notema[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
notema.exe
Size 28.4MB
Sample260806-ng5awsam2x
SHA256 32fd7eb8250b65db0208a54c0a4454fc576ae02a4e490dd5a64b9783d397d010
MD5 ed75b9270fc9c0d5e9f7def1e4dc7c9e
SHA1 e3a2ca8c7a15f3aaeb0d016efbea13c84ee9c1b8
SHA512 827bc7e87a8e08b3d1b30bb37f01e28e4fe1ade796e56a475da3aaa8a44e521a93bc395d15d5999b8d81f2e3b68ea818ae98fd8f27f4888d2af7486fa8dca461
SSDEEP 98304:0S58sQnRHOXcfFt6Wc1jttCthbvJn5VAi6xv9rxqn1UH/G2wS3ZaFbd+XOyuzood:ZCmWcu4wmH+23QJa2PZB
TLSH
T1DC677C13FABB9E2DD166C43092BA0B226B72B4C617137BAB19D551343E76BD03F25318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
notema.exe

File Explorer

notema.exe

.exe 28.4MB

notema.exe

IMPHASH 54a7412b2132db58ec2de9ee918acb6f
SHA256 32fd7eb8250b65db0208a54c0a4454fc576ae02a4e490dd5a64b9783d397d010
MD5 ed75b9270fc9c0d5e9f7def1e4dc7c9e
SHA1 e3a2ca8c7a15f3aaeb0d016efbea13c84ee9c1b8
SHA512 827bc7e87a8e08b3d1b30bb37f01e28e4fe1ade796e56a475da3aaa8a44e521a93bc395d15d5999b8d81f2e3b68ea818ae98fd8f27f4888d2af7486fa8dca461
SSDEEP 98304:0S58sQnRHOXcfFt6Wc1jttCthbvJn5VAi6xv9rxqn1UH/G2wS3ZaFbd+XOyuzood:ZCmWcu4wmH+23QJa2PZB
TLSH
T1DC677C13FABB9E2DD166C43092BA0B226B72B4C617137BAB19D551343E76BD03F25318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11572272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

notema.pdb

bcryptprimitives

ProcessPrng

kernel32

GetModuleHandleA GetProcAddress Sleep CloseHandle GetSystemTimeAsFileTime SetConsoleActiveScreenBuffer SetConsoleCursorInfo CreateConsoleScreenBuffer CreateFileW lstrlenW WaitForSingleObject FindClose SwitchToThread CreateThread WriteFileEx SleepEx GetExitCodeProcess FlushFileBuffers GetCurrentProcessId ReadDirectoryChangesW ReleaseSemaphore WaitForSingleObjectEx GetSystemTimePreciseAsFileTime GetStdHandle GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo GetCurrentThread MultiByteToWideChar GlobalFree WideCharToMultiByte FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleCursorPosition GetFileInformationByHandleEx WaitForMultipleObjects GetNumberOfConsoleInputEvents ReadConsoleInputW GetDynamicTimeZoneInformation CancelIo CreateSemaphoreW GetLastError GetSystemInfo WriteFile WriteConsoleW ReadFile FindNextFileW GetFileType GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA ExitProcess FindFirstFileExW MoveFileExW CopyFileExW RemoveDirectoryW SetThreadStackGuarantee SetFilePointerEx CreateDirectoryW DuplicateHandle GetCurrentProcess TerminateProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandle SetFileInformationByHandle SetFileTime GetOverlappedResult CreateEventW ReadFileEx SetHandleInformation GetCurrentThreadId GetFullPathNameW SetLastError CompareStringOrdinal GenerateConsoleCtrlEvent ReadConsoleW LoadLibraryExA GetModuleHandleW GetModuleFileNameW HeapAlloc LoadLibraryA SetUnhandledExceptionFilter GetEnvironmentVariableW GetCurrentDirectoryW AddVectoredExceptionHandler FreeEnvironmentStringsW GetEnvironmentStringsW InitializeSListHead RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter QueryPerformanceFrequency FormatMessageW GlobalSize GlobalUnlock GlobalLock GlobalAlloc HeapReAlloc HeapFree GetProcessHeap RtlVirtualUnwind GetCommandLineW

advapi32

CredDeleteW CredReadW ImpersonateAnonymousToken RevertToSelf CredEnumerateW CredFree CredWriteW SystemFunction036

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

user32

ToUnicodeEx GetKeyboardLayout SetClipboardData CloseClipboard IsClipboardFormatAvailable EmptyClipboard OpenClipboard GetForegroundWindow RegisterClipboardFormatW GetWindowThreadProcessId GetClipboardData

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile NtOpenFile NtCreateNamedPipeFile

api-ms-win-core-handle-l1-1-0

CompareObjectHandles

oleaut32

SysStringLen SysFreeString

bcrypt

BCryptGenRandom

ws2_32

WSAStartup getpeername WSASocketW select WSACleanup getsockopt freeaddrinfo ioctlsocket setsockopt WSAGetLastError getaddrinfo send recv closesocket connect

vcruntime140

__current_exception __current_exception_context memcmp memcpy __C_specific_handler _CxxThrowException __CxxFrameHandler3 memset memmove

api-ms-win-crt-runtime-l1-1-0

_wassert _register_onexit_function _initialize_onexit_table abort _crt_atexit terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _exit exit _initterm_e _initterm _seh_filter_exe _set_app_type _get_initial_narrow_environment strerror _configure_narrow_argv _initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

isdigit iswctype towupper strlen strncmp strcmp strncpy

api-ms-win-crt-math-l1-1-0

pow _fdopen ceil fmod truncf __setusermatherr round floor ceilf floorf roundf expf sinf asinh trunc cbrtf powf asin acos tan sin log10 fma cos

api-ms-win-crt-heap-l1-1-0

realloc malloc free calloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode __stdio_common_vsprintf __stdio_common_vfprintf fputs __p__commode fclose fputc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale