WardenLoader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WardenLoader.exe
Size 921KB
Sample260804-epxrcacf58
SHA256 08b00b05d177e806148f56a47c1e3e33417e8ce82e96059d98f464e6dcf6adf5
MD5 29499b7a801396bc39077e6b1eaf9e83
SHA1 1dccb0750796885eceef1b7923e9e4c812d2ecaf
SHA512 aba623db534167ec6839700331bd15e2ee7ecf25d70653f7da050349fcc3a4c16e4cb5ecc472c742158f8bd26eac10b8f36b05ec37b083e1d2cb62687247c17b
SSDEEP 24576:ZL/vI7lNv31UY5oOXRLlsQtiKnOc6tdzARToT/:ZL/Up3x5XXRpl8KnO/ttYToL
TLSH
T19415AC13F7A242EDC26A957C9147AB2BE7353C190710C6CF63E09E666FA76D00E7A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WardenLoader.exe

File Explorer

WardenLoader.exe

.exe 921KB

WardenLoader.exe

IMPHASH 7df5b5b77331bbc8568e9107661bee20
SHA256 08b00b05d177e806148f56a47c1e3e33417e8ce82e96059d98f464e6dcf6adf5
MD5 29499b7a801396bc39077e6b1eaf9e83
SHA1 1dccb0750796885eceef1b7923e9e4c812d2ecaf
SHA512 aba623db534167ec6839700331bd15e2ee7ecf25d70653f7da050349fcc3a4c16e4cb5ecc472c742158f8bd26eac10b8f36b05ec37b083e1d2cb62687247c17b
SSDEEP 24576:ZL/vI7lNv31UY5oOXRLlsQtiKnOc6tdzARToT/:ZL/Up3x5XXRpl8KnO/ttYToL
TLSH
T19415AC13F7A242EDC26A957C9147AB2BE7353C190710C6CF63E09E666FA76D00E7A350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511636

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders WinHttpSetOption WinHttpCrackUrl WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData

tbs

Tbsip_Submit_Command Tbsi_Context_Create Tbsip_Context_Close

shell32

ShellExecuteA

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData

kernel32

UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetFileInformationByHandleEx GetModuleHandleW AreFileApisANSI SetFileInformationByHandle GetModuleFileNameW CreateFileA ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe DisconnectNamedPipe Sleep WakeAllConditionVariable CreateNamedPipeA GetCurrentProcess GetSystemFirmwareTable WideCharToMultiByte GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA SleepConditionVariableSRW GetFileAttributesExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive GetVolumeInformationA IsDebuggerPresent GetStartupInfoW AcquireSRWLockExclusive GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime CreateProcessA InitializeSListHead

user32

ScreenToClient ClientToScreen SetCursor SetCursorPos GetForegroundWindow IsWindowUnicode GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard EnumDisplayDevicesA GetCursorPos GetWindowRect GetClientRect SetWindowRgn PeekMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetWindowPos SetCapture ReleaseCapture UpdateWindow TranslateMessage LoadCursorA SetProcessDPIAware DispatchMessageW

gdi32

DeleteObject CreateRoundRectRgn

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z ?fail@ios_base@std@@QEBA_NXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setf@ios_base@std@@QEAAHHH@Z ?setf@ios_base@std@@QEAAHH@Z ?_Random_device@std@@YAIXZ ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z _Thrd_join _Thrd_id _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?uncaught_exceptions@std@@YAHXZ _Xtime_get_ticks ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

vcruntime140

__current_exception_context __std_exception_copy __std_exception_destroy memcmp _CxxThrowException memchr __current_exception __C_specific_handler strstr memmove __std_terminate memset memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_errno _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback abort _invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc realloc free

api-ms-win-crt-convert-l1-1-0

strtol strtoull

api-ms-win-crt-stdio-l1-1-0

__p__commode ftell ferror feof _wfopen fopen_s ungetc setvbuf fwrite _fseeki64 fsetpos fread fputc fgetpos fgetc fflush fclose _get_stream_buffer_pointers _set_fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __acrt_iob_func fseek

api-ms-win-crt-math-l1-1-0

sinf fmodf pow __setusermatherr ldexp floorf cosf sqrtf acosf ceilf expf powf

api-ms-win-crt-string-l1-1-0

isalpha toupper tolower isdigit isalnum strncmp strcmp isspace

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

_mkgmtime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func