Terentiy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Terentiy.exe
Size 3.5MB
Sample260814-vhsrtaxfmc
SHA256 4a7567f06f698f1b4ff670e68f899da8416c9799ce791c63a43cd40f73aafa12
MD5 4afa847a6650d601f6ed613bd15b6a47
SHA1 c44862aa060b9690b53a1d39f2cdd52179506c7a
SHA512 7b0548d721771aed9d3932e0a28a974d9bf71e1da282315191ed875cac2f0ed54d3294b62fc8c885e6b6a04a7853ba68b4409bf34a0cb8c23b9f290cea3306a9
SSDEEP 49152:Tsp/Yx6lMQ+pLxrBdJdvd1dWdkdyS0m3WAZcS5huGvYontIz0Q6:wVLsjZcS5huGvYontIz0Q6
TLSH
T1AB06F65369DB0CE9CED667B8A5C76235A338FD71CA291F2BA604C1313C536C06E6EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Terentiy.exe

File Explorer

Terentiy.exe

.exe 3.5MB

Terentiy.exe

IMPHASH ef3512289f23ae3a4027f713a5ce8876
SHA256 4a7567f06f698f1b4ff670e68f899da8416c9799ce791c63a43cd40f73aafa12
MD5 4afa847a6650d601f6ed613bd15b6a47
SHA1 c44862aa060b9690b53a1d39f2cdd52179506c7a
SHA512 7b0548d721771aed9d3932e0a28a974d9bf71e1da282315191ed875cac2f0ed54d3294b62fc8c885e6b6a04a7853ba68b4409bf34a0cb8c23b9f290cea3306a9
SSDEEP 49152:Tsp/Yx6lMQ+pLxrBdJdvd1dWdkdyS0m3WAZcS5huGvYontIz0Q6:wVLsjZcS5huGvYontIz0Q6
TLSH
T1AB06F65369DB0CE9CED667B8A5C76235A338FD71CA291F2BA604C1313C536C06E6EB50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges ChangeServiceConfigA CloseServiceHandle CreateServiceA GetTokenInformation GetUserNameA LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExA RegDeleteKeyA RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExA StartServiceA

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkMode

gdiplus

GdipAddPathArc GdipAddPathEllipse GdipAddPathEllipseI GdipAddPathRectangle GdipAlloc GdipCloneBrush GdipCloneImage GdipClosePathFigure GdipCreateFont GdipCreateFontFamilyFromName GdipCreateFromHDC GdipCreateHatchBrush GdipCreateLineBrushFromRect GdipCreateLineBrushFromRectI GdipCreateLineBrushI GdipCreatePath GdipCreatePathGradientFromPath GdipCreatePen1 GdipCreateSolidFill GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDeleteStringFormat GdipDisposeImage GdipDrawArc GdipDrawEllipse GdipDrawImageRectI GdipDrawLine GdipDrawPath GdipDrawRectangle GdipDrawRectangleI GdipDrawString GdipFillEllipse GdipFillEllipseI GdipFillPath GdipFillPolygon GdipFillRectangle GdipFillRectangleI GdipFree GdipGetImageHeight GdipGetImageWidth GdipGetInterpolationMode GdipLoadImageFromFile GdipLoadImageFromFileICM GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipMeasureString GdipResetWorldTransform GdipSetInterpolationMode GdipSetLinePresetBlend GdipSetPathGradientCenterColor GdipSetPathGradientCenterPoint GdipSetPathGradientSurroundColorsWithCount GdipSetPenLineCap197819 GdipSetPenMode GdipSetSmoothingMode GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdipTranslateWorldTransform GdiplusShutdown GdiplusStartup

kernel32

Beep CloseHandle CopyFileA CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateHardLinkW CreateProcessA CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FindResourceA FormatMessageA FreeLibrary GetCommandLineA GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeA GetFileAttributesA GetFileAttributesW GetFileInformationByHandle GetFileSize GetFullPathNameW GetLastError GetLocalTime GetLogicalDriveStringsA GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessTimes GetStartupInfoA GetSystemDirectoryA GetSystemDirectoryW GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetUserDefaultUILanguage GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LoadResource LocalFree LockResource MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesA SetFileTime SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

_wtoi mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _fstat64 _lock_file _unlock_file _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64 rename

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen cos cosf fmodf powf sin sinf

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_errno _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_errno _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _chsize_s _close _fileno _get_osfhandle _lseeki64 _read _setmode _wfopen _wopen _write fclose fflush fopen fputc fputs fputwc fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _stricmp iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm tolower towlower towupper wcscat wcscat_s wcscmp wcscoll wcscpy wcscpy_s wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand rand_s

ole32

CoGetObject CoInitializeEx CoUninitialize CreateStreamOnHGlobal

shell32

SHGetFolderPathA ShellExecuteExA Shell_NotifyIconW

user32

BeginPaint CallNextHookEx CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EndPaint EnumDisplayDevicesW FillRect FindWindowA GetAsyncKeyState GetClientRect GetCursorPos GetKeyState GetMessageA GetSystemMetrics InvalidateRect KillTimer LoadCursorA LoadIconA MessageBoxA PostMessageA PostQuitMessage RegisterClassA SetCursor SetFocus SetLayeredWindowAttributes SetTimer SetWindowsHookExA ShowCursor ShowWindow TranslateMessage UnhookWindowsHookEx

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest

winmm

PlaySoundA

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

512B

Virtual Size

221B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/123

Size

512B

Virtual Size

249B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Terentiy.exe

advapi32

bcrypt

gdi32

gdiplus

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

shell32

user32

winhttp

winmm

generic