Monoxide x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Monoxide x64.exe
Size 330KB
Sample260809-zhst2acd59
SHA256 ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe
MD5 692361071bbbb3e9243d09dc190fedea
SHA1 04894c41500859ea3617b0780f1cc2ba82a40daf
SHA512 cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e
SSDEEP 3072:7/yvAAdLz9aha9RMXtdf+IBC2nQ4oUehONFlT7vJ333AlOi9E3AAqgm:z6dLzgiMXzBTJTDqlOi9E3AAqgm
TLSH
T13174C3027151DA99D8214130CC2ECAF67E227CE4C6B149E736F2BF7F7D7524269AA720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Monoxide x64.exe

File Explorer

Monoxide x64.exe

.exe 330KB

Monoxide x64.exe

IMPHASH a2f9cc400443004644952ac829162570
SHA256 ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe
MD5 692361071bbbb3e9243d09dc190fedea
SHA1 04894c41500859ea3617b0780f1cc2ba82a40daf
SHA512 cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e
SSDEEP 3072:7/yvAAdLz9aha9RMXtdf+IBC2nQ4oUehONFlT7vJ333AlOi9E3AAqgm:z6dLzgiMXzBTJTDqlOi9E3AAqgm
TLSH
T13174C3027151DA99D8214130CC2ECAF67E227CE4C6B149E736F2BF7F7D7524269AA720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

waveOutWrite waveOutUnprepareHeader waveOutReset waveOutOpen waveOutPrepareHeader

kernel32

Sleep GetLastError lstrcatW DeleteFileW CloseHandle LoadLibraryW CreateThread GetProcAddress LocalFree CreateProcessW FreeLibrary CopyFileW lstrcpyW lstrcmpW GetCurrentThreadId HeapAlloc GetProcessHeap CreateMutexW WaitForSingleObject TerminateThread HeapFree HeapSize GetStringTypeW GetLogicalDriveStringsW ReadFile LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW SetFileAttributesW CreateFileW FindClose GetTempPathW GetModuleFileNameW RemoveDirectoryW WriteFile GetCurrentProcess FindNextFileW GetFileType FindFirstFileW HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW SetStdHandle GetACP GetModuleHandleExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetStdHandle MultiByteToWideChar WideCharToMultiByte ExitProcess

user32

GetMessageW DispatchMessageW SetTimer TranslateMessage EnumDisplayMonitors GetWindowRect GetDC EnumChildWindows CallNextHookEx GetSystemMetrics SetWindowTextW DrawIcon DestroyCursor ShowWindow GetCursorInfo RedrawWindow MoveWindow UnhookWindowsHookEx EnumWindows mouse_event SetWindowsHookExW SetCursorPos ReleaseDC EnableWindow MessageBoxW ExitWindowsEx

gdi32

DeleteDC CreatePen Ellipse DeleteObject CreateSolidBrush BitBlt SelectObject CreateDIBSection CreateCompatibleDC StretchBlt

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW FreeSid OpenProcessToken

shell32

ShellExecuteW

Name

.text

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Monoxide x64.exe

winmm

kernel32

user32

gdi32

advapi32

shell32

generic