Terentiy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Terentiy.exe
Size 3.3MB
Sample260813-pyhc5ahm21
SHA256 43e08b529d8083a781d4cacc304aaa2513aaa689b9887820bf0eea813624152d
MD5 ee6996fe5ce4e6c786e6eaba921ca27d
SHA1 d56fc9f7048813f85bc90ca400802caa4ba479a5
SHA512 9b05ff679d3015ac6b3c545560ce634ed535ae30832f61d7988e77d24ebe633598a01b1c807946c9c6494192c194ba9fed1ad16c994007ddb7db9f5811ab5cd6
SSDEEP 49152:rYTFgTG6ff3bkWttBbR8DEM06RlZcS5huGNYonFyml0l:r0FIrkvZcS5huGNYonFyml0l
TLSH
T1F6F5078369DB0CE9CED677B8A1C75335A738FD318A291F2BA604D2312D136C46D6EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Terentiy.exe

File Explorer

Terentiy.exe

.exe 3.3MB

Terentiy.exe

IMPHASH 1e6341d9688012bdc476df3afa7340cf
SHA256 43e08b529d8083a781d4cacc304aaa2513aaa689b9887820bf0eea813624152d
MD5 ee6996fe5ce4e6c786e6eaba921ca27d
SHA1 d56fc9f7048813f85bc90ca400802caa4ba479a5
SHA512 9b05ff679d3015ac6b3c545560ce634ed535ae30832f61d7988e77d24ebe633598a01b1c807946c9c6494192c194ba9fed1ad16c994007ddb7db9f5811ab5cd6
SSDEEP 49152:rYTFgTG6ff3bkWttBbR8DEM06RlZcS5huGNYonFyml0l:r0FIrkvZcS5huGNYonFyml0l
TLSH
T1F6F5078369DB0CE9CED677B8A1C75335A738FD318A291F2BA604D2312D136C46D6EB50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges ChangeServiceConfigA CloseServiceHandle CreateServiceA GetTokenInformation GetUserNameA LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExA RegDeleteKeyA RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExA StartServiceA

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkMode

gdiplus

GdipAddPathArc GdipAddPathEllipse GdipAddPathEllipseI GdipAddPathRectangle GdipAlloc GdipCloneBrush GdipCloneImage GdipClosePathFigure GdipCreateFont GdipCreateFontFamilyFromName GdipCreateFromHDC GdipCreateLineBrushFromRect GdipCreateLineBrushFromRectI GdipCreateLineBrushI GdipCreatePath GdipCreatePathGradientFromPath GdipCreatePen1 GdipCreateSolidFill GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDeleteStringFormat GdipDisposeImage GdipDrawArc GdipDrawEllipse GdipDrawImageRectI GdipDrawLine GdipDrawPath GdipDrawRectangle GdipDrawRectangleI GdipDrawString GdipFillEllipse GdipFillEllipseI GdipFillPath GdipFillPolygon GdipFillRectangle GdipFillRectangleI GdipFree GdipGetImageHeight GdipGetImageWidth GdipGetInterpolationMode GdipLoadImageFromStream GdipMeasureString GdipResetWorldTransform GdipSetInterpolationMode GdipSetLinePresetBlend GdipSetPathGradientCenterColor GdipSetPathGradientCenterPoint GdipSetPathGradientSurroundColorsWithCount GdipSetPenLineCap197819 GdipSetPenMode GdipSetSmoothingMode GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdipTranslateWorldTransform GdiplusShutdown GdiplusStartup

kernel32

Beep CloseHandle CopyFileA CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateHardLinkW CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FindResourceA FormatMessageA FreeLibrary GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeA GetFileAttributesA GetFileAttributesW GetFileInformationByHandle GetFileSize GetFullPathNameW GetLastError GetLocalTime GetLogicalDriveStringsA GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessTimes GetStartupInfoA GetSystemDirectoryA GetSystemDirectoryW GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetUserDefaultUILanguage GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LoadResource LocalFree LockResource MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesA SetFileTime SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

_wtoi mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _fstat64 _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64 rename

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen cos cosf fmodf powf sin sinf

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_errno _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_errno _set_invalid_parameter_handler abort exit signal strerror system

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _chsize_s _close _fileno _get_osfhandle _lseeki64 _read _setmode _wfopen _wopen _write fclose fflush fopen fputc fputs fputwc fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _stricmp isalnum iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm tolower towlower towupper wcscat wcscat_s wcscmp wcscoll wcscpy wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand rand_s

ole32

CoGetObject CoInitializeEx CoUninitialize CreateStreamOnHGlobal

shell32

SHGetFolderPathA ShellExecuteExA

user32

BeginPaint CallNextHookEx CreateWindowExA DefWindowProcA DispatchMessageA EndPaint EnumDisplayDevicesW FillRect FindWindowA GetAsyncKeyState GetClientRect GetCursorPos GetMessageA GetSystemMetrics InvalidateRect LoadCursorA MessageBoxA PostMessageA PostQuitMessage RegisterClassA SetCursor SetLayeredWindowAttributes SetTimer SetWindowsHookExA ShowCursor ShowWindow TranslateMessage UnhookWindowsHookEx

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest

winmm

PlaySoundA

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

512B

Virtual Size

221B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/123

Size

512B

Virtual Size

249B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Terentiy.exe

advapi32

gdi32

gdiplus

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

shell32

user32

winhttp

winmm

generic