retrac-7fa9746d90fbb1d7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
retrac-7fa9746d90fbb1d7.exe
Size 91KB
Sample260810-tyzpmashkd
SHA256 4a55b88c20e32038174b595bb8a2cf6006c3c0b5a95e5b5ed442e39e43618eff
MD5 b86ad2ba372024ccc535e80554a92812
SHA1 b06aabd042e513767c03d5428553bc1fffdf0ce0
SHA512 00dc49e94d7c76f60d6228fec115ecf653cef51b7da8bb276941412efb54d2ca3864470e89e0b89a3f2d0d7b12ea98b4a5ca89be76502f31ee1231cf44e2b0cb
SSDEEP 768:tkNqK6zWmj8JpFMuFxFVsyAFhDBOlyc70utbCct40wm2xuDIJlJNkDSR+mA/b9on:Uq9nDAUWDDy5uEJi2QmAKFJn
TLSH
T10B93E80BAB6FF92DE2625175F8601D51AF32BCAD03D37D4F8B500D924A5AFA09F115C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
retrac-7fa9746d90fbb1d7.exe

File Explorer

retrac-7fa9746d90fbb1d7.exe

.exe 91KB

retrac-7fa9746d90fbb1d7.exe

IMPHASH 24887d6746e7737ff6cefc6d34f5671b
SHA256 4a55b88c20e32038174b595bb8a2cf6006c3c0b5a95e5b5ed442e39e43618eff
MD5 b86ad2ba372024ccc535e80554a92812
SHA1 b06aabd042e513767c03d5428553bc1fffdf0ce0
SHA512 00dc49e94d7c76f60d6228fec115ecf653cef51b7da8bb276941412efb54d2ca3864470e89e0b89a3f2d0d7b12ea98b4a5ca89be76502f31ee1231cf44e2b0cb
SSDEEP 768:tkNqK6zWmj8JpFMuFxFVsyAFhDBOlyc70utbCct40wm2xuDIJlJNkDSR+mA/b9on:Uq9nDAUWDDy5uEJi2QmAKFJn
TLSH
T10B93E80BAB6FF92DE2625175F8601D51AF32BCAD03D37D4F8B500D924A5AFA09F115C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\apina\Downloads\Retrac loader\x64\Release\Injector-x64.pdb

kernel32

GetProcAddress VirtualAllocEx ReadProcessMemory GetModuleHandleW CreateRemoteThread VirtualFreeEx GetTickCount GetExitCodeProcess ReadFile CreateNamedPipeA SetConsoleTitleA GetCurrentProcess WriteFile GetModuleFileNameW SetFilePointer VirtualProtectEx DisconnectNamedPipe OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW LocalFree GetFileSize WideCharToMultiByte AllocConsole IsWow64Process ConnectNamedPipe FlushFileBuffers AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW CloseHandle LoadLibraryA Sleep RtlAddFunctionTable CreateFileW WriteProcessMemory QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime ReleaseSRWLockExclusive InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess

user32

MessageBoxA

advapi32

AdjustTokenPrivileges OpenProcessToken ConvertSidToStringSidW GetTokenInformation LookupPrivilegeValueW

msvcp140

?good@ios_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z

wininet

HttpQueryInfoA HttpOpenRequestA InternetOpenA InternetConnectA HttpSendRequestA InternetCloseHandle InternetReadFile

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGetProperty BCryptOpenAlgorithmProvider

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_terminate memcmp __std_exception_destroy memset __C_specific_handler _CxxThrowException __current_exception __current_exception_context memmove memcpy

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode freopen_s __stdio_common_vfprintf __p__commode

api-ms-win-crt-runtime-l1-1-0

_exit _initterm _get_initial_wide_environment __p___wargv exit _c_exit _register_thread_local_exe_atexit_callback _initialize_wide_environment _configure_wide_argv _cexit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _set_app_type _seh_filter_exe system _invoke_watson _initterm_e __p___argc

api-ms-win-crt-string-l1-1-0

_wcsicmp isxdigit strcpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale