potato[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
potato.exe
Size 1.4MB
Sample260728-ccec5ahn3v
SHA256 85181246483047792c1fea02474eac891278ba2666184541160fa37db68d1188
MD5 98349dea9a4703b75fb314f05cde6f0c
SHA1 bd480c7398246eb634390d04ea8a3a72bbac55a4
SHA512 277f974810663fcf1ac6d63a16ac86d05e90c96eb41cee45e9166feff968ed850d90fed27aace3fc648045612486994aeb8b1d52257360d72e6f8ec7be7cca45
SSDEEP 24576:p+YmY1nfl5d9Id2iqywIiyn769aagTl4PmUIgi7yEB5ZjG9XkMUz:MYxrd9Id2iJwVynoaplG5fEB5ZKujz
TLSH
T14265BE03F3A283ACD41669394793D726B3377C442B12D1CBB3A426588BA76F41EB76C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
potato.exe

File Explorer

potato.exe

.exe 1.4MB

potato.exe

IMPHASH ff30527194fbd90e17bf5309b5467013
SHA256 85181246483047792c1fea02474eac891278ba2666184541160fa37db68d1188
MD5 98349dea9a4703b75fb314f05cde6f0c
SHA1 bd480c7398246eb634390d04ea8a3a72bbac55a4
SHA512 277f974810663fcf1ac6d63a16ac86d05e90c96eb41cee45e9166feff968ed850d90fed27aace3fc648045612486994aeb8b1d52257360d72e6f8ec7be7cca45
SSDEEP 24576:p+YmY1nfl5d9Id2iqywIiyn769aagTl4PmUIgi7yEB5ZjG9XkMUz:MYxrd9Id2iJwVynoaplG5fEB5ZKujz
TLSH
T14265BE03F3A283ACD41669394793D726B3377C442B12D1CBB3A426588BA76F41EB76C5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

447992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

shell32

SHGetFolderPathA ShellExecuteW

kernel32

CloseHandle GetProcessHeap GetExitCodeProcess GetTickCount ReadProcessMemory WriteProcessMemory GetModuleHandleA SetConsoleTitleA GetLastError OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW OutputDebugStringA AcquireSRWLockExclusive GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetModuleHandleW ReleaseSRWLockExclusive GetCurrentProcessId GetCurrentThreadId IsDebuggerPresent WakeAllConditionVariable SleepConditionVariableSRW GlobalAlloc SetUnhandledExceptionFilter GetSystemTimeAsFileTime Module32NextW InitializeSListHead

user32

SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient LoadCursorA TranslateMessage ReleaseCapture SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData OpenClipboard FindWindowA SetWindowLongPtrA GetWindowLongPtrA GetWindowRect GetClientRect SetForegroundWindow UpdateWindow mouse_event GetAsyncKeyState SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow GetForegroundWindow IsWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA CloseClipboard IsWindowUnicode

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?setf@ios_base@std@@QEAAHHH@Z ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

vcruntime140

_CxxThrowException memcpy memmove memset __std_terminate memchr memcmp __C_specific_handler __current_exception __current_exception_context strchr __std_exception_copy __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-convert-l1-1-0

atoi atof

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fopen_s fclose fflush _set_fmode __acrt_iob_func _wfopen fread fseek __stdio_common_vsscanf __stdio_common_vsprintf __p__commode ftell fopen fgets fwrite

api-ms-win-crt-filesystem-l1-1-0

_mkdir

api-ms-win-crt-math-l1-1-0

floorf sinf sqrtf __setusermatherr ceilf pow cosf logf log acosf atan2f fmodf powf _fdclass

api-ms-win-crt-string-l1-1-0

strcmp strlen strncpy strncmp wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe terminate _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _initterm _cexit _set_app_type _get_initial_narrow_environment

api-ms-win-crt-locale-l1-1-0

_configthreadlocale