brownclient[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
brownclient.exe
Size 2.0MB
Sample260809-vtxvxasepe
SHA256 b852b673ab452e98cc62a54697d1770f304bc42e4d27562b180a24c97aa78902
MD5 71a64ca33e86e09d39214e7b7a1ea548
SHA1 c3d76962a1719e52d80d8f8c79dc78c6f55ffe2e
SHA512 e1ca89fd768a9b02548b87dfed3918f6073a4b23c6f8e5783d3c581490eeb7e368f5e6d84b6141040cadca50be0a2ee97eb0031d86339b28453aaade8aaaa85b
SSDEEP 49152:BzFGsTYZrvCODhl9avtZgyd1HlNnBeV78SyzIlE:mS6mgl
TLSH
T1E2A5C082B6E541F8C05FC1758293AD0BEA323458037269EF33DD85595F667E08EBBE12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
brownclient.exe

File Explorer

brownclient.exe

.exe 2.0MB

brownclient.exe

IMPHASH c78d40e200d80ceb3828e1ce0cb4b636
SHA256 b852b673ab452e98cc62a54697d1770f304bc42e4d27562b180a24c97aa78902
MD5 71a64ca33e86e09d39214e7b7a1ea548
SHA1 c3d76962a1719e52d80d8f8c79dc78c6f55ffe2e
SHA512 e1ca89fd768a9b02548b87dfed3918f6073a4b23c6f8e5783d3c581490eeb7e368f5e6d84b6141040cadca50be0a2ee97eb0031d86339b28453aaade8aaaa85b
SSDEEP 49152:BzFGsTYZrvCODhl9avtZgyd1HlNnBeV78SyzIlE:mS6mgl
TLSH
T1E2A5C082B6E541F8C05FC1758293AD0BEA323458037269EF33DD85595F667E08EBBE12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1068448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\priso\Downloads\Lumen\Source\1\build\brownclient.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

QueryPerformanceFrequency GetProcAddress QueryPerformanceCounter GetStdHandle SetConsoleMode GetConsoleMode GetLastError SetThreadPriority GetCurrentThread GetModuleHandleW Sleep SetConsoleTitleA GetConsoleWindow AllocConsole Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle GetExitCodeProcess GlobalLock GetSystemTimeAsFileTime GetCurrentProcessId SetUnhandledExceptionFilter WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GlobalFree GetLocaleInfoA AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GlobalAlloc MultiByteToWideChar LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte InitializeSListHead GetFileInformationByHandleEx

user32

DispatchMessageA GetWindowRect GetMessageExtraInfo SetWindowDisplayAffinity SetClipboardData MessageBoxA DefWindowProcA CreateWindowExA GetSystemMetrics SetLayeredWindowAttributes PeekMessageA PostQuitMessage RegisterClassExA UpdateWindow ShowWindow GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetWindowLongA BringWindowToTop SetForegroundWindow SendInput GetWindowThreadProcessId EnumWindows FindWindowA IsWindow GetMessageW DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW DispatchMessageW GetRawInputData RegisterRawInputDevices ScreenToClient GetKeyState GetCapture ClientToScreen MapVirtualKeyA TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture TranslateMessage GetKeyNameTextA GetAsyncKeyState SetCursorPos LoadCursorA

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteA

msvcp140

?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ??7ios_base@std@@QEBA_NXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Random_device@std@@YAIXZ _Thrd_hardware_concurrency _Cnd_broadcast _Thrd_join _Thrd_id ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$numpunct@D@std@@2V0locale@2@A _Xtime_get_ticks ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Cnd_signal _Cnd_wait

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpCrackUrl WinHttpCloseHandle WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpSendRequest WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpSetOption WinHttpAddRequestHeaders WinHttpReceiveResponse

winmm

timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __current_exception_context __current_exception memset memmove memcpy _CxxThrowException memchr strchr strstr __std_terminate __std_exception_copy __std_exception_destroy memcmp

api-ms-win-crt-heap-l1-1-0

malloc free calloc realloc _set_new_mode _callnewh

api-ms-win-crt-math-l1-1-0

atan2f asinf acosf sinf sin nearbyint __setusermatherr roundf _dsign powf cos _fdsign _ldsign logf log ldexp pow expf fmodf

api-ms-win-crt-stdio-l1-1-0

fsetpos ungetc setvbuf fgetpos fgetc _get_stream_buffer_pointers freopen_s __stdio_common_vsprintf_s __p__commode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite _fwrite_nolock fseek fclose fflush __acrt_iob_func ftell _set_fmode _fseeki64 fputc

api-ms-win-crt-utility-l1-1-0

srand qsort

api-ms-win-crt-string-l1-1-0

strncpy _stricmp strncmp tolower strcpy_s strcmp wcslen strlen

api-ms-win-crt-convert-l1-1-0

strtof strtol strtoll atoi strtoull strtod atof

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table exit _register_onexit_function _crt_atexit abort _register_thread_local_exe_atexit_callback _cexit _seh_filter_exe _c_exit __p___argv __p___argc _set_app_type _errno _exit _initterm_e _get_initial_narrow_environment _initterm terminate _beginthreadex

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

534KB

Virtual Size

533KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

422KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

brownclient.exe

d3d11

kernel32

user32

shell32

msvcp140

imm32

d3dcompiler_47

dwmapi

winhttp

winmm

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic