindowPlacement DestroyCursor GetKeyboardState SetCaretPos GetActiveWindow IsWindow GetAsyncKeyState OpenClipboard GetCapture RedrawWindow VkKeyScanW GetWindowInfo GetMonitorInfoW CreateIconIndirect ClientToScreen CloseClipboard EmptyClipboard PeekMessageW IsChild CreateCaret MapWindowPoints ValidateRect TrackMouseEvent GetForegroundWindow UnhookWindowsHookEx EnumWindows GetMessageTime SetLayeredWindowAttributes BringWindowToTop TranslateMessage GetClipboardData LoadIconW EnumDisplayDevicesW LoadCursorW DestroyCaret SetCapture SetWindowsHookExW SetClipboardData ToUnicode SetCursor GetSystemMetricsForDpi GetClientRect UpdateLayeredWindow DrawIconEx InvalidateRect SendInput EndPaint BeginPaint GetCursorPos ReleaseDC SetCursorPos GetAncestor ReleaseCapture GetParent SystemParametersInfoW EnableMenuItem EnumDisplaySettingsW GetDesktopWindow ShowCaret MessageBeep

gdi32

SetBrushOrgEx BitBlt SaveDC SelectObject CreateDIBSection CreateFontIndirectW SetMapperFlags StretchBlt StretchDIBits CreateRectRgnIndirect GetDeviceCaps CreateRectRgn DeleteDC GetRegionData GetObjectW ExcludeClipRect SetStretchBltMode RestoreDC DeleteObject SetMapMode CreateBitmap CombineRgn CreateCompatibleDC

shell32

SHGetSpecialFolderPathW Shell_NotifyIconW DragQueryFileW SHCreateShellItem SHGetMalloc ExtractAssociatedIconW SHBrowseForFolderW SHGetKnownFolderPath SHParseDisplayName SHGetPathFromIDListW ShellExecuteW

ole32

OleInitialize DoDragDrop CoInitialize PropVariantClear CoTaskMemFree RegisterDragDrop CoUninitialize CoTaskMemAlloc OleUninitialize RevokeDragDrop CoCreateInstance CoInitializeEx

oleaut32

SafeArrayDestroy SafeArrayPutElement SafeArrayUnaccessData SafeArrayCreateVector SafeArrayAccessData SysAllocString

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

OpenProcessToken AccessCheck MapGenericMask DuplicateToken GetNamedSecurityInfoW

msvcp140

_Query_perf_counter ?classic@locale@std@@SAAEBV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ _Query_perf_frequency _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit _Cnd_broadcast _Cnd_wait _Cnd_register_at_thread_exit ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_unregister_at_thread_exit ??0task_continuation_context@Concurrency@@AEAA@XZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z _Cnd_signal _Mtx_unlock _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_yield ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?good@ios_base@std@@QEBA_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z

wininet

FtpOpenFileW HttpQueryInfoW InternetSetFilePointer InternetCrackUrlW InternetWriteFile HttpEndRequestW HttpSendRequestExW InternetCloseHandle InternetConnectW InternetSetOptionW InternetReadFile HttpOpenRequestW InternetOpenW

ws2_32

setsockopt sendto __WSAFDIsSet accept freeaddrinfo htons htonl getsockopt recv inet_ntoa bind closesocket select getaddrinfo WSAStartup inet_addr send ioctlsocket

shlwapi

PathStripToRootW

winmm

midiInGetDevCapsW midiInPrepareHeader midiInClose midiInAddBuffer midiOutMessage midiInGetNumDevs midiOutShortMsg midiOutGetNumDevs midiOutLongMsg midiOutClose midiInStop midiInReset midiOutUnprepareHeader midiOutOpen midiOutPrepareHeader midiOutGetDevCapsW midiInOpen midiInUnprepareHeader midiInMessage timeSetEvent timeGetTime timeKillEvent midiInStart timeBeginPeriod

imm32

ImmAssociateContext ImmAssociateContextEx ImmIsUIMessageW ImmReleaseContext ImmGetContext ImmGetCompositionStringW ImmSetCandidateWindow ImmNotifyIME

comctl32

ord345

dwmapi

DwmExtendFrameIntoClientArea

d2d1

ord1

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __current_exception_context __current_exception memset memcpy memcmp memchr strchr strstr __C_specific_handler longjmp __RTtypeid __std_type_info_compare __std_exception_copy __std_exception_destroy __std_terminate _purecall __RTDynamicCast __intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free realloc malloc

api-ms-win-crt-runtime-l1-1-0

_errno abort exit _fpreset _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _beginthreadex _c_exit terminate _exit _initterm_e _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _initterm _cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _endthreadex

api-ms-win-crt-math-l1-1-0

powf pow logf log2 frexp sinf log10 log sqrt fmodf fmod floorf floor expf exp cos ceilf ceil atanf atan2f atan2 acos _hypotf _hypot sin sqrtf tan lround llround round __setusermatherr truncf tanf cosf ldexp

api-ms-win-crt-stdio-l1-1-0

fread fwrite _set_fmode __stdio_common_vfprintf __stdio_common_vsscanf __p__commode fclose fflush __acrt_iob_func fseek __stdio_common_vsprintf _fileno freopen_s __stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

strcmp towlower iswdigit towupper iswlower strnlen iswalnum strncpy strncmp iswupper iswalpha iswspace

api-ms-win-crt-convert-l1-1-0

_strtod_l _atoi64 atoi strtod mbstowcs

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_ftime64_s wcsftime _localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale _create_locale

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

216KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

TrackCast.exe

kernel32

user32

gdi32

shell32

ole32

oleaut32

comdlg32

advapi32

msvcp140

wininet

ws2_32

shlwapi

winmm

imm32

comctl32

dwmapi

d2d1

dxgi

d3d11

dcomp

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic