loker[.]ses[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loker.ses.exe
Size 3.5MB
Sample260818-fbda8afd44
SHA256 7764299681d941b444a48fac1ba7bd737e25b2dd2a297eebdd86fba7b7b2acbb
MD5 b5d9a61c4b44abe10e4bffe04b59dfaf
SHA1 656842b9183eaed7f1d10f7fcd5fa093ed6ac15c
SHA512 e35d3488b2524e05111d5eeff88091b276421be5b0185c8693f1e43486b501a01845e3c03e871851668e6be51077de473f0d4b9607ff9bb9fc05587c72ee871a
SSDEEP 49152:CyFAGiD3CguD5P5gVgwJyJDdh/qNwffAj3g/bTqSk62OF7UQ/S:CIAZ3CrDRJj/lgQ/6STq
TLSH
T1CA06CF0BF3A246D9D6669178C126A353E6B1B418173083DF2BE10966EF876F09FF9701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loker.ses.exe

File Explorer

loker.ses.exe

.exe 3.5MB

loker.ses.exe

IMPHASH f90e7e0d5a82db86f7361ccf5d925d35
SHA256 7764299681d941b444a48fac1ba7bd737e25b2dd2a297eebdd86fba7b7b2acbb
MD5 b5d9a61c4b44abe10e4bffe04b59dfaf
SHA1 656842b9183eaed7f1d10f7fcd5fa093ed6ac15c
SHA512 e35d3488b2524e05111d5eeff88091b276421be5b0185c8693f1e43486b501a01845e3c03e871851668e6be51077de473f0d4b9607ff9bb9fc05587c72ee871a
SSDEEP 49152:CyFAGiD3CguD5P5gVgwJyJDdh/qNwffAj3g/bTqSk62OF7UQ/S:CIAZ3CrDRJj/lgQ/6STq
TLSH
T1CA06CF0BF3A246D9D6669178C126A353E6B1B418173083DF2BE10966EF876F09FF9701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

33332123fdsfsds

Minor OS version

Major OS version

Entry point

1459624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\Repositorios\Strix - Majestic\x64\Release\Wexize Revamp.pdb

d3dx9_43

D3DXVec3Transform D3DXMatrixTranspose D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetFileInformationByHandleEx WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileAttributesExW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess WideCharToMultiByte IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime FindNextFileW InitializeSListHead CreateThread GlobalFree GetTempPathA MultiByteToWideChar ExitProcess GetStartupInfoA GetProcAddress LoadLibraryA QueryPerformanceFrequency GetModuleHandleW AreFileApisANSI QueryPerformanceCounter GetLastError GetCommandLineA GetModuleHandleA GetCurrentProcess GlobalUnlock CreateDirectoryA GlobalLock GlobalAlloc GetTickCount64 ReadProcessMemory VirtualProtectEx CloseHandle FreeLibrary VerSetConditionMask Process32Next K32GetModuleFileNameExA FindFirstFileW UnmapViewOfFile CreateFileMappingA FindClose CreateFileW CreateDirectoryW FindFirstFileExW CreateToolhelp32Snapshot OpenProcess Module32First Module32Next Process32First VirtualFreeEx VirtualAllocEx MapViewOfFile HeapFree HeapAlloc ReadFile CreateFileA GetFileSizeEx GetLocaleInfoEx LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA SetLastError WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA Sleep GetTickCount VerifyVersionInfoA GetSystemDirectoryA SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection

user32

CloseClipboard SetWindowLongA OpenClipboard SetWindowDisplayAffinity UpdateWindow FindWindowA PostQuitMessage GetWindowLongPtrA GetClipboardData SetClipboardData PeekMessageA EmptyClipboard mouse_event GetAsyncKeyState GetForegroundWindow GetSystemMetrics MoveWindow GetWindowThreadProcessId GetKeyState LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent SetCapture TranslateMessage MessageBoxA ShowWindow RegisterClassExW UnregisterClassW DestroyWindow GetWindowRect DispatchMessageA GetCursorPos SetCursorPos ReleaseCapture GetClientRect SetCursor DefWindowProcA SetLayeredWindowAttributes UnhookWindowsHookEx

advapi32

RevertToSelf CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey GetTokenInformation OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx SetThreadToken LookupPrivilegeValueA SetTokenInformation CryptEncrypt CryptImportKey PrivilegeCheck CryptAcquireContextA CreateProcessAsUserA RegGetValueA

shell32

ShellExecuteA SHParseDisplayName SHGetFolderPathA SHOpenFolderAndSelectItems

ole32

CoInitializeEx

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Query_perf_frequency ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Random_device@std@@YAIXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ _Mtx_unlock _Query_perf_counter _Mtx_lock ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

ws2_32

closesocket recv send bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup WSAGetLastError htonl listen accept ioctlsocket __WSAFDIsSet select ntohl gethostname sendto recvfrom getaddrinfo freeaddrinfo

normaliz

IdnToAscii

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertCloseStore

wldap32

ord46 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord217 ord143

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

urlmon

URLDownloadToFileA

imm32

ImmReleaseContext ImmGetContext ImmAssociateContextEx ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __C_specific_handler memcmp memchr memset memmove _CxxThrowException longjmp strrchr strchr strstr __std_terminate __std_exception_copy __std_exception_destroy memcpy __intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

realloc _callnewh free _set_new_mode calloc malloc

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-runtime-l1-1-0

exit _errno strerror _invalid_parameter_noinfo_noreturn terminate _beginthreadex __sys_nerr abort _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit _initialize_narrow_environment _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _getpid

api-ms-win-crt-string-l1-1-0

strncmp strcmp _stricmp strpbrk strncpy strcspn strspn isupper _strdup tolower toupper

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtod atof strtoul strtoll atoi

api-ms-win-crt-stdio-l1-1-0

fflush _read fclose _write _close fgetc _wfopen _lseeki64 __stdio_common_vfprintf fgets _open __p__commode feof fwrite fputs fopen __stdio_common_vsprintf fgetpos __stdio_common_vsscanf __acrt_iob_func setvbuf ungetc fseek ftell _set_fmode _get_stream_buffer_pointers _fseeki64 fread fsetpos fputc

api-ms-win-crt-math-l1-1-0

atan2f __setusermatherr ceilf _hypotf fmodf sqrtf _dsign acosf cosf powf sinf

api-ms-win-crt-filesystem-l1-1-0

_access _lock_file _fstat64 _unlock_file _stat64 _unlink

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64