retrac-12951f74f9f160cd[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
retrac-12951f74f9f160cd.exe
Size 110KB
Sample260808-qff8sa1xev
SHA256 eec9465c565c7600d186016058d1dd1d3cfb7f41f5223aeb9c8ceb5a518b2fd5
MD5 c2852725e57eaf30d9aa2a47d6f91143
SHA1 ca06d737e213487b7c2795eb8c7a8df337263b1f
SHA512 1838825ad8121a1391f1e53c26defc661b6d034bc96868231f02c98d8c0d9fd593ec512e51bd53a94cb2d46d516f7bb159df282915125a9c9ac01bdb221237be
SSDEEP 1536:kqbs1exh6QdQMpfVr1XK3kv0x1eiYySNGBze6XrRvVfr8YW:GEmMBXCs0xtYySEzDdNfgP
TLSH
T1B8B3D90BAB6FF82DE2626179F8601D50AF33BCAD07973D5F4B5009924A5AFA09F115C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
retrac-12951f74f9f160cd.exe

File Explorer

retrac-12951f74f9f160cd.exe

.exe 110KB

retrac-12951f74f9f160cd.exe

IMPHASH 6fdfadae77040d0a119ff559cbf0ad25
SHA256 eec9465c565c7600d186016058d1dd1d3cfb7f41f5223aeb9c8ceb5a518b2fd5
MD5 c2852725e57eaf30d9aa2a47d6f91143
SHA1 ca06d737e213487b7c2795eb8c7a8df337263b1f
SHA512 1838825ad8121a1391f1e53c26defc661b6d034bc96868231f02c98d8c0d9fd593ec512e51bd53a94cb2d46d516f7bb159df282915125a9c9ac01bdb221237be
SSDEEP 1536:kqbs1exh6QdQMpfVr1XK3kv0x1eiYySNGBze6XrRvVfr8YW:GEmMBXCs0xtYySEzDdNfgP
TLSH
T1B8B3D90BAB6FF82DE2626179F8601D50AF33BCAD07973D5F4B5009924A5AFA09F115C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\apina\Downloads\Retrac loader\x64\Release\Injector-x64.pdb

kernel32

GetProcAddress VirtualAllocEx ReadProcessMemory GetModuleHandleW CreateRemoteThread VirtualFreeEx GetTickCount GetExitCodeProcess ReadFile CreateNamedPipeA SetConsoleTitleA GetCurrentProcess WriteFile GetModuleFileNameW SetFilePointer VirtualProtectEx DisconnectNamedPipe OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW LocalFree GetFileSize WideCharToMultiByte AllocConsole IsWow64Process ConnectNamedPipe FlushFileBuffers AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW CloseHandle LoadLibraryA Sleep RtlAddFunctionTable CreateFileW WriteProcessMemory QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime ReleaseSRWLockExclusive InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess

user32

MessageBoxA

advapi32

AdjustTokenPrivileges OpenProcessToken ConvertSidToStringSidW GetTokenInformation LookupPrivilegeValueW

msvcp140

?good@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z

wininet

HttpOpenRequestA InternetOpenA InternetCloseHandle HttpQueryInfoA InternetConnectA HttpSendRequestA InternetReadFile

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider BCryptGetProperty

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_terminate memcmp __std_exception_destroy memset __C_specific_handler _CxxThrowException __current_exception __current_exception_context memmove memcpy

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf freopen_s __acrt_iob_func _set_fmode __stdio_common_vsprintf_s __p__commode

api-ms-win-crt-runtime-l1-1-0

exit _exit _invoke_watson __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm _get_initial_wide_environment system _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate _configure_wide_argv _seh_filter_exe _initialize_wide_environment _initterm_e

api-ms-win-crt-string-l1-1-0

_wcsicmp isxdigit strcpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale