radium[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
radium.exe
Size 6.4MB
Sample260804-24alpazyev
SHA256 abee49edd45e0fc0329f1d4e75f30064fc619dab042c8f47e8a8d2155f80590f
MD5 84641504ddd1b9251ca4330b24697a02
SHA1 7ca1fbd33109dec32d6a81eeb18f8c2c280833fe
SHA512 3fe25452b043a5ae859125913e255e1eb213546c783112caf1d82270f3e5ad9a8f70d06c3de005522579b8980d74e7c5b8816df65a1ac3731053b9a60a4d7e04
SSDEEP 98304:5lgKwcIOPfHxem+xdDbHcXka+XDQJNQFaVF65N2EO9RxV8jK:5lc2Mm+x5unJN5j6b2zRx
TLSH
T1F266AD0EF2A341E8C607C87C82369A62A929784D8B54DAEB739D95247FD77D04F39F04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
radium.exe

File Explorer

radium.exe

.exe 6.4MB

radium.exe

IMPHASH 6caf17e818b28c507789538c4949606a
SHA256 abee49edd45e0fc0329f1d4e75f30064fc619dab042c8f47e8a8d2155f80590f
MD5 84641504ddd1b9251ca4330b24697a02
SHA1 7ca1fbd33109dec32d6a81eeb18f8c2c280833fe
SHA512 3fe25452b043a5ae859125913e255e1eb213546c783112caf1d82270f3e5ad9a8f70d06c3de005522579b8980d74e7c5b8816df65a1ac3731053b9a60a4d7e04
SSDEEP 98304:5lgKwcIOPfHxem+xdDbHcXka+XDQJNQFaVF65N2EO9RxV8jK:5lc2Mm+x5unJN5j6b2zRx
TLSH
T1F266AD0EF2A341E8C607C87C82369A62A929784D8B54DAEB739D95247FD77D04F39F04
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4035936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CloseHandle CloseThreadpoolWork CompareStringW CreateDirectoryW CreateEventExW CreateFileMappingW CreateFileW CreateMutexExW CreateSemaphoreExW CreateThread CreateThreadpoolWork DebugBreak DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTimeZoneInformation GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock InterlockedPushEntrySList IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MapViewOfFile MultiByteToWideChar OpenSemaphoreW OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableA SetFilePointerEx SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SubmitThreadpoolWork TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

DragQueryFileW SHCreateItemFromParsingName SHGetFolderPathW ShellExecuteW

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop

user32

AdjustWindowRect ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DisplayConfigGetDeviceInfo EmptyClipboard GetCapture GetClientRect GetClipboardData GetCursorPos GetDisplayConfigBufferSizes GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetMonitorInfoW GetParent GetWindow GetWindowLongPtrW GetWindowPlacement GetWindowRect IsWindowUnicode LoadCursorW LoadIconW MonitorFromWindow OpenClipboard PeekMessageW PostQuitMessage QueryDisplayConfig RegisterClassExW ReleaseCapture ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetWindowLongPtrW SetWindowPlacement SetWindowPos SetWindowTextW ShowWindow TrackMouseEvent TranslateMessage UpdateWindow

dxgi

CreateDXGIFactory2

d3d12

ord101 D3D12SerializeVersionedRootSignature

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

593B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

402KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

radium.exe

kernel32

shell32

ole32

user32

dxgi

d3d12

imm32

generic