q9mq4sn[.]exe | Triage™

General

Target
q9mq4sn.exe
Size 2.7MB
Sample260728-cbgrvswblc
SHA256 a48ed4349639c4b314d25901749ff0223feaaa821f01abe97b2a0397aac6b3bd
MD5 de2e4457765ed14cfc3f132ade889d7d
SHA1 075ff0b8849723beedff98378f6825f8d4c84c8c
SHA512 a436cfb3ea1a0e605b8624a810acfb985251f5a1306209c117cab39da1128357c10fd79395f039b6072c7b03f7851fc10ad6475600136ab4bd90be50c2cbb753
SSDEEP 49152:YoWUzyMWpqUcvj8VQTYvU4e+DGOA7MAu1wiSRev0zUrul3msE2qtNdtOcVsO8:wUztEt6jeQTYvU4e+al7emiSRGvutI27
TLSH
T185D523557657A9FDE913C03096415237BB32B48A1B23AAFF0A5406792F62AF10F3CE17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
q9mq4sn.exe

File Explorer

q9mq4sn.exe

.exe 2.7MB

q9mq4sn.exe

IMPHASH 2b67776705464e86a1e1c2557ba2f4bf
SHA256 a48ed4349639c4b314d25901749ff0223feaaa821f01abe97b2a0397aac6b3bd
MD5 de2e4457765ed14cfc3f132ade889d7d
SHA1 075ff0b8849723beedff98378f6825f8d4c84c8c
SHA512 a436cfb3ea1a0e605b8624a810acfb985251f5a1306209c117cab39da1128357c10fd79395f039b6072c7b03f7851fc10ad6475600136ab4bd90be50c2cbb753
SSDEEP 49152:YoWUzyMWpqUcvj8VQTYvU4e+DGOA7MAu1wiSRev0zUrul3msE2qtNdtOcVsO8:wUztEt6jeQTYvU4e+al7emiSRGvutI27
TLSH
T185D523557657A9FDE913C03096415237BB32B48A1B23AAFF0A5406792F62AF10F3CE17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

103512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cfgloader.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

IsDebuggerPresent CreateFileW GetProcessHeap HeapFree QueryPerformanceCounter GetTickCount GetSystemInfo CloseHandle VirtualAlloc VirtualProtect VirtualFree GetTickCount64 QueryPerformanceFrequency GetLastError GetModuleHandleA GetProcAddress AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetEnvironmentVariableW HeapAlloc GetModuleHandleW FormatMessageW CreateThread CreateWaitableTimerExW SetWaitableTimer Sleep ExitProcess SetFilePointerEx FlushFileBuffers HeapSize GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile GetModuleFileNameW TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW

ntdll

NtWriteFile RtlNtStatusToDosError

Sharing