CrockyHub[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CrockyHub.exe
Size 1.5MB
Sample260813-e5vxpazxfs
SHA256 edcb643a10a24c757f04ff4a8933cabb4dfafa6a577a8749e8e684d540906e88
MD5 cf55ae899772d43c6408c888af868585
SHA1 90ca296dbb1a2fd2efa2dd7badf2f319cf54f100
SHA512 dc5dbe75e3ac9d632fdd7af5a64a289ea3758d920a3b9396d0d263cf83d460b819e16efe5f37e51dc14a9cf485e2814020b1cfdd5308456a94808797df566c68
SSDEEP 24576:y30wbdChzKXURi4ZHjWGjc2wxtTARpNLbWxVJImyptg9IQbYR3z5Rr9ZQBQnj2dq:y3NAhzKkRi8+PTkR06g9IQcz8SnjW
TLSH
T1D665AE87F6B801F8C067D27CC696A61BE775340907246BEB27E04A262F53BE15F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CrockyHub.exe

File Explorer

CrockyHub.exe

.exe 1.5MB

CrockyHub.exe

IMPHASH 3e7d7fac3b958f2ec5c35b9a50fb3610
SHA256 edcb643a10a24c757f04ff4a8933cabb4dfafa6a577a8749e8e684d540906e88
MD5 cf55ae899772d43c6408c888af868585
SHA1 90ca296dbb1a2fd2efa2dd7badf2f319cf54f100
SHA512 dc5dbe75e3ac9d632fdd7af5a64a289ea3758d920a3b9396d0d263cf83d460b819e16efe5f37e51dc14a9cf485e2814020b1cfdd5308456a94808797df566c68
SSDEEP 24576:y30wbdChzKXURi4ZHjWGjc2wxtTARpNLbWxVJImyptg9IQbYR3z5Rr9ZQBQnj2dq:y3NAhzKkRi8+PTkR06g9IQcz8SnjW
TLSH
T1D665AE87F6B801F8C067D27CC696A61BE775340907246BEB27E04A262F53BE15F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1133584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\ExtYhujin\Yhujin\bin\Release\CrockyHub.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpOpenRequest WinHttpReadData WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect

kernel32

ReleaseSRWLockExclusive GetModuleFileNameA SizeofResource SetConsoleTitleA MultiByteToWideChar LockResource FreeConsole LoadResource FindResourceW VirtualAllocEx GetModuleHandleW WideCharToMultiByte AllocConsole GetExitCodeProcess GetProcessId CompareStringOrdinal OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle Module32FirstW Module32NextW GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter CreateFileA GetCurrentThreadId ReadFile HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GetFileInformationByHandleEx GetLastError AreFileApisANSI CreateFile2 GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree WakeAllConditionVariable SetUnhandledExceptionFilter AcquireSRWLockExclusive SleepConditionVariableSRW HeapAlloc GetStartupInfoW Sleep GetCurrentProcessId GetSystemTimeAsFileTime GetFileSizeEx InitializeSListHead

user32

GetMessageExtraInfo ScreenToClient GetCapture GetKeyState ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW SetWindowDisplayAffinity SetLayeredWindowAttributes TranslateMessage GetClientRect FindWindowW SetWindowLongW PostQuitMessage UpdateWindow GetCursorPos SendInput

comdlg32

GetOpenFileNameW GetSaveFileNameW

msvcp140

??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ __crtLCMapStringA ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??_7_Facet_base@std@@6B@ _Strxfrm _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??_7facet@locale@std@@6B@ _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __std_exception_destroy __std_exception_copy __std_type_info_compare _set_se_translator strchr _CxxThrowException __intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception memcmp memchr memmove memcpy longjmp strrchr strstr __RTtypeid

api-ms-win-crt-stdio-l1-1-0

fwrite fopen_s __stdio_common_vsprintf fgetc __stdio_common_vsprintf_s _get_stream_buffer_pointers _wfopen __stdio_common_vsscanf fseek freopen_s __stdio_common_vfprintf _fseeki64 __p__commode fclose fread fflush _set_fmode setvbuf fsetpos __acrt_iob_func ferror feof ungetc fputc ftell fgetpos

api-ms-win-crt-heap-l1-1-0

free realloc malloc _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

strtof strtol strtoll strtod strtoull atof

api-ms-win-crt-math-l1-1-0

powf ceilf sinf cosf __setusermatherr _dsign logf acosf fmodf atan2f ldexp sqrtf

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s

api-ms-win-crt-string-l1-1-0

strcmp strncpy tolower strncpy_s strlen strncmp

api-ms-win-crt-filesystem-l1-1-0

remove _lock_file _unlock_file rename

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _exit _initialize_onexit_table abort exit _initterm_e _initterm _beginthreadex _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _register_onexit_function _configure_narrow_argv _cexit system terminate _errno _crt_atexit _initialize_narrow_environment

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func localeconv ___lc_collate_cp_func ___lc_codepage_func _configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort