xds[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
xds.exe
Size 130KB
Sample260806-c78v8axtby
SHA256 198de860b8063227606068c677bbde173670cc1aff572b3352ea2b7de0045a89
MD5 a95fb39d233ab563477ce8a29ce83875
SHA1 7600283d2db3d445c66690d3f41f63522a6cf4c3
SHA512 82e0001899c7cf7c8b04dc0936a3df7b2796229599165008d193b89a3f054f74c3657e9ec1431bc4227c59882346a76738f33068b0175631843194692fc04a0c
SSDEEP 3072:55tLbZU6fc7ES9oXx0kep12dh3E3py92oJ:PtLbZU6f2oe8wy9fJ
TLSH
T169D32A2BBA5910BDE1A98678CE874942FB737849035667EF079049B24F279D0FF39702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xds.exe

File Explorer

xds.exe

.exe 130KB

xds.exe

IMPHASH dbea34bebbac9b910be4fd21fc577171
SHA256 198de860b8063227606068c677bbde173670cc1aff572b3352ea2b7de0045a89
MD5 a95fb39d233ab563477ce8a29ce83875
SHA1 7600283d2db3d445c66690d3f41f63522a6cf4c3
SHA512 82e0001899c7cf7c8b04dc0936a3df7b2796229599165008d193b89a3f054f74c3657e9ec1431bc4227c59882346a76738f33068b0175631843194692fc04a0c
SSDEEP 3072:55tLbZU6fc7ES9oXx0kep12dh3E3py92oJ:PtLbZU6f2oe8wy9fJ
TLSH
T169D32A2BBA5910BDE1A98678CE874942FB737849035667EF079049B24F279D0FF39702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rivator\Desktop\any thing\Malware delivry chain\RIvex-C2\bin\Release\rivex-client.pdb

ws2_32

ioctlsocket freeaddrinfo htons inet_ntop getsockopt recv setsockopt socket send WSAStartup getaddrinfo select closesocket WSACleanup connect WSAGetLastError

user32

CreateWindowExA DefWindowProcA RegisterClassA DispatchMessageW ShowWindow GetMessageW TranslateMessage GetCursorPos GetSystemMetrics

bcrypt

BCryptGenRandom BCryptEncrypt BCryptDestroyKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey

shell32

ShellExecuteExW SHGetFolderPathA

advapi32

AllocateAndInitializeSid RegOpenKeyExA RegCreateKeyExA RegSetValueExA AdjustTokenPrivileges RegCloseKey RegQueryValueExA GetTokenInformation LookupPrivilegeValueA GetUserNameA OpenProcessToken FreeSid CheckTokenMembership

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize

oleaut32

SysAllocString VariantClear SysFreeString

kernel32

GetTempPathA SetFileTime GetModuleHandleW VirtualAlloc VirtualFree CheckRemoteDebuggerPresent IsDebuggerPresent MapViewOfFile GetDiskFreeSpaceExA GetFileAttributesA GlobalMemoryStatusEx CreateFileMappingA SetFileAttributesA GetSystemInfo LoadLibraryA GetSystemDirectoryA UnmapViewOfFile VirtualProtect GetExitCodeProcess SetUnhandledExceptionFilter SystemTimeToFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetComputerNameA GetTickCount WideCharToMultiByte CloseHandle SetThreadContext CreateDirectoryA CreateProcessA CreateProcessW GetCurrentProcessId ReadFile GetModuleFileNameA SetConsoleCtrlHandler WriteProcessMemory SetHandleInformation FindFirstFileA GetCurrentProcess WriteFile TerminateProcess GetModuleFileNameW SetProcessShutdownParameters FindNextFileA CreatePipe ExpandEnvironmentStringsA FindClose CreateMutexA WaitForSingleObject GetSystemDirectoryW GetCurrentDirectoryA ResumeThread GetModuleHandleA OpenProcess SetCurrentDirectoryA CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTickCount64 CopyFileA GetLastError Process32NextW MoveFileExA CreateFileA DeleteFileA Process32FirstW ExitProcess CreateThread GetThreadContext GetProcAddress VirtualAllocEx GetFileSize

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??Bios_base@std@@QEBA_NXZ

iphlpapi

GetAdaptersInfo

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception memset memcpy strchr __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy memcmp _CxxThrowException memmove

api-ms-win-crt-runtime-l1-1-0

_exit exit _cexit _c_exit _invoke_watson _crt_atexit _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv set_terminate _register_onexit_function terminate _register_thread_local_exe_atexit_callback _initialize_onexit_table _initterm_e _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_fseeki64 __stdio_common_vsscanf fread fsetpos fputc _get_stream_buffer_pointers fgetpos _set_fmode __stdio_common_vsprintf fwrite fflush fgetc setvbuf __p__commode fclose ungetc

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _mktime64 _difftime64

api-ms-win-crt-string-l1-1-0

_wcsicmp strncpy wcscat_s isdigit tolower wcscpy_s _stricmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rivex

Size

1024B

Virtual Size

697B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

xds.exe

ws2_32

user32

bcrypt

shell32

advapi32

ole32

oleaut32

kernel32

msvcp140

iphlpapi

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic