starter[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
starter.exe
Size 10.9MB
Sample260802-wzw18sek21
SHA256 c21fbd78f62e71fb88e29cc1ee619e393210c2b2a5268bc96f2090051cedd51e
MD5 08b30db5a8cde3551e063527aee7a24c
SHA1 3a2728276c86508f5f13bb0c5ac0c72e691e5b0a
SHA512 d5504391c1b57092cfd35882b7d8b601e80de56c9ed6a4af79733f3d37bca2ff51e16f234e74caff381e5f245c34a1098109611dd0739b212e36ac8b2a43e367
SSDEEP 196608:iIcbzPh++6Bd+e4jSFLNrKYKeLmwXVTJWLtWgkzSNNdfSiZ+PPqCbBbmd:i5YoSdN4eLvUAgkzSpTZiPlBbc
TLSH
T1FDB633EB5327015EC99B05771EF22366B05463F3C6E15DE7C2AEC6AB1B3A2E2134051E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
starter.exe
unpack001/$PLUGINSDIR/inetc.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

starter.exe

.exe 10.9MB
$PLUGINSDIR/idman641build3.exe

.exe 10.8MB
$PLUGINSDIR/inetc.dll

.dll 22KB

starter.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 c21fbd78f62e71fb88e29cc1ee619e393210c2b2a5268bc96f2090051cedd51e
MD5 08b30db5a8cde3551e063527aee7a24c
SHA1 3a2728276c86508f5f13bb0c5ac0c72e691e5b0a
SHA512 d5504391c1b57092cfd35882b7d8b601e80de56c9ed6a4af79733f3d37bca2ff51e16f234e74caff381e5f245c34a1098109611dd0739b212e36ac8b2a43e367
SSDEEP 196608:iIcbzPh++6Bd+e4jSFLNrKYKeLmwXVTJWLtWgkzSNNdfSiZ+PPqCbBbmd:i5YoSdN4eLvUAgkzSpTZiPlBbc
TLSH
T1FDB633EB5327015EC99B05771EF22366B05463F3C6E15DE7C2AEC6AB1B3A2E2134051E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/idman641build3.exe

IMPHASH bf33765b3ad3b105c0b29bcf6093d0c2
SHA256 e3f599ddfddd248d8c94dd88297b69166860c722b9a2b1e6fdc40c34ff367ab0
MD5 d82cd880f4ab8a8e574c1cc049c99304
SHA1 390579e601945cbbd122dc1aefba1b94e1efee2c
SHA512 18c2481255b237c3c73d8b0105ba32a41659fcf3c85f5174ea8f6808dde11fe057591513f4a3add2667f6d461ecd9a66c14e5baa2fdef87c6cfec817606d4b66
SSDEEP 196608:UYq5pjxAwA/THcNwTAlAWzN+PpC6UQJlU/rnsfx+KNZeYez8aQHD2peix:UTtxAwAb8NwT1I+Z7inI+sZh/HKpR
TLSH
T121B6335A91B5CF48F5FC187898B8D5B91D2E6C81DA4503E37BB97CBA78B854BC04303A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

0b:b5:4b:78:09:5b:b0:1f:f0:36:a3:7c:bc:1d:02:22:69:c4:7d:d5:50:a3:df:95:e7:ca:ef:c0:d3:cf:38:3d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Chains

Oct 3, 2022

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Tonec Inc.,O=Tonec Inc.,L=New York,ST=New York,C=US

Serial Number

0b:59:29:2a:8c:f6:59:10:78:c9:29:d5:ba:55:a7:f6

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2022 - Aug 6, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

17126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv _wsplitpath __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit free calloc memcpy _except_handler3 memchr memcmp _itoa strlen ??2@YAPAXI@Z ??3@YAXPAX@Z wcsstr strstr wcschr wcslen wcscat memset wcsncpy __CxxFrameHandler wcscpy

kernel32

GetStartupInfoA GetFileSize CreateFileMappingA GetFileTime SetFileTime MapViewOfFile ExitThread UnmapViewOfFile FormatMessageA CreateFileW SetFilePointer WriteFile lstrlenA LocalFree GetCurrentProcess WaitForSingleObject GetExitCodeThread GetModuleFileNameW CreateProcessW CloseHandle CreateMutexA ExitProcess GetTempPathW GetFileAttributesW CreateDirectoryW CreateThread LoadLibraryA FreeLibrary GetModuleHandleA GetDiskFreeSpaceW GetProcAddress GetLastError

user32

SetForegroundWindow ShowWindow FindWindowA wsprintfA DestroyWindow MessageBoxA SetWindowTextA SendMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfW PostQuitMessage CreateDialogParamA

advapi32

RegDeleteValueW RegQueryValueExW RegOpenKeyExA RegCloseKey

shell32

SHGetPathFromIDListW SHBrowseForFolderW

$PLUGINSDIR/inetc.dll

IMPHASH 2e4d94706c699d2da474aa823430b9a5
SHA256 89e24e4124b607f3f98e4df508c4ddd2701d8f7fcf1dc6e2aba11d56c97c0c5a
MD5 cab75d596adf6bac4ba6a8374dd71de9
SHA1 fb90d4f13331d0c9275fa815937a4ff22ead6fa3
SHA512 510786599289c8793526969cfe0a96e049436d40809c1c351642b2c67d5fb2394cb20887010727a5da35c52a20c5557ad940967053b1b59ad91ca1307208c391
SSDEEP 384:PWc7V9H6MVsnCPFN4DC5/kdhdj/ouVj19L0d10Ac9khYLMkIX0+GbyeEaI2sJ:PWqTH/V7tHSWutp
TLSH
T19BA2E6124A600AF7E3B90534B0AB37530769EE72646565D786F32AC93874393FF36722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetErrorDlg HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetOptionA InternetQueryOptionA InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA

comctl32

ord17

kernel32

GlobalFree GlobalAlloc WideCharToMultiByte LoadLibraryA lstrlenA lstrcatA lstrcpyA lstrcmpiA MulDiv LocalFree LocalAlloc GetProcAddress GetModuleHandleA GetTickCount TerminateThread CreateThread SleepEx lstrcmpA lstrcpynA CreateFileA DeleteFileA GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SendDlgItemMessageA SetTimer KillTimer EnableWindow UpdateWindow RedrawWindow SetWindowTextA GetWindowTextA GetClientRect GetWindowRect MessageBoxA GetWindowLongA SetWindowLongA GetParent FindWindowExA LoadIconA IsDialogMessageA SystemParametersInfoA SetDlgItemTextA wsprintfA GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA IsWindow DestroyWindow ShowWindow SetWindowPos IsWindowVisible CreateDialogParamA GetDlgItem

starter.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/idman641build3.exe

msvcrt

kernel32

user32

advapi32

shell32

generic

$PLUGINSDIR/inetc.dll

wininet

comctl32

kernel32

user32

generic