loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 3.4MB
Sample260808-p3spnaxcmd
SHA256 2a8807ca60d078c4f997dd92422bc9027e4aee5d70eaa23e6a338efceacf90fb
MD5 ae24686e47cd3b9a70e466b92dbe44bd
SHA1 83626fd501c4342590ea4d93766a282e85e5f927
SHA512 9260a43822310cccae48320b86572292d99bd92b3f8693b5508c637d88a8859ea541c53f46654003dede479e7cb5471e33ec99b4722082fab13d52e1b0fa8d49
SSDEEP 49152:vlQ0MmmVOPoHejFTzyTReBjTo9Qf9pJHK6imbWjlXHYxGwZbsQzIU6i7mPthcep:6c4ReBqSidZ+7y
TLSH
T12BF58C42F6A240E9C07AC174D356A633FA727C8947317AEB16D046353E62FD0AB3EB45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 3.4MB

loader.exe

IMPHASH 985948e837bf98f512af5be29ae430ed
SHA256 2a8807ca60d078c4f997dd92422bc9027e4aee5d70eaa23e6a338efceacf90fb
MD5 ae24686e47cd3b9a70e466b92dbe44bd
SHA1 83626fd501c4342590ea4d93766a282e85e5f927
SHA512 9260a43822310cccae48320b86572292d99bd92b3f8693b5508c637d88a8859ea541c53f46654003dede479e7cb5471e33ec99b4722082fab13d52e1b0fa8d49
SSDEEP 49152:vlQ0MmmVOPoHejFTzyTReBjTo9Qf9pJHK6imbWjlXHYxGwZbsQzIU6i7mPthcep:6c4ReBqSidZ+7y
TLSH
T12BF58C42F6A240E9C07AC174D356A633FA727C8947317AEB16D046353E62FD0AB3EB45
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2429672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

loader.pdb

ntdll

NtReadFile RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile RtlCaptureContext RtlVirtualUnwind NtQuerySystemInformation NtQueryInformationProcess NtWriteFile NtCreateFile

kernel32

AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock FreeLibrary GetFileAttributesW GetProcessIoCounters GetSystemTimes AcquireSRWLockShared GetProcessTimes FindVolumeClose GetModuleHandleW FindNextVolumeW FindFirstVolumeW DeviceIoControl GetDiskFreeSpaceExW GetVolumePathNamesForVolumeNameW GetVolumeInformationW GetDriveTypeW FindNextFileW CopyFileExW DeleteFileW GetTempPathW GetUserDefaultUILanguage LCIDToLocaleName ExitProcess CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle HeapReAlloc GetSystemTimePreciseAsFileTime FindFirstFileExW SetFileInformationByHandle IsDebuggerPresent CheckRemoteDebuggerPresent LoadLibraryW CreateToolhelp32Snapshot Module32FirstW Module32NextW Process32FirstW Process32NextW VirtualAllocEx WriteProcessMemory VirtualFreeEx InitOnceExecuteOnce SetFileTime TlsAlloc CreateFileW GetSystemInfo RtlLookupFunctionEntry LoadLibraryA lstrlenW WideCharToMultiByte MultiByteToWideChar FormatMessageW GlobalMemoryStatusEx ReadProcessMemory VirtualQueryEx GetFullPathNameW SetHandleInformation ReleaseMutex CreateMutexA WaitForSingleObjectEx GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx SetWaitableTimer CreateWaitableTimerExW GetCurrentThread SetThreadStackGuarantee CreateRemoteThread OpenProcess GetCurrentProcess MoveFileExW GetCurrentProcessId WaitForSingleObject WakeAllConditionVariable SleepConditionVariableSRW LocalFree TerminateProcess TlsGetValue PostQueuedCompletionStatus IsProcessorFeaturePresent SwitchToThread FindClose GetCurrentThreadId GetSystemTimeAsFileTime CreateThread GetModuleHandleA LoadLibraryExA Sleep GetProcAddress CloseHandle GetLastError TlsSetValue GetProcessHeap OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW HeapAlloc HeapFree SetUnhandledExceptionFilter InitializeSListHead UnhandledExceptionFilter QueryPerformanceFrequency QueryPerformanceCounter AddVectoredExceptionHandler K32GetPerformanceInfo GetCurrentDirectoryW GetEnvironmentVariableW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW

bcryptprimitives

ProcessPrng

oleaut32

SafeArrayAccessData SetErrorInfo SafeArrayUnaccessData SysFreeString SysStringLen GetErrorInfo SafeArrayDestroy VariantClear SysAllocStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

WSASend freeaddrinfo bind getaddrinfo getsockopt WSAGetLastError WSACleanup connect ioctlsocket WSASocketW setsockopt recv closesocket send WSAIoctl WSAStartup

advapi32

RegOpenKeyExW CopySid RegQueryValueExW GetTokenInformation GetLengthSid IsValidSid RegCloseKey RegGetValueW OpenProcessToken EventUnregister EventRegister EventSetInformation EventWriteTransfer

user32

GetKeyboardLayout MapVirtualKeyExW RegisterWindowMessageA ShowWindow GetSystemMenu EnableMenuItem InvalidateRgn EnumChildWindows IsProcessDPIAware GetDC DispatchMessageA GetMessageA SetWindowPos RegisterClassExW RegisterRawInputDevices SetWindowLongW RegisterTouchWindow IsWindow MonitorFromPoint CreateWindowExW MessageBoxW DestroyIcon ChangeDisplaySettingsExW SetForegroundWindow GetForegroundWindow CreateIcon SetCursor LoadCursorW GetActiveWindow CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FillRect GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient SetWindowPlacement GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData DefWindowProcW GetKeyboardState GetAsyncKeyState RedrawWindow SetWindowLongPtrW GetKeyState MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW SendMessageW DestroyWindow PostMessageW GetWindowLongPtrW ShowCursor DispatchMessageW TranslateMessage GetMessageW GetClipCursor ClipCursor GetMenu AdjustWindowRectEx GetWindowRect ToUnicodeEx SetFocus GetWindow GetWindowPlacement SystemParametersInfoA SetPropW SendInput

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass

ole32

CoTaskMemAlloc CoTaskMemFree CoInitializeSecurity CoSetProxyBlanket RevokeDragDrop CoUninitialize RegisterDragDrop OleInitialize CoCreateFreeThreadedMarshaler CoInitializeEx CoCreateInstance

gdi32

CreateSolidBrush GetDeviceCaps DeleteObject

shell32

SHAppBarMessage DragFinish DragQueryFileW CommandLineToArgvW

shlwapi

SHCreateMemStream

crypt32

CryptProtectData CryptUnprotectData

dwmapi

DwmSetWindowAttribute

iphlpapi

GetAdaptersAddresses

pdh

PdhRemoveCounter PdhCloseQuery PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhOpenQueryA PdhCollectQueryData

psapi

GetModuleFileNameExW

powrprof

CallNtPowerInformation

vcruntime140

__current_exception __C_specific_handler memchr strchr __std_exception_copy _CxxThrowException __std_exception_destroy _purecall memset memcpy memcmp memmove __current_exception_context __CxxFrameHandler3 wcsrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

roundf floor __setusermatherr round pow trunc

api-ms-win-crt-string-l1-1-0

wcscmp _wcsicmp wcslen strcmp strlen

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol strtol

api-ms-win-crt-runtime-l1-1-0

abort exit _exit _initterm _get_initial_narrow_environment __p___argv _initterm_e _cexit _register_onexit_function _initialize_onexit_table _c_exit _initialize_narrow_environment terminate _wassert _seh_filter_exe _register_thread_local_exe_atexit_callback _errno _crt_atexit _set_app_type _configure_narrow_argv __p___argc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

ferror fseek fgets fopen __stdio_common_vsscanf __p__commode feof _setmode _set_fmode __stdio_common_vfprintf fflush __acrt_iob_func fclose _fileno fwrite fread ftell __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc realloc

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale