wt[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wt.exe
Size 21.4MB
Sample260809-y4rcnavfqd
SHA256 8b04377979c1e8b89138c3cb2f47bf9fa862e63f902f66dd539c2b1f7c55633b
MD5 cd89bd09620b76dd8abf671cf64bae27
SHA1 b6f485a6512d9b8b4cb2a62d44c3ee550dede56c
SHA512 ac14a4dca4e24e678e6c82f5094b2293daa46533cc87bb0ccfcd6a261d7ffa27fe3c40a1979bad196b99d2c4ab0a69a69bae1973c0006ae5b961048abd9c6b71
SSDEEP 393216:i8KRoH0eXhb6/D2XfUvOG2PwrmHoH0eXhb6/D2XfUvOG2p:i8KkXh6L2XfUvuPwrm6Xh6L2XfUvup
TLSH
T15A37CE53F26280FCC56AC135C25A6273FA217C494B353AEB5BE04B253E69F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wt.exe

File Explorer

wt.exe

.exe 21.4MB

wt.exe

IMPHASH d16bac1a2b62756529408c9d79b16366
SHA256 8b04377979c1e8b89138c3cb2f47bf9fa862e63f902f66dd539c2b1f7c55633b
MD5 cd89bd09620b76dd8abf671cf64bae27
SHA1 b6f485a6512d9b8b4cb2a62d44c3ee550dede56c
SHA512 ac14a4dca4e24e678e6c82f5094b2293daa46533cc87bb0ccfcd6a261d7ffa27fe3c40a1979bad196b99d2c4ab0a69a69bae1973c0006ae5b961048abd9c6b71
SSDEEP 393216:i8KRoH0eXhb6/D2XfUvOG2PwrmHoH0eXhb6/D2XfUvOG2p:i8KkXh6L2XfUvuPwrm6Xh6L2XfUvup
TLSH
T15A37CE53F26280FCC56AC135C25A6273FA217C494B353AEB5BE04B253E69F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3407488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

WolfLegend_Setup.pdb

kernel32

FindClose GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetTempPathW GetFinalPathNameByHandleW SetFileInformationByHandle GetFullPathNameW GetModuleHandleW SleepEx MultiByteToWideChar ReleaseMutex WideCharToMultiByte GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx SetLastError RtlLookupFunctionEntry GetCurrentThreadId LoadLibraryW LoadLibraryA SwitchToThread lstrlenW SetWaitableTimer HeapReAlloc GetCurrentThread SetThreadStackGuarantee SetEnvironmentVariableW GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext QueryPerformanceFrequency QueryPerformanceCounter AddVectoredExceptionHandler WaitForSingleObject GetModuleHandleA GetProcAddress Sleep ReleaseSRWLockExclusive DeviceIoControl LoadLibraryExA AcquireSRWLockExclusive PostQueuedCompletionStatus CreateIoCompletionPort CreateProcessW ReadFile GetOverlappedResult CancelIo CreateEventW CreateDirectoryW CreateFileW WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle WakeAllConditionVariable FormatMessageW CreateMutexA GetQueuedCompletionStatusEx CreateWaitableTimerExW CreateThread GetLastError SleepConditionVariableSRW SetUnhandledExceptionFilter FindFirstFileExW GetSystemTimeAsFileTime FreeLibrary InitializeSListHead HeapAlloc CloseHandle LoadLibraryExW OutputDebugStringW OutputDebugStringA GetSystemTimePreciseAsFileTime CopyFileExW FindNextFileW GetSystemInfo LCIDToLocaleName GetUserDefaultUILanguage HeapFree SetFileTime GetProcessHeap

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile NtDeviceIoControlFile RtlGetVersion NtReadFile RtlNtStatusToDosError NtOpenFile NtCancelIoFileEx NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

comctl32

TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass DefSubclassProc

user32

DestroyWindow ScreenToClient InvalidateRect SetCursorPos SetCapture GetTouchInputInfo DispatchMessageW GetForegroundWindow FlashWindowEx CloseTouchInputHandle TranslateAcceleratorW GetUpdateRect GetRawInputData LoadCursorW IsWindow CreateWindowExW TrackMouseEvent IsWindowEnabled EnableWindow IsIconic IsWindowVisible PostThreadMessageW RedrawWindow EnumDisplayMonitors RegisterRawInputDevices SetWindowPlacement ChangeDisplaySettingsExW SetCursor EnumChildWindows SetParent SetFocus SetPropW GetMonitorInfoW MonitorFromRect SetWindowLongPtrW GetWindowLongPtrW MapVirtualKeyW GetWindow AdjustWindowRect RegisterTouchWindow MsgWaitForMultipleObjectsEx AdjustWindowRectEx GetMenu GetWindowLongW SystemParametersInfoW DefWindowProcW RegisterClassExW MonitorFromPoint GetMessageW ClipCursor GetSystemMetrics GetClipCursor ShowCursor SetWindowTextW SetWindowLongW GetSystemMenu InvalidateRgn SetWindowPos GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity ReleaseCapture ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState PeekMessageW RegisterWindowMessageA IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo FillRect ShowWindow SendMessageW PostQuitMessage PostMessageW GetActiveWindow SystemParametersInfoA SetMenu CreatePopupMenu CreateMenu CreateIcon RemoveMenu AppendMenuW InsertMenuW CheckMenuItem DrawIconEx ReleaseDC GetDC EnableMenuItem GetMenuItemInfoW VkKeyScanW SetMenuItemInfoW DrawMenuBar CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu DispatchMessageA GetMessageA FindWindowExW ValidateRect GetParent TranslateMessage GetWindowPlacement SetWindowRgn UpdateWindow

gdi32

CreateDIBSection SetBkMode DeleteObject SetTextColor GetDeviceCaps CreateRectRgn DeleteDC CreateSolidBrush SelectObject CreateCompatibleDC BitBlt CombineRgn

ole32

CoInitializeEx CoUninitialize CoCreateFreeThreadedMarshaler CoTaskMemFree CoTaskMemAlloc CoInitialize RevokeDragDrop OleInitialize RegisterDragDrop CoCreateInstance

advapi32

RegCloseKey RegGetValueW RegOpenKeyExW RegQueryValueExW EventUnregister EventWriteTransfer EventRegister EventSetInformation

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shell32

ShellExecuteW ILCreateFromPathW DragQueryFileW DragFinish SHGetKnownFolderPath SHAppBarMessage SHOpenFolderAndSelectItems ILFree ShellExecuteExW

shlwapi

SHCreateMemStream

vcruntime140

__current_exception_context _purecall __std_exception_copy memmove memcpy __current_exception memset _CxxThrowException __std_exception_destroy memcmp wcsrchr __CxxFrameHandler3 __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

round roundf __setusermatherr floor trunc pow

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscmp wcslen

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_thread_local_exe_atexit_callback _crt_atexit _c_exit _cexit __p___argv __p___argc _exit exit _register_onexit_function _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv terminate _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free