Indra X[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Indra X.exe
Size 2.9MB
Sample260728-1lwwjaythx
SHA256 4237bc8de5f500c6413b794e984a9a7c0ea29e37f92f186918f309c4ec7fba20
MD5 a5e538772b75c4f6fd36af09f6f7de2e
SHA1 46c444d2b0af240461a6448cd429e37f46eb375c
SHA512 c5bb955bdd2a1ff739acb72bf67af1d99fe9d3e568be2c1b9990c94d80b09dbd40e204ca04561e2e8274644728b569ef7bdb42247965f9d4a6caabdc492ebc82
SSDEEP 49152:M84GFE8be8jrsq4LL8lGVPb5K52L330vFuI7FNMm+RRnXR:2l6lGK2L330vFuI7FNM3F
TLSH
T13CD57C06B66490A8D066E078CD5AD8C7DA72FC481B7147EB72E4F77E1F326F05A3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Indra X.exe

File Explorer

Indra X.exe

.exe 2.9MB

Indra X.exe

IMPHASH 1bbd29654b2c3eb0c54d21d49851dd22
SHA256 4237bc8de5f500c6413b794e984a9a7c0ea29e37f92f186918f309c4ec7fba20
MD5 a5e538772b75c4f6fd36af09f6f7de2e
SHA1 46c444d2b0af240461a6448cd429e37f46eb375c
SHA512 c5bb955bdd2a1ff739acb72bf67af1d99fe9d3e568be2c1b9990c94d80b09dbd40e204ca04561e2e8274644728b569ef7bdb42247965f9d4a6caabdc492ebc82
SSDEEP 49152:M84GFE8be8jrsq4LL8lGVPb5K52L330vFuI7FNMm+RRnXR:2l6lGK2L330vFuI7FNM3F
TLSH
T13CD57C06B66490A8D066E078CD5AD8C7DA72FC481B7147EB72E4F77E1F326F05A3A601
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1595792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

LoadIconA AnimateWindow SendMessageA PeekMessageA CreateWindowExA DefWindowProcA DestroyIcon GetClientRect TranslateMessage GetSystemMetrics ScreenToClient GetDC DestroyWindow LoadCursorA DispatchMessageA LoadImageA SendInput BeginPaint DrawIconEx InvalidateRect LoadImageW SetForegroundWindow ReleaseCapture UpdateWindow PtInRect DrawTextW SetCursor SetFocus SetLayeredWindowAttributes UnhookWindowsHookEx MessageBoxA SetWindowDisplayAffinity RegisterClassW SetWindowsHookExA ClientToScreen GetMonitorInfoW PostThreadMessageA GetCursorInfo GetCapture GetAsyncKeyState IsWindow ShowWindow RegisterClassExW UnregisterClassA PostQuitMessage RegisterClassExA ReleaseDC GetCursorPos EndPaint SetClassLongPtrW DefWindowProcW GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture IsWindowUnicode SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetMessageA GetMessagePos PostMessageW SetProcessDpiAwarenessContext SetWindowPos SetWindowRgn EnumDisplayMonitors FillRect CreateWindowExW CallNextHookEx UnregisterClassW SetWindowTextW

gdi32

CreateCompatibleDC BitBlt CreateCompatibleBitmap CreateFontW GetStockObject CreateRoundRectRgn GetDeviceCaps TextOutW GetTextExtentPoint32W SetTextColor SetBkMode CreatePen CreateSolidBrush RoundRect SelectObject CreateDIBSection DeleteDC DeleteObject

shell32

ShellExecuteA ShellExecuteW SHGetPathFromIDListW SHBrowseForFolderW SetCurrentProcessExplicitAppUserModelID

comdlg32

GetOpenFileNameW

winmm

timeEndPeriod timeBeginPeriod

dwmapi

DwmSetWindowAttribute

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

advapi32

SetSecurityInfo CryptReleaseContext CredDeleteW RegDeleteValueA CryptGetHashParam RegOpenKeyExA CryptDestroyHash CryptHashData CryptCreateHash RegQueryValueExA GetCurrentHwProfileA RegCloseKey CryptAcquireContextA OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation IsValidSid CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptAcquireContextW RegDeleteKeyA RegCreateKeyExA InitializeAcl

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptUnprotectData CertFreeCertificateChainEngine

ws2_32

WSAEventSelect WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup bind connect getsockname htons recv WSAEnumNetworkEvents socket WSAIoctl __WSAFDIsSet select accept htonl listen getpeername WSAResetEvent recvfrom sendto ioctlsocket WSACreateEvent gethostname WSACloseEvent inet_ntop inet_pton freeaddrinfo getaddrinfo ntohl send setsockopt getsockopt

msvcp140

_Thrd_join ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Xtime_get_ticks ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ _Query_perf_counter ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ??7ios_base@std@@QEBA_NXZ _Thrd_detach ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Random_device@std@@YAIXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Cnd_do_broadcast_at_thread_exit ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Mtx_unlock _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_id

kernel32

MoveFileExW WaitForSingleObjectEx GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW SetLastError QueryFullProcessImageNameW AddDllDirectory GetModuleFileNameW UnmapViewOfFile MapViewOfFile FindNextFileW SetFileInformationByHandle VirtualProtect GetSystemDirectoryW CreateThread FormatMessageW DeleteCriticalSection InitializeCriticalSectionEx CreateFile2 AreFileApisANSI DeviceIoControl CopyFile2 CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW FormatMessageA GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleFileNameA GetCurrentProcess SetDllDirectoryW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx GetCurrentProcessId GetSystemInfo GetFileAttributesExW OutputDebugStringW GetFinalPathNameByHandleW CreatePipe CreateFileMappingW IsDebuggerPresent GetFullPathNameW AddVectoredExceptionHandler GetFileAttributesA CreateFileW FreeLibrary VerSetConditionMask GetProcAddress IsDBCSLeadByte LoadLibraryA GetLocaleInfoA GlobalUnlock GlobalLock GlobalFree GlobalAlloc OutputDebugStringA GetTickCount QueryPerformanceCounter WideCharToMultiByte GetModuleHandleW GetThreadId QueryPerformanceFrequency GetCurrentThread GetLastError GetTickCount64 MultiByteToWideChar GetCurrentThreadId CreateMutexA SetThreadPriority lstrcpynW lstrlenW FlushFileBuffers CreateDirectoryA LocalFree DeleteFileA CreateFileA MoveFileExA Sleep GetExitCodeProcess CreateProcessA FreeConsole CloseHandle SetProcessMitigationPolicy WaitForSingleObject GetEnvironmentVariableA SetErrorMode WriteFile TerminateProcess GetStdHandle SetDefaultDllDirectories SetHandleInformation GetModuleHandleA MoveFileA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __C_specific_handler wcschr strrchr memset memmove memcpy memcmp memchr _CxxThrowException strstr strchr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fclose _close _open_osfhandle _fileno fgets fputc _write fputs feof _read fflush fgetc _wopen fwrite __stdio_common_vsscanf _wfopen fgetpos setvbuf _lseeki64 ungetc __stdio_common_vfprintf fseek __acrt_iob_func ftell __p__commode fsetpos __stdio_common_vsprintf fread _fseeki64 __stdio_common_vswprintf_s _set_fmode _get_stream_buffer_pointers

api-ms-win-crt-math-l1-1-0

powf _fdopen sqrtf _dsign pow _dclass log sinf fmodf floorf cosf roundf __setusermatherr ceilf acosf logf

api-ms-win-crt-string-l1-1-0

isalnum isdigit _stricmp isspace wcsncpy strpbrk wcsncmp towlower strspn strncpy_s wcspbrk _strdup isxdigit strncmp strcspn _wcsdup strcmp strlen toupper tolower wcslen strncpy

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _errno _initterm _initterm_e _exit _cexit _c_exit _invoke_watson _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function terminate _beginthreadex abort _crt_atexit exit _initialize_narrow_environment __sys_nerr __sys_errlist

api-ms-win-crt-heap-l1-1-0

calloc free malloc _set_new_mode realloc _callnewh

api-ms-win-crt-convert-l1-1-0

strtof strtoull strtoll atoi strtoul strtod atof wcstombs strtol _strtoi64

api-ms-win-crt-time-l1-1-0

_time64 _localtime64 _localtime64_s strftime _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _unlink _fstat64 _wfullpath _wstat64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func