users[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
users.exe
Size 164KB
Sample260809-xevhcabh92
SHA256 362e1bb732d0b49d0c412a9ec8aed6cc280a270a3adcb02d025013ef63b35eb9
MD5 9f70c4988587c301c872d469d692bc47
SHA1 375e526917e33b635e9d649ac4ede5487277f842
SHA512 5d31b9db3c5307c1567ed54c9c4cca107afcad0217a6a3bedefb7f15ecb682ae73266bca955d9c70602830790bf59f9d95e9841de9aa144e57f43f9a85b9bdf3
SSDEEP 3072:2grUPoWUjj3YsdUccxLIK3XtI74PvGf8DKv+4nV:OdUjjYsk7kcvGf8DKv1
TLSH
T121F36B55B3A600F6E0B79238C9655A06E672FC1207209BDF43A447762F733E19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
users.exe

File Explorer

users.exe

.exe 164KB

users.exe

IMPHASH 6360c8cfacfa745b472d0ddf315aa535
SHA256 362e1bb732d0b49d0c412a9ec8aed6cc280a270a3adcb02d025013ef63b35eb9
MD5 9f70c4988587c301c872d469d692bc47
SHA1 375e526917e33b635e9d649ac4ede5487277f842
SHA512 5d31b9db3c5307c1567ed54c9c4cca107afcad0217a6a3bedefb7f15ecb682ae73266bca955d9c70602830790bf59f9d95e9841de9aa144e57f43f9a85b9bdf3
SSDEEP 3072:2grUPoWUjj3YsdUccxLIK3XtI74PvGf8DKv+4nV:OdUjjYsk7kcvGf8DKv1
TLSH
T121F36B55B3A600F6E0B79238C9655A06E672FC1207209BDF43A447762F733E19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

netapi32

NetLocalGroupAddMembers NetUserAdd NetUserEnum NetLocalGroupDelMembers NetLocalGroupGetMembers NetApiBufferFree NetUserSetInfo

user32

ExitWindowsEx

advapi32

AdjustTokenPrivileges ClearEventLogW CloseEventLog OpenProcessToken OpenEventLogW GetUserNameW GetTokenInformation LookupPrivilegeValueW

shell32

ShellExecuteW

kernel32

GetConsoleMode CreateFileW HeapSize HeapReAlloc ReadFile ReadConsoleW SetEndOfFile WriteConsoleW GetConsoleOutputCP TlsFree FlushFileBuffers SetFilePointerEx SetConsoleTextAttribute GetCurrentProcess GetStdHandle GetModuleFileNameW Sleep CloseHandle ExitProcess GetTickCount AllocConsole QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetFileSizeEx RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue FreeLibrary GetProcAddress LoadLibraryExW EncodePointer TerminateProcess WriteFile GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap

Name

.text

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

users.exe

netapi32

user32

advapi32

shell32

kernel32

generic