Nexservice[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nexservice.exe
Size 4.6MB
Sample260818-e42nvaej5w
SHA256 51cc68175d0bfb41c1155a040aa9190bee31921e2a6564b18ab459d20f406088
MD5 e9d28074a0f71a5aa765fe9b41f3a650
SHA1 ec97331d584db06c454c00437f906a3f9e1efd94
SHA512 93f97b08724b00d275ecc17dc5140a36da04ab13acd318b9a427f6c37c59d844f5ea636a5d02aa1baa835ad4ab48b9edf550a991b5c3298bf4cbd77e3f06fdd3
SSDEEP 98304:WC18LC0CTJgWjVmxdAGTZ3b/hRhZV0LYcqW:Wq8W9nV6dAGBb/hn8Y2
TLSH
T16726E046A29746A8CF72973CC54A5327D2B17CC5037097E76ADC4EA56F23AF46A3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nexservice.exe

File Explorer

Nexservice.exe

.exe 4.6MB

Nexservice.exe

IMPHASH 6c8413bcded6f872424cf81196083d3d
SHA256 51cc68175d0bfb41c1155a040aa9190bee31921e2a6564b18ab459d20f406088
MD5 e9d28074a0f71a5aa765fe9b41f3a650
SHA1 ec97331d584db06c454c00437f906a3f9e1efd94
SHA512 93f97b08724b00d275ecc17dc5140a36da04ab13acd318b9a427f6c37c59d844f5ea636a5d02aa1baa835ad4ab48b9edf550a991b5c3298bf4cbd77e3f06fdd3
SSDEEP 98304:WC18LC0CTJgWjVmxdAGTZ3b/hRhZV0LYcqW:Wq8W9nV6dAGBb/hn8Y2
TLSH
T16726E046A29746A8CF72973CC54A5327D2B17CC5037097E76ADC4EA56F23AF46A3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1463428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\szyns\Desktop\stoped\Stopped\x64\Release\Nexservice.pdb

d3dx9_43

D3DXVec3Transform D3DXMatrixTranspose D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetLocaleInfoEx CreateFileW GetCurrentThreadId FindClose SleepConditionVariableSRW FindFirstFileW AcquireSRWLockExclusive GetFileAttributesExW ReleaseSRWLockExclusive CreateFileMappingA AreFileApisANSI GetModuleHandleW GetTickCount64 GetFileInformationByHandleEx WakeAllConditionVariable UnmapViewOfFile RtlCaptureContext MapViewOfFile RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW HeapFree GetSystemTimeAsFileTime InitializeSListHead DuplicateHandle HeapAlloc GetProcessId CreateThread GetFileSizeEx CreateFileA GetComputerNameA GetDiskFreeSpaceExA GlobalMemoryStatusEx GetLocalTime VirtualAlloc SetPriorityClass VirtualProtect WriteProcessMemory CreateRemoteThreadEx QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA WideCharToMultiByte GlobalFree MultiByteToWideChar CreateRemoteThread GetLastError Sleep GetModuleHandleA GetCurrentProcess GlobalUnlock ExitProcess GlobalLock GlobalAlloc ReadProcessMemory VirtualProtectEx CloseHandle Process32Next K32GetModuleFileNameExA CreateToolhelp32Snapshot OpenProcess Module32First WaitForSingleObjectEx Module32Next Process32First VirtualFreeEx LocalFree VirtualAllocEx VerifyVersionInfoA GetSystemDirectoryA SleepEx GetNativeSystemInfo GetEnvironmentVariableA GetStdHandle GetFileType GetVersionExA GetModuleFileNameA MoveFileExA SetUnhandledExceptionFilter CheckRemoteDebuggerPresent IsDebuggerPresent OpenThread GetTickCount ReadFile PeekNamedPipe WaitForMultipleObjects DeleteCriticalSection InitializeCriticalSectionEx TerminateProcess GetCurrentProcessId SetLastError LeaveCriticalSection EnterCriticalSection FormatMessageA

user32

mouse_event SetClipboardData GetClipboardData SetWindowDisplayAffinity EmptyClipboard CloseClipboard SetWindowLongA OpenClipboard UpdateWindow FindWindowA PostQuitMessage PeekMessageA TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow GetMonitorInfoA MessageBoxA ShowWindow RegisterClassExW UnregisterClassW CreateWindowExW GetAsyncKeyState DestroyWindow DispatchMessageA GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetWindowTextA IsWindowVisible GetWindowRect GetWindowThreadProcessId GetSystemMetrics EnumDisplayMonitors GetForegroundWindow FindWindowW SetWindowsHookA GetWindowLongPtrA GetWindowTextLengthA GetKeyState GetMessageExtraInfo LoadCursorA EnumWindows

advapi32

CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt CryptReleaseContext CryptGetHashParam GetTokenInformation OpenProcessToken AdjustTokenPrivileges RegQueryValueExW RegOpenKeyExW RegCloseKey CryptCreateHash CryptGenRandom RegQueryValueExA AllocateAndInitializeSid GetUserNameA FreeSid CheckTokenMembership RegOpenKeyExA QueryServiceStatus CloseServiceHandle OpenSCManagerA ControlService OpenServiceA CryptAcquireContextA

shell32

ShellExecuteA

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xbad_function_call@std@@YAXXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ?_Random_device@std@@YAIXZ _Mtx_unlock _Query_perf_counter _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ _Wcsxfrm

ws2_32

htonl listen ioctlsocket accept WSACleanup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSAGetLastError gethostname send recv closesocket ntohl __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom WSAStartup sendto

normaliz

IdnToAscii

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenStore PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindCertificateInStore CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindExtension CryptStringToBinaryA CertFreeCertificateContext

wldap32

ord211 ord46 ord60 ord217 ord143 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

imm32

ImmGetContext ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

iphlpapi

GetAdaptersInfo

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __intrinsic_setjmp _CxxThrowException longjmp memchr __current_exception memmove strrchr memset memcpy wcsstr strchr memcmp strstr __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_callnewh malloc calloc free _set_new_mode realloc

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _errno strerror _getpid exit __sys_nerr abort _invoke_watson terminate _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit _initialize_narrow_environment _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

strncpy strncmp strcpy_s tolower strpbrk toupper isdigit strcmp strcspn strspn isupper _strdup

api-ms-win-crt-convert-l1-1-0

strtoll strtoul strtoull strtol atoi atof strtod mbstowcs

api-ms-win-crt-math-l1-1-0

cosf _dsign __setusermatherr sqrtf ceilf fmodf _hypotf log logf atan2f pow powf sinf floorf acosf _dclass

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-stdio-l1-1-0

_write __p__commode _close _open fputc __stdio_common_vsprintf _read _lseeki64 fflush fclose fgets fgetc __stdio_common_vsprintf_s feof fwrite fputs fopen fgetpos setvbuf __stdio_common_vsscanf _wfopen ungetc fsetpos __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 _set_fmode fread

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _fstat64 _unlink _stat64 _access

api-ms-win-crt-environment-l1-1-0

_wgetenv getenv

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64