catalyst[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
catalyst.exe
Size 1.8MB
Sample260806-d5m2eaff25
SHA256 4e1f13789bc4e58f935961ec65cf79f752cf198c556de92a66f54f5e5b0c3c90
MD5 c6d11eb901223feb34a7610e0326fe22
SHA1 f9ea90bcaba918ab7ef2d38c4dd1883a8f8ae0d0
SHA512 dba25044c42b003efd46761208f412e406518a2f329e2d7e7fefcf38ca8d5385ff795ee871857bca868675afbb4a3cef7466a21ba326b40122ebf7ccb184b0b7
SSDEEP 24576:9a1M2IOIWLnbc03nMPBJVmGWqR9OVV9Zlh0lhSMXltJAOp+mL1jJ3:9aMODPGVWE9y2PEmL
TLSH
T1FA958D11E79EC2D8C62DA4BC9652D703E33470022F1587CB5BA52D56AE27EE05FBEB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
catalyst.exe

File Explorer

catalyst.exe

.exe 1.8MB

catalyst.exe

IMPHASH 575ebb5a1d40bdf29c9b86cbda8c827b
SHA256 4e1f13789bc4e58f935961ec65cf79f752cf198c556de92a66f54f5e5b0c3c90
MD5 c6d11eb901223feb34a7610e0326fe22
SHA1 f9ea90bcaba918ab7ef2d38c4dd1883a8f8ae0d0
SHA512 dba25044c42b003efd46761208f412e406518a2f329e2d7e7fefcf38ca8d5385ff795ee871857bca868675afbb4a3cef7466a21ba326b40122ebf7ccb184b0b7
SSDEEP 24576:9a1M2IOIWLnbc03nMPBJVmGWqR9OVV9Zlh0lhSMXltJAOp+mL1jJ3:9aMODPGVWE9y2PEmL
TLSH
T1FA958D11E79EC2D8C62DA4BC9652D703E33470022F1587CB5BA52D56AE27EE05FBEB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

938512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\catalyst-main\bin\catalyst.pdb

kernel32

SetConsoleMode GetCurrentConsoleFontEx SetCurrentConsoleFontEx GetConsoleScreenBufferInfoEx SetConsoleScreenBufferInfoEx GetConsoleWindow SetConsoleWindowInfo SetConsoleScreenBufferSize SetConsoleCursorInfo FlushConsoleInputBuffer SetConsoleTitleA CreateToolhelp32Snapshot Process32FirstW lstrcmpiW Process32NextW CloseHandle OpenProcess Module32FirstW ReadProcessMemory lstrcmpW Module32NextW GetModuleHandleW GetCurrentThreadId QueryFullProcessImageNameA GetFileSizeEx GetConsoleMode HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetProcAddress SleepConditionVariableSRW Sleep ReadFile GetStdHandle GetModuleHandleA QueryPerformanceCounter QueryPerformanceFrequency GetLocalTime GlobalUnlock GlobalLock GlobalAlloc MultiByteToWideChar InitializeSListHead GetSystemTimeAsFileTime AreFileApisANSI GetLastError LocalFree FormatMessageA GetLocaleInfoEx WakeAllConditionVariable SetUnhandledExceptionFilter WideCharToMultiByte GetCurrentProcessId CreateFileA

user32

GetAsyncKeyState OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetClipboardData GetSystemMetrics GetWindowLongW SetWindowLongW SetLayeredWindowAttributes CreateWindowExW ShowWindow UpdateWindow GetClassInfoExW LoadCursorW RegisterClassExW PeekMessageW TranslateMessage DefWindowProcW PostQuitMessage SetForegroundWindow AttachThreadInput DispatchMessageW GetForegroundWindow GetWindowThreadProcessId

gdi32

GetStockObject

advapi32

RegCreateKeyExW RegEnumValueW RegDeleteValueW RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Throw_Cpp_error@std@@YAXH@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$numpunct@D@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ _Query_perf_counter _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Incref@facet@locale@std@@UEAAXXZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Xbad_alloc@std@@YAXXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__RTDynamicCast __std_terminate __std_exception_copy __std_exception_destroy _purecall strstr strchr strrchr longjmp memcpy memmove memset memchr memcmp __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException __C_specific_handler

api-ms-win-crt-math-l1-1-0

sqrt _dsign _ldsign atan2f scalbnf acosf lroundf roundf sinf powf sqrtf __setusermatherr pow logf cosf tanf fmodf ilogbf fminf floorf ceilf _fdsign

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode malloc calloc _callnewh free

api-ms-win-crt-string-l1-1-0

strcmp strlen strncmp strcpy strncpy wcscpy_s tolower _wcsicmp wcslen

api-ms-win-crt-stdio-l1-1-0

fputc __stdio_common_vswprintf fflush fclose _set_fmode __p__commode fgetc __acrt_iob_func fwrite __stdio_common_vfprintf fgetpos setvbuf ungetc fsetpos fread __stdio_common_vsscanf _fseeki64 _get_stream_buffer_pointers __stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type exit _get_initial_narrow_environment _initterm _c_exit _initterm_e _exit __p___argc __p___argv _register_thread_local_exe_atexit_callback terminate _beginthreadex

api-ms-win-crt-convert-l1-1-0

strtoll strtol

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func