UserMode (4)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
UserMode (4).exe
Size 2.3MB
Sample260804-2mlmmazvbz
SHA256 aa3fd202c58db0e0c2ffce0906ecfe9b4efd802e5cde3b576b10f3e7afe3f2fd
MD5 ac9582bbacf44a2d6c7d90342c621872
SHA1 0bdd32f76d586bf956e56dba53189cc575330ec3
SHA512 85348b75b021b2ecba92f131ece723d573a2c8600ede64d512cf948d616661f2b4badaeb33e73ca4d22cc1b31801c9c468f058c90d43e00bbce1bf6b06ee465b
SSDEEP 24576:sHZZY/yrdsB402sTo41McI2uiQruwxF8ikBcWA4ko+gZ2rPgfGRp+WQOCPTuIaRl:bZNOigVhDv6s9KP8fZN7z/RN5lMFcn
TLSH
T103B58CE952AC01ECE166C138924A5207F7F3BC4D17A0DFFB26D04DA41F1B6D0BA3A695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UserMode (4).exe

File Explorer

UserMode (4).exe

.exe 2.3MB

UserMode (4).exe

IMPHASH cfb8eb223e29b13623efae891e67cf6a
SHA256 aa3fd202c58db0e0c2ffce0906ecfe9b4efd802e5cde3b576b10f3e7afe3f2fd
MD5 ac9582bbacf44a2d6c7d90342c621872
SHA1 0bdd32f76d586bf956e56dba53189cc575330ec3
SHA512 85348b75b021b2ecba92f131ece723d573a2c8600ede64d512cf948d616661f2b4badaeb33e73ca4d22cc1b31801c9c468f058c90d43e00bbce1bf6b06ee465b
SSDEEP 24576:sHZZY/yrdsB402sTo41McI2uiQruwxF8ikBcWA4ko+gZ2rPgfGRp+WQOCPTuIaRl:bZNOigVhDv6s9KP8fZN7z/RN5lMFcn
TLSH
T103B58CE952AC01ECE166C138924A5207F7F3BC4D17A0DFFB26D04DA41F1B6D0BA3A695
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2096368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\A\Desktop\UdWare\UserMode-Main\x64\Release\UserMode.pdb

kernel32

IsDebuggerPresent InitializeCriticalSectionEx DeleteCriticalSection SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW FreeLibrary LoadLibraryW SleepEx QueryPerformanceCounter MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetTickCount CreateProcessA GetConsoleWindow GetModuleHandleW GetCurrentProcessId GetProcAddress SetProcessDEPPolicy SetThreadIdealProcessor HeapSetInformation VerifyVersionInfoW GetFileSizeEx SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WakeAllConditionVariable GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW CreateThread SetProcessWorkingSetSizeEx CloseHandle Process32FirstW DeleteFileA LoadLibraryA GetCurrentThread CreateFileA Process32NextW GetLastError GetTempPathA CreateToolhelp32Snapshot GetModuleHandleA GetCurrentThreadId CreateFileW WaitForSingleObject SetThreadPriority CreateJobObjectW GetProcessAffinityMask TerminateProcess AssignProcessToJobObject DeviceIoControl SetProcessAffinityMask GetStdHandle GetCurrentProcess SetConsoleTitleA SetConsoleTextAttribute SetPriorityClass SetInformationJobObject SetThreadAffinityMask SetProcessPriorityBoost GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar Sleep

user32

DefWindowProcW GetKeyState GetWindow GetWindowRect DestroyWindow GetWindowThreadProcessId SetWindowPos SetWindowLongPtrW CreateWindowExW GetSystemMetrics RegisterClassExW ShowWindow GetWindowLongW GetAsyncKeyState DispatchMessageW GetWindowTextLengthW IsWindowVisible GetCursorPos InjectSyntheticPointerInput SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard UpdateWindow FindWindowA SetWindowLongW LoadCursorW FindWindowW TranslateMessage SetLayeredWindowAttributes EnumWindows GetForegroundWindow MessageBoxA SetWindowDisplayAffinity PeekMessageW

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CryptGetHashParam CryptAcquireContextW CryptReleaseContext

d3d9

Direct3DCreate9Ex

msvcp140

?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ _Thrd_yield _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod

ntdll

VerSetConditionMask RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

crypt32

CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW CertOpenStore PFXImportCertStore CertEnumCertificatesInStore CertFindExtension CryptDecodeObjectEx CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CertCloseStore

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents getsockopt closesocket WSAGetLastError inet_pton ntohs WSASetLastError inet_ntop bind connect getpeername getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname WSAEventSelect

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __current_exception_context __current_exception wcschr strrchr memset memmove strstr memcmp memchr _CxxThrowException __std_exception_copy __std_exception_destroy __std_terminate strchr memcpy

api-ms-win-crt-stdio-l1-1-0

setvbuf ungetc _read fsetpos _fseeki64 fgets _get_stream_buffer_pointers __p__commode fgetc __stdio_common_vsprintf_s _lseeki64 _fileno ftell __acrt_iob_func _wopen fflush fclose fgetpos _set_fmode fputc fseek fputs __stdio_common_vfprintf feof fwrite __stdio_common_vsscanf fread _close __stdio_common_vsprintf _wfopen _write

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp strcspn strspn _wcsicmp strncpy strcmp wcspbrk strpbrk wcsncpy _strdup strcpy_s wcsncmp

api-ms-win-crt-heap-l1-1-0

free malloc realloc calloc _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

atoi strtoll wcstombs strtol atof strtoul

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc exit _seh_filter_exe _invoke_watson abort _beginthreadex _set_app_type _exit __sys_nerr __sys_errlist _cexit _get_initial_narrow_environment _initterm _initterm_e system _configure_narrow_argv _initialize_narrow_environment _invalid_parameter_noinfo_noreturn terminate _crt_atexit _register_onexit_function _errno _initialize_onexit_table

api-ms-win-crt-math-l1-1-0

fmodf fmax pow logf cosf ceilf log sinf tanf __setusermatherr sqrt powf _fdopen acosf sqrtf asin atan atan2 atan2f

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlock_file _fstat64 _unlink _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64 strftime _gmtime64