Usermode Injector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Usermode Injector.exe
Size 34KB
Sample260804-nsxp7aygkf
SHA256 c065c4a5174b1fad1deca1998f7a6d39322702d30e4683be3180c2f989b3ce8a
MD5 7f3103a03704ce8176989c341c067124
SHA1 42a7c012bb7a55a302ae7be50db6b5c43beeb426
SHA512 51090ce0155e77f7b9fbd9ae4de25d2f580406a03fd923fcc24ac6cb39d16fc70935b95e9903bd468dfe566308cfdcb833ebae7e7d14309721e4cb963f508b43
SSDEEP 768:JcMYSzA+OCLxDPoaaI1kFvMteLnnPpJYTzn3BZfqf:DYSzhPrHkFvRYzRZf
TLSH
T177F23A2B276700E4C5FA92FC8597274AEAB27C111711A3CF53B1814A0F667E0B97BE61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Usermode Injector.exe

File Explorer

Usermode Injector.exe

.exe 34KB

Usermode Injector.exe

IMPHASH 8eb2e48f2e9f4f109341091f0e195677
SHA256 c065c4a5174b1fad1deca1998f7a6d39322702d30e4683be3180c2f989b3ce8a
MD5 7f3103a03704ce8176989c341c067124
SHA1 42a7c012bb7a55a302ae7be50db6b5c43beeb426
SHA512 51090ce0155e77f7b9fbd9ae4de25d2f580406a03fd923fcc24ac6cb39d16fc70935b95e9903bd468dfe566308cfdcb833ebae7e7d14309721e4cb963f508b43
SSDEEP 768:JcMYSzA+OCLxDPoaaI1kFvMteLnnPpJYTzn3BZfqf:DYSzhPrHkFvRYzRZf
TLSH
T177F23A2B276700E4C5FA92FC8597274AEAB27C111711A3CF53B1814A0F667E0B97BE61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\Usermode Injector\x64\Release\Usermode Injector.pdb

kernel32

GetProcAddress VirtualAllocEx CreateRemoteThread CloseHandle RtlLookupFunctionEntry GetModuleHandleW IsDebuggerPresent Process32FirstW Process32NextW GetLastError Sleep CreateToolhelp32Snapshot OpenProcess GetModuleHandleA WaitForSingleObject VirtualFreeEx WriteProcessMemory RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext

advapi32

RegCloseKey AllocateAndInitializeSid RegSetValueExA FreeSid CheckTokenMembership RegOpenKeyExA RegOpenKeyExW RegDeleteValueA RegQueryValueExW

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memmove memset __current_exception _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler __current_exception_context

api-ms-win-crt-stdio-l1-1-0

fflush fclose __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fputc

api-ms-win-crt-string-l1-1-0

_wcsicmp tolower

api-ms-win-crt-runtime-l1-1-0

_exit exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _configure_narrow_argv _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn system _get_initial_narrow_environment

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale