𝐒𝐄𝐓𝐔𝐏[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
𝐒𝐄𝐓𝐔𝐏.exe
Size 1.1MB
Sample260804-yhr23adj5w
SHA256 67d1aeae3da2eea072c9f6bec6693a26c797ca372a2c6f2e58b804d9a063f7f8
MD5 eb310863c1235677d04d6038d03a917c
SHA1 98037984692f5f92651b7009ee0573900ba6a654
SHA512 d422225c6413933825d23e6347691d5ee222bb91b11f7977da75e3d78bb1439ee19dfbad82a01ae0a8544b30f97a2785f7632b738f924e99429ec42275321498
SSDEEP 24576:dkrxVZpgaFsx7MmMKsmsCMmM7mMCsmswVMmMCsmsasmsCMmMKsmsCMmMigsaVCsx:RzskS
TLSH
T185359E26B26C41E4D166D1BC89960506F7F37C4613329FDB47A0AE9A1F17AF0AE7F210
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
𝐒𝐄𝐓𝐔𝐏.exe

File Explorer

𝐒𝐄𝐓𝐔𝐏.exe

.exe 1.1MB

𝐒𝐄𝐓𝐔𝐏.exe

IMPHASH 853a8c2cca7aee080da03665735756a7
SHA256 67d1aeae3da2eea072c9f6bec6693a26c797ca372a2c6f2e58b804d9a063f7f8
MD5 eb310863c1235677d04d6038d03a917c
SHA1 98037984692f5f92651b7009ee0573900ba6a654
SHA512 d422225c6413933825d23e6347691d5ee222bb91b11f7977da75e3d78bb1439ee19dfbad82a01ae0a8544b30f97a2785f7632b738f924e99429ec42275321498
SSDEEP 24576:dkrxVZpgaFsx7MmMKsmsCMmM7mMCsmswVMmMCsmsasmsCMmMKsmsCMmMigsaVCsx:RzskS
TLSH
T185359E26B26C41E4D166D1BC89960506F7F37C4613329FDB47A0AE9A1F17AF0AE7F210
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

670112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\AppData\Local\Temp\2\9b875d1a-9a5b-4717-87e2-10f2d72a3463\Vorishka.pdb

kernel32

CopyFileExW SizeofResource ExpandEnvironmentStringsW EnumResourceNamesW GetTempPathW EndUpdateResourceW LockResource DeleteFileW EnumResourceLanguagesW FindResourceExW LoadResource UpdateResourceW MoveFileExW FreeLibrary BeginUpdateResourceW GetTempFileNameW LoadLibraryExW SetLastError GetFileAttributesA GetLogicalDrives GetSystemDefaultLocaleName GetSystemInfo GetLastError WideCharToMultiByte GetComputerNameA RemoveDirectoryW SetFileAttributesW CreateDirectoryA GetEnvironmentVariableW WriteProcessMemory SuspendThread ResumeThread Sleep GetThreadContext CreateDirectoryW ReadProcessMemory CreateProcessW VirtualFreeEx SetThreadContext GetProcessTimes FormatMessageA CreateProcessA SetEndOfFile WriteConsoleW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP CreateFileW WriteFile FindFirstFileExW GetFileSizeEx GlobalMemoryStatusEx ReadFile GetExitCodeProcess CloseHandle OpenProcess WaitForSingleObject TerminateProcess GetCurrentProcess LocalFree GetFileAttributesW FindClose FindNextFileW IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect HeapQueryInformation HeapSize UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext VirtualAllocEx FindFirstFileW HeapReAlloc HeapAlloc HeapFree GetStdHandle GetModuleFileNameW GetProcAddress ExitProcess IsProcessorFeaturePresent RtlUnwind FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RaiseException MultiByteToWideChar WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetLogicalProcessorInformationEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive RtlPcToFileHeader

user32

EnumDisplayDevicesW GetMonitorInfoW EnumDisplayMonitors GetDC ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject BitBlt

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA CryptAcquireContextA CryptGenRandom RegEnumKeyExW RegOpenKeyExW RegQueryValueExW CryptReleaseContext

shell32

SHGetKnownFolderPath ShellExecuteW SHGetFolderPathW

ole32

CoSetProxyBlanket CoUninitialize CoTaskMemFree CoCreateInstance CoInitializeEx

oleaut32

SysFreeString VariantClear SysAllocString VariantInit

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDecrypt BCryptGenerateSymmetricKey BCryptDestroyKey

shlwapi

PathFindExtensionW

crypt32

CryptUnprotectData

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

rstrtmgr

RmStartSession RmGetList RmRegisterResources RmEndSession

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpConnect WinHttpReadData

gdiplus

GdiplusShutdown GdiplusStartup GdipSaveImageToFile GdipGetImageEncoders GdipCloneImage GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipFree GdipAlloc GdipDisposeImage

ws2_32

ioctlsocket htons connect socket send setsockopt shutdown WSACleanup closesocket select WSAGetLastError inet_pton WSAStartup

Name

.text

Size

861KB

Virtual Size

860KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

𝐒𝐄𝐓𝐔𝐏.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

bcrypt

shlwapi

crypt32

rpcrt4

rstrtmgr

winhttp

gdiplus

ws2_32

generic