mod-manager-v2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mod-manager-v2.exe
Size 18.8MB
Sample260803-spnekatyet
SHA256 b358acfa275e4e3df9f8588c2c106b3dc94d98acf75779e6391c328abf310d16
MD5 a49b8253a2b51a442a22871332495b1b
SHA1 7562db99a26de6e0b47cdd79a1ca5392346aaa56
SHA512 ee3edc53cafc4468d2ad52be3e0b118c7f2b0c71cf992f299ad470bd79a3eb65b14d0126a2997528d13e4231089c81e3de180f0f01caa32cf58cae97c3decd3d
SSDEEP 196608:txyatNZYDitAAmpVOz2A6gjzhjgNHFNWZ/Vy5SZIPtKT/Z:TPZYDitAAmpVOz2AHjBg9FNqVy0IPts
TLSH
T1B1172815AA9B98ACD49BC4B483478A725A3034CF0B3579BF45C492383F6DBF46F28719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mod-manager-v2.exe

File Explorer

mod-manager-v2.exe

.exe 18.8MB

mod-manager-v2.exe

IMPHASH 64d257c8979381a35c2461c71519fb10
SHA256 b358acfa275e4e3df9f8588c2c106b3dc94d98acf75779e6391c328abf310d16
MD5 a49b8253a2b51a442a22871332495b1b
SHA1 7562db99a26de6e0b47cdd79a1ca5392346aaa56
SHA512 ee3edc53cafc4468d2ad52be3e0b118c7f2b0c71cf992f299ad470bd79a3eb65b14d0126a2997528d13e4231089c81e3de180f0f01caa32cf58cae97c3decd3d
SSDEEP 196608:txyatNZYDitAAmpVOz2A6gjzhjgNHFNWZ/Vy5SZIPtKT/Z:TPZYDitAAmpVOz2AHjBg9FNqVy0IPts
TLSH
T1B1172815AA9B98ACD49BC4B483478A725A3034CF0B3579BF45C492383F6DBF46F28719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14142504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mod_manager_v2.pdb

bcryptprimitives

ProcessPrng

advapi32

EventRegister RegGetValueW RegOpenKeyExW EventSetInformation EventWriteTransfer RegQueryValueExW EventUnregister RegCloseKey

ntdll

NtWriteFile NtOpenFile NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError RtlGetVersion

kernel32

WakeAllConditionVariable AcquireSRWLockExclusive GetSystemInfo FlsGetValue FlsAlloc FlsSetValue FlsFree EncodePointer InitializeSListHead GetModuleHandleW SetUnhandledExceptionFilter ReleaseSRWLockExclusive FindNextFileW GetTempPathW GetCurrentThreadId WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeleteFileW lstrlenW GetUserDefaultUILanguage DeviceIoControl LCIDToLocaleName GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess FindClose FindFirstFileExW RaiseException RemoveDirectoryW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler LoadLibraryA GetStdHandle GetExitCodeProcess LoadLibraryW RtlPcToFileHeader CreateProcessW GetWindowsDirectoryW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW RtlUnwindEx FreeLibrary GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess GetOverlappedResult ReadFile ReadFileEx GetCurrentProcessId CreateEventW CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle MoveFileExW GetFullPathNameW CopyFileExW SetLastError SleepConditionVariableSRW SleepEx WriteFileEx FreeEnvironmentStringsW LoadLibraryExA WaitForSingleObject HeapAlloc DeleteCriticalSection CompareStringOrdinal GetEnvironmentVariableW GetModuleHandleA Sleep GetProcAddress FormatMessageW CloseHandle GetFileAttributesW GetFileInformationByHandle GetConsoleMode InitializeCriticalSectionEx CreateFileW CreateDirectoryW

shell32

SetCurrentProcessExplicitAppUserModelID SHCreateItemFromParsingName ILCreateFromPathW ILFree DragFinish SHOpenFolderAndSelectItems ShellExecuteExW SHGetKnownFolderPath ShellExecuteW DragQueryFileW SHAppBarMessage

user32

DestroyMenu PeekMessageW DrawIconEx CheckMenuItem GetMenuItemInfoW RemoveMenu CreatePopupMenu CreateMenu SetMenu DrawMenuBar SetMenuItemInfoW PostThreadMessageW DefWindowProcW CreateWindowExW AppendMenuW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable CreateIcon GetAsyncKeyState GetKeyboardState MapVirtualKeyExW ToUnicodeEx GetKeyState SetWindowTextW GetWindowTextW GetWindowTextLengthW RegisterClassExW SendInput SetForegroundWindow GetRawInputData GetKeyboardLayout EnumDisplayMonitors GetMessageW GetMenu IsWindowVisible SetWindowDisplayAffinity GetWindowLongW DispatchMessageW SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu GetClientRect ClientToScreen DestroyWindow ClipCursor GetClipCursor ShowCursor DestroyIcon GetMenuBarInfo RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx OffsetRect GetWindowDC RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC IsProcessDPIAware GetDC GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled DrawTextW IsIconic RedrawWindow SendMessageW PostMessageW EnumChildWindows TranslateMessage DispatchMessageA GetMessageA MonitorFromPoint TranslateAcceleratorW AdjustWindowRect SetWindowPos GetForegroundWindow ScreenToClient GetCursorPos RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos MonitorFromWindow InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor LoadCursorW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetSystemMetrics GetMonitorInfoW MonitorFromRect

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

ole32

CoCreateFreeThreadedMarshaler RevokeDragDrop CoCreateInstance OleInitialize RegisterDragDrop CoTaskMemFree CoUninitialize CoInitialize CoTaskMemAlloc CoInitializeEx

gdi32

CombineRgn BitBlt SetTextColor SetBkMode CreateRectRgn DeleteObject GetDeviceCaps CreateDIBSection SelectObject CreateCompatibleDC DeleteDC CreateSolidBrush

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shlwapi

SHCreateMemStream

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

api-ms-win-crt-math-l1-1-0

truncf trunc powf floorf floor ceil cosf logf exp log2 fma __setusermatherr log2f pow fmaf round roundf

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table terminate _seh_filter_exe _set_app_type _wassert _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv abort _initialize_narrow_environment _exit exit _initterm_e _initterm _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode puts

api-ms-win-crt-string-l1-1-0

strcpy_s wcscmp _wcsicmp wcslen

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc malloc _callnewh _set_new_mode free

msvcp140

?_Xlength_error@std@@YAXPEBD@Z