BatLoader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BatLoader.exe
Size 6.5MB
Sample260810-apllvsxhrd
SHA256 a9e8d8c75c5189f80c88b1726a50367fb56742f75dd287da3e83464c01174d3f
MD5 3c6776fbd136937268352938ca2024db
SHA1 353b87d4852749b4d8e8048590ad0e981d59af6d
SHA512 de73061cfb8fc93434f80ec73d464a2e80e26f583c0129e703e2320a510802885d9dba38a9adce9e821679d9c1b6afc4cae2c270669ed4769d2d014a4073990a
SSDEEP 49152:CzkWhQnoj0ohflSCvGRCIyRu4kpI/44DWYw7rn6ODcrpWGeMsoT8+HEoK4LwE8ap:Qj0uvWw4E4LVc1WSKRpl/NEan100PYp9
TLSH
T144664B4366D7CDE5D9D267B8D28397F6A334BC25CB191B6B5604FE213E33AC0692A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BatLoader.exe

File Explorer

BatLoader.exe

.exe 6.5MB

BatLoader.exe

IMPHASH 7b2185f44bee884c17cf95993c082427
SHA256 a9e8d8c75c5189f80c88b1726a50367fb56742f75dd287da3e83464c01174d3f
MD5 3c6776fbd136937268352938ca2024db
SHA1 353b87d4852749b4d8e8048590ad0e981d59af6d
SHA512 de73061cfb8fc93434f80ec73d464a2e80e26f583c0129e703e2320a510802885d9dba38a9adce9e821679d9c1b6afc4cae2c270669ed4769d2d014a4073990a
SSDEEP 49152:CzkWhQnoj0ohflSCvGRCIyRu4kpI/44DWYw7rn6ODcrpWGeMsoT8+HEoK4LwE8ap:Qj0uvWw4E4LVc1WSKRpl/NEan100PYp9
TLSH
T144664B4366D7CDE5D9D267B8D28397F6A334BC25CB191B6B5604FE213E33AC0692A700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegGetValueA

gdi32

CreateFontA CreateRoundRectRgn CreateSolidBrush GetDeviceCaps SetBkColor SetTextColor

gdiplus

GdipAddPathArc GdipAlloc GdipBitmapLockBits GdipBitmapUnlockBits GdipCloneBrush GdipCloneImage GdipClosePathFigure GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateFont GdipCreateFontFamilyFromName GdipCreateFromHDC GdipCreateImageAttributes GdipCreatePath GdipCreatePen1 GdipCreateSolidFill GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDeleteStringFormat GdipDisposeImage GdipDisposeImageAttributes GdipDrawImageRectI GdipDrawImageRectRectI GdipDrawPath GdipDrawString GdipFillPath GdipFillRectangle GdipFree GdipGetGenericFontFamilySansSerif GdipGetImageGraphicsContext GdipGetImageHeight GdipGetImageWidth GdipGraphicsClear GdipResetPath GdipSetImageAttributesColorMatrix GdipSetInterpolationMode GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdiplusShutdown GdiplusStartup

kernel32

CloseHandle CreateEventA CreateFileA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FindResourceA FormatMessageA GetCPInfo GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileInformationByHandle GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetVolumeInformationA GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fdopen _fileno _fmode _fstat64 _get_osfhandle _initterm _lseeki64 _read _setjmp _setmode _time64 _strdup _vscprintf _vsnprintf _wfopen _write atexit abort calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getenv iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm toupper towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CreateStreamOnHGlobal

shell32

ShellExecuteExA

user32

BeginPaint CallWindowProcA CreateWindowExA DefWindowProcA DispatchMessageA EndPaint GetClientRect GetDC GetFocus GetKeyState GetMessageA GetSystemMetrics GetWindowTextA GetWindowTextLengthA InvalidateRect KillTimer LoadCursorA PostMessageA PostQuitMessage RegisterClassA ReleaseCapture ReleaseDC SendMessageA SetFocus SetLayeredWindowAttributes SetProcessDPIAware SetTimer SetWindowDisplayAffinity SetWindowLongPtrA SetWindowRgn SetWindowTextA ShowWindow TranslateMessage

Name

.text

Size

920KB

Virtual Size

920KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BatLoader.exe

advapi32

gdi32

gdiplus

kernel32

msvcrt

ole32

shell32

user32

generic