ram_ui (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ram_ui (1).exe
Size 13.6MB
Sample260729-23ffjsvand
SHA256 f25a9d98c26930beeda3cf692ce18ea201414b4c4cc3094bd844470f91c797d7
MD5 e373182679d2ffbad015f122978271a5
SHA1 4f4500df40b52b62e8d80b0251177f55f319bf2a
SHA512 0de51f6e0b6ef55cd3ca7f9619d656e48af90c7866b2c0f0647dcd0e15c6fca55bcbfb12d165e1f025b5610d1d0ce63cb341a0f741052a613d785cc4d6eb209a
SSDEEP 98304:7niG9D9VmhTyl5YuD0dApvLUwEcz4/JaT+SsydAC+bytw+2wxx:7t9JVwdcLUwzgy+Cftn
TLSH
T131E65A22BB8A99ACC05AC47483468A735A3170CB0B35B9FF45D456393F6AAF45F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ram_ui (1).exe

File Explorer

ram_ui (1).exe

.exe 13.6MB

ram_ui (1).exe

IMPHASH 90643184781bc4b48cb0c95f0baec0b6
SHA256 f25a9d98c26930beeda3cf692ce18ea201414b4c4cc3094bd844470f91c797d7
MD5 e373182679d2ffbad015f122978271a5
SHA1 4f4500df40b52b62e8d80b0251177f55f319bf2a
SHA512 0de51f6e0b6ef55cd3ca7f9619d656e48af90c7866b2c0f0647dcd0e15c6fca55bcbfb12d165e1f025b5610d1d0ce63cb341a0f741052a613d785cc4d6eb209a
SSDEEP 98304:7niG9D9VmhTyl5YuD0dApvLUwEcz4/JaT+SsydAC+bytw+2wxx:7t9JVwdcLUwzgy+Cftn
TLSH
T131E65A22BB8A99ACC05AC47483468A735A3170CB0B35B9FF45D456393F6AAF45F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8770544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ram_ui.pdb

advapi32

SystemFunction036 GetTokenInformation OpenProcessToken CopySid IsValidSid CredDeleteW CredFree CredReadW CredWriteW RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW GetLengthSid RegGetValueW RegCloseKey RegQueryValueExW RegOpenKeyExW EventSetInformation EventWriteTransfer RevertToSelf ImpersonateAnonymousToken EventUnregister EventRegister

ntdll

NtOpenFile NtCreateNamedPipeFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtReadFile NtQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation RtlGetVersion NtCreateFile

kernel32

GetModuleHandleA OpenProcess CreateMutexW SetThreadStackGuarantee GetCurrentDirectoryW GetCommandLineW GetCurrentProcessId GetSystemInfo VirtualQueryEx GetProcessTimes LocalFree CopyFileExW FindFirstFileExW FindClose ReadFileEx CreateThread QueryPerformanceCounter GetExitCodeProcess GetSystemTimes GetProcessIoCounters ExitProcess CreateEventW WaitForSingleObject SwitchToThread WaitForSingleObjectEx QueryPerformanceFrequency SetNamedPipeHandleState HeapReAlloc SetFileTime SetFileInformationByHandle MoveFileExW GetFullPathNameW CreateMutexA ReleaseMutex DeleteFileW GetStdHandle GetConsoleMode WriteConsoleW GetConsoleOutputCP WaitForMultipleObjects FindNextFileW SleepEx GetFileAttributesW LoadLibraryA CreateFileW FlushFileBuffers FreeLibrary LoadLibraryExW HeapFree GetProcessHeap GetModuleFileNameW WriteFileEx OutputDebugStringW FreeEnvironmentStringsW OutputDebugStringA lstrlenW CompareStringOrdinal AddVectoredExceptionHandler GetProcAddress LoadLibraryW GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry FormatMessageW GetSystemTimePreciseAsFileTime SetWaitableTimer CreateWaitableTimerExW GetCurrentThread MultiByteToWideChar GlobalFree SetHandleInformation CancelIo WideCharToMultiByte GlobalSize GetFileInformationByHandleEx GlobalUnlock GetLastError GetFinalPathNameByHandleW SetLastError GlobalAlloc GlobalLock SetUnhandledExceptionFilter GetEnvironmentStringsW HeapAlloc GetSystemDirectoryW GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx LoadLibraryExA CreateDirectoryW SetFileCompletionNotificationModes LCIDToLocaleName GetUserDefaultUILanguage SetThreadErrorMode Sleep GetWindowsDirectoryW GetModuleHandleW CreateProcessW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId GetSystemTimeAsFileTime CloseHandle InitializeSListHead RtlVirtualUnwind GetEnvironmentVariableW ReadProcessMemory GetFileInformationByHandle

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

MonitorFromRect ReleaseDC GetSystemMetrics GetMonitorInfoW GetTouchInputInfo DestroyCursor CreateIconFromResourceEx DestroyWindow GetMessageW RemovePropW CallWindowProcW GetPropW IsIconic CloseClipboard EnumWindows GetUpdateRect ChangeDisplaySettingsExW MonitorFromWindow RegisterClipboardFormatW GetCursorPos ClientToScreen SetClipboardData GetClientRect GetWindowLongW ScreenToClient DefWindowProcW GetClipboardData OpenClipboard IsClipboardFormatAvailable RedrawWindow SetWindowPlacement PostThreadMessageW PostMessageW PeekMessageW TrackMouseEvent GetWindowPlacement SetWindowPos GetAsyncKeyState ValidateRect InvalidateRgn MapVirtualKeyExW GetKeyboardLayout DispatchMessageW TranslateMessage EmptyClipboard ToUnicodeEx GetKeyState MapVirtualKeyW LoadCursorW AdjustWindowRectEx FlashWindowEx GetMenu GetWindowRect IsWindowVisible SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor GetActiveWindow EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SendInput SetForegroundWindow GetWindowLongPtrW DestroyIcon GetRawInputData CloseTouchInputHandle SetWindowLongPtrW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetForegroundWindow SystemParametersInfoW FillRect IsProcessDPIAware GetDC RegisterWindowMessageA SendMessageW GetWindow SetFocus ShowWindow GetKeyboardState SetCursorPos GetClassInfoExW GetClassNameW MessageBoxW SetCursor EnumChildWindows DispatchMessageA GetMessageA RegisterClassExW CreateIcon GetWindowThreadProcessId RegisterTouchWindow IsWindow CreateWindowExW

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass

ole32

CoInitializeEx CoCreateFreeThreadedMarshaler OleInitialize CoTaskMemFree CoTaskMemAlloc RegisterDragDrop CoCreateInstance CoUninitialize RevokeDragDrop

gdi32

CreateRectRgn SwapBuffers ChoosePixelFormat DescribePixelFormat SetPixelFormat GetDeviceCaps DeleteObject CreateSolidBrush

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

SHCreateMemStream AssocQueryStringW

shell32

DragQueryFileW DragFinish SHAppBarMessage CommandLineToArgvW SHCreateItemFromParsingName

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmAssociateContextEx ImmSetCandidateWindow ImmGetCompositionStringW

oleaut32

SysFreeString SysStringLen VariantClear SafeArrayCreateVector SetErrorInfo GetErrorInfo SysAllocStringLen SafeArrayPutElement

ws2_32

freeaddrinfo WSACleanup closesocket select getaddrinfo WSAStartup getsockopt getsockname getpeername accept WSARecv recv WSASend send setsockopt ioctlsocket connect WSAIoctl WSASocketW bind listen shutdown WSADuplicateSocketW WSAGetLastError

secur32

AcquireCredentialsHandleA InitializeSecurityContextW FreeCredentialsHandle ApplyControlToken DecryptMessage QueryContextAttributesW DeleteSecurityContext FreeContextBuffer EncryptMessage AcceptSecurityContext

bcrypt

BCryptGenRandom

crypt32

CertDuplicateStore CertFreeCertificateContext CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertCloseStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertOpenStore

bcryptprimitives

ProcessPrng

pdh

PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

opengl32

wglCreateContext wglShareLists wglGetCurrentContext wglGetCurrentDC wglDeleteContext wglGetProcAddress wglMakeCurrent

uiautomationcore

UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaGetReservedNotSupportedValue UiaLookupId UiaHostProviderFromHwnd UiaReturnRawElementProvider

uxtheme

SetWindowTheme

vcruntime140

__std_exception_destroy __std_exception_copy __current_exception __current_exception_context memcmp memset __C_specific_handler _CxxThrowException _purecall wcsrchr memmove __CxxFrameHandler3 memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

expf sinf cos ceilf fmodf pow roundf ceil sin powf _hypotf log10 cosf __setusermatherr round floor fmod trunc floorf cbrtf atan2f acosf exp2f

api-ms-win-crt-string-l1-1-0

wcscmp wcslen strlen _wcsicmp

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _get_initial_narrow_environment _initialize_narrow_environment terminate _register_onexit_function strerror _configure_narrow_argv _initialize_onexit_table _initterm _initterm_e exit _exit _seh_filter_exe __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale