Nobodies[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nobodies.exe
Size 3.0MB
Sample260727-wwdeqabl3x
SHA256 6e15711255f34b10efbc7d0ac236c464265d546aa3b2a56e710f0701d727da3f
MD5 ca1a024bfd7304ac9c37c23efa9da4bc
SHA1 9c77127cdfd9761e4e00dd3d9765c00a10fa098c
SHA512 62ccacd982f57478d3208f23c3c5562f43dfb532a442a16eabbe6aa4a677b6a2959047865af95e5ad890c3a4f5ae55c471464dad9c428c8cfffa8d59c90864ea
SSDEEP 49152:KOWeB2TqEihkfSvjamebhC+M3Lv/cbcOc4zn88PB3HFvdCZjgvySeyrNbZZpn5Bs:0zfCccOM0CZjgvySeyrNbZvnnk
TLSH
T142E5BE8777A501ECC16BC178C24B9607E67234490331AAEF37EDC6652F63BE05A7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nobodies.exe

File Explorer

Nobodies.exe

.exe 3.0MB

Nobodies.exe

IMPHASH 42925cc99cb3b73f51ae8370a4ecfe53
SHA256 6e15711255f34b10efbc7d0ac236c464265d546aa3b2a56e710f0701d727da3f
MD5 ca1a024bfd7304ac9c37c23efa9da4bc
SHA1 9c77127cdfd9761e4e00dd3d9765c00a10fa098c
SHA512 62ccacd982f57478d3208f23c3c5562f43dfb532a442a16eabbe6aa4a677b6a2959047865af95e5ad890c3a4f5ae55c471464dad9c428c8cfffa8d59c90864ea
SSDEEP 49152:KOWeB2TqEihkfSvjamebhC+M3Lv/cbcOc4zn88PB3HFvdCZjgvySeyrNbZZpn5Bs:0zfCccOM0CZjgvySeyrNbZvnnk
TLSH
T142E5BE8777A501ECC16BC178C24B9607E67234490331AAEF37EDC6652F63BE05A7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1918724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\m_ssa\Downloads\Lumen\Source\build\Nobodies.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

HeapDestroy AddVectoredExceptionHandler GetLastError CreateFileW GetSystemDirectoryW LoadLibraryW SleepEx GetSystemInfo GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerifyVersionInfoW FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess CreateThread VirtualProtect SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx SleepConditionVariableSRW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW CreateFileMappingW GetModuleFileNameA GetModuleFileNameW GetModuleHandleW QueryFullProcessImageNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap HeapFree HeapReAlloc HeapAlloc ReadFile GetFileSizeEx CreateFileA GetExitCodeProcess CloseHandle Process32Next CreateToolhelp32Snapshot OpenProcess Module32First GetProcessId Module32Next Process32First AllocConsole GetConsoleWindow SetConsoleTitleA GlobalFindAtomA GetConsoleMode Sleep SetConsoleMode GetStdHandle QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA LocalFree GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree HeapSize GlobalAlloc MultiByteToWideChar LeaveCriticalSection

user32

SetForegroundWindow BringWindowToTop IsWindow EnumWindows FindWindowA SetWindowLongA UpdateWindow RegisterClassExA GetKeyNameTextA PostQuitMessage GetCursorPos GetAsyncKeyState MapVirtualKeyA TranslateMessage GetKeyState GetMessageExtraInfo LoadCursorA GetWindowThreadProcessId SendInput PeekMessageA DispatchMessageA SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow OpenClipboard GetWindowRect DestroyWindow GetSystemMetrics SetWindowDisplayAffinity GetKeyboardLayout MessageBoxA DefWindowProcA TrackMouseEvent CreateWindowExA SetLayeredWindowAttributes CloseClipboard EmptyClipboard ClientToScreen GetClipboardData SetClipboardData GetCapture ShowWindow ScreenToClient

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteA

msvcp140

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??Bios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z _Cnd_signal ?_Xinvalid_argument@std@@YAXPEBD@Z _Cnd_wait ?_Random_device@std@@YAIXZ ??7ios_base@std@@QEBA_NXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Mtx_unlock _Query_perf_counter _Mtx_lock _Query_perf_frequency ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?rdstate@ios_base@std@@QEBAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z _Thrd_detach _Xtime_get_ticks ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryDataAvailable

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertOpenStore CertFindExtension CryptDecodeObjectEx CertAddCertificateContextToStore CertEnumCertificatesInStore PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore

ws2_32

__WSAFDIsSet setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt WSAIoctl select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname socket

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception wcschr _CxxThrowException memcmp memchr memset memmove memcpy longjmp strrchr __std_exception_destroy strchr strstr __std_terminate __std_exception_copy

api-ms-win-crt-heap-l1-1-0

free _callnewh calloc _set_new_mode malloc realloc

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _invalid_parameter_noinfo_noreturn terminate __sys_nerr system _beginthreadex __sys_errlist exit abort _invalid_parameter_noinfo _resetstkoflw _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _errno

api-ms-win-crt-math-l1-1-0

_dsign __setusermatherr _dclass _fdopen _ldsign _fdclass _ldclass acosf asinf atan2f nearbyint _fdsign fmodf log logf pow powf roundf sin cos

api-ms-win-crt-stdio-l1-1-0

_lseeki64 fwrite _wfopen __stdio_common_vsprintf _wopen fread __stdio_common_vsscanf fputs __stdio_common_vsprintf_s ftell fseek _read _write fgets _fileno fputc _fwrite_nolock _popen _pclose _close __p__commode fclose fgetc fflush freopen_s _set_fmode fgetpos feof _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf __acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp _stricmp strncpy_s _strdup wcsncpy strncpy strpbrk _wcsdup strcpy_s strcspn strncmp wcspbrk strspn wcsncmp tolower

api-ms-win-crt-convert-l1-1-0

strtoll strtoull atoi strtof strtol strtoul strtod wcstombs atof

api-ms-win-crt-time-l1-1-0

_localtime64_s _localtime64 strftime _time64 _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _wstat64 _fstat64 remove _unlink _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv

advapi32

AddAccessAllowedAce CopySid ConvertSidToStringSidA OpenProcessToken CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash SystemFunction036 CryptDestroyKey CryptImportKey CryptEncrypt RegDeleteKeyA RegCreateKeyExA IsValidSid InitializeAcl GetTokenInformation GetLengthSid SetSecurityInfo

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

675KB

Virtual Size

675KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

410KB

Virtual Size

419KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Nobodies.exe

d3d11

kernel32

user32

shell32

msvcp140

imm32

d3dcompiler_47

dwmapi

winhttp

crypt32

ws2_32

shlwapi

psapi

userenv

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

advapi32

generic