natgo[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
natgo.exe
Size 8.3MB
Sample260809-pgb5saem9x
SHA256 1a032bc7c649d0c8a4f1d057b4ce3fa59ccdc7aa8cade2a17b30757b51a6cf01
MD5 70afaaf166cddce3c8e73f25b8b14a51
SHA1 febaaf5fc024a2843216a1611bb08cf53e9bef3b
SHA512 b179da87a7d630f3094793cc44ecc273a869ae6b089a6b54b39af30dee8e5a39e824531a6e1773d7f0d3953f687f079a3badb978af973dd8bfa212272488e6a4
SSDEEP 98304:nQoY361tHKT+tOxh8mjKg0xZLZ4QowKGs8UqWUiFY+YJTl7q+USRkrEGS61a:nQoxW7eqwxZUEB+67qNS+c
TLSH
T14F96AE22F652C5B1E858057451B663F95B36AF204326E6C3AFD0FCB91C321E2DB3A359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

natgo.exe

.exe 8.3MB

natgo.exe

IMPHASH cfc8b0b38cae3895fa399c93660986da
SHA256 1a032bc7c649d0c8a4f1d057b4ce3fa59ccdc7aa8cade2a17b30757b51a6cf01
MD5 70afaaf166cddce3c8e73f25b8b14a51
SHA1 febaaf5fc024a2843216a1611bb08cf53e9bef3b
SHA512 b179da87a7d630f3094793cc44ecc273a869ae6b089a6b54b39af30dee8e5a39e824531a6e1773d7f0d3953f687f079a3badb978af973dd8bfa212272488e6a4
SSDEEP 98304:nQoY361tHKT+tOxh8mjKg0xZLZ4QowKGs8UqWUiFY+YJTl7q+USRkrEGS61a:nQoxW7eqwxZUEB+67qNS+c
TLSH
T14F96AE22F652C5B1E858057451B663F95B36AF204326E6C3AFD0FCB91C321E2DB3A359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

92:71:9b:37:63:06:d1:34:3d:ab:01:c8:89:49:22:d0:5d:71:89:45:70:be:2d:87:ea:5d:d3:de:a8:46:b6:ae

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91330108MADC7W701T,CN=浙江星络网络有限公司,O=浙江星络网络有限公司,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Nov 22, 2024

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

4b:2c:3b:01:01:8b:ad:2a:bc:8c:7b:5b:3e:ed:90:57

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 22, 2021 - Mar 21, 2046

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

ff:d1:8a:69:df:85:c4:fc:23:f7:98:ec:64:37:9f:df

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 28, 2024 - Aug 28, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1477443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvfw32

DrawDibDraw

avifil32

AVIStreamGetFrame AVIStreamInfoA

winmm

midiStreamOut midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause midiOutPrepareHeader waveOutPrepareHeader waveOutUnprepareHeader PlaySoundA midiStreamRestart midiStreamClose midiOutReset midiStreamStop waveOutWrite

ws2_32

accept getpeername recv ioctlsocket recvfrom WSAAsyncSelect closesocket WSACleanup WSAStartup gethostbyname inet_ntoa inet_addr

kernel32

InterlockedDecrement LocalFree FileTimeToSystemTime InterlockedIncrement lstrcpynA DuplicateHandle FlushFileBuffers LockFile UnlockFile SetEndOfFile lstrcmpiA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA lstrcmpA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind RaiseException GetSystemTime GetLocalTime HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle GetVersion GetTimeZoneInformation SetLastError GetSystemDirectoryA TerminateProcess GetCurrentProcess GetFileSize SetFilePointer Beep GetWindowsDirectoryA LoadLibraryExA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA MoveFileA DeleteFileA CreateDirectoryA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject CloseHandle InterlockedExchange FileTimeToLocalFileTime

user32

GetSysColorBrush GetMenuCheckMarkDimensions SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA CreateWindowExA GetClassLongA SetPropA GetPropA CallWindowProcA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement EndDialog CreateDialogIndirectParamA DestroyWindow GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC CharUpperA GetWindowTextLengthA GetForegroundWindow GetDlgItem GetDesktopWindow CreateIconIndirect GetIconInfo CopyIcon LoadStringA SetWindowTextA UnhookWindowsHookEx SetWindowsHookExA CallNextHookEx GetMenuItemCount GetMenuItemID GetMenuState GetWindowTextA GetClassNameA DrawStateA FrameRect GetNextDlgTabItem LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA RegisterClipboardFormatA KillTimer UnregisterClassA

gdi32

CombineRgn PatBlt CreatePen SelectObject CreatePatternBrush CreateBitmap CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn FrameRgn OffsetRgn GetTextMetricsA LineTo MoveToEx SaveDC RestoreDC SetPolyFillMode SetROP2 SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect CreateRectRgn ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible ExtTextOutA Escape SetBkMode TextOutA SetBkColor CreateRectRgnIndirect CreateDIBSection SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath GetPixel CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect SetDIBitsToDevice FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage GetTextExtentPoint32A BitBlt SetMapMode GetDeviceCaps PathToRegion SetTextColor

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

comdlg32

GetFileTitleA ChooseColorA GetOpenFileNameA GetSaveFileNameA

advapi32

RegCreateKeyExA RegOpenKeyA RegQueryValueA RegDeleteValueA RegSetValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA SHChangeNotify

ole32

CLSIDFromProgID OleUninitialize CLSIDFromString CoCreateInstance OleRun OleInitialize

oleaut32

SafeArrayGetUBound SafeArrayGetLBound VariantClear SafeArrayGetDim SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SysAllocString VariantChangeType RegisterTypeLi LHashValOfNameSys LoadTypeLi UnRegisterTypeLi

comctl32

_TrackMouseEvent ImageList_GetImageInfo ImageList_SetBkColor ord17 ImageList_GetImageCount ImageList_GetIcon ImageList_Destroy ImageList_Create ImageList_Read ImageList_Write ImageList_Duplicate

Sharing

General

Malware Config

Signatures

File Explorer

natgo.exe

msvfw32

avifil32

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

generic