DFIRThread[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DFIRThread.exe
Size 541KB
Sample260819-b89cpsvbkf
SHA256 783f46dd6dce29e85e55f4d0a2315a76824cac825589be802857c6651cb63557
MD5 93975fdb4b431fc48c202dc4f3d9f2f9
SHA1 9752b99de642c27df3c0c2a4207b7bda78c66456
SHA512 f9a9a23ac6727e626130a7aaca93dea185722aa3fcc5d438462ef9b946d58363c80f04799792ac8c1146daedaa47ec121e351d2a4718ba645928100e6d12b9df
SSDEEP 6144:z06gRbaxxlmhvxUKNO4zgSJrU8saBcc1yULF3mU+rlIV7SC3FxqsWnrAGnOAtUJ6:zjA7QcUiQULcpIFSC37qsWnTnbtUQ
TLSH
T1AEC46C59A6A803F8D1B7C138CA524902FB727C564771DAEF03E045A64F27AE19F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DFIRThread.exe

File Explorer

DFIRThread.exe

.exe 541KB

DFIRThread.exe

IMPHASH b2f5ae474ffbd89e6cfce524fc5ab71e
SHA256 783f46dd6dce29e85e55f4d0a2315a76824cac825589be802857c6651cb63557
MD5 93975fdb4b431fc48c202dc4f3d9f2f9
SHA1 9752b99de642c27df3c0c2a4207b7bda78c66456
SHA512 f9a9a23ac6727e626130a7aaca93dea185722aa3fcc5d438462ef9b946d58363c80f04799792ac8c1146daedaa47ec121e351d2a4718ba645928100e6d12b9df
SSDEEP 6144:z06gRbaxxlmhvxUKNO4zgSJrU8saBcc1yULF3mU+rlIV7SC3FxqsWnrAGnOAtUJ6:zjA7QcUiQULcpIFSC37qsWnTnbtUQ
TLSH
T1AEC46C59A6A803F8D1B7C138CA524902FB727C564771DAEF03E045A64F27AE19F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

222408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kilij\source\repos\ThreadDTC\bin\x64\Release\ThreadDTC.pdb

advapi32

GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW LookupAccountSidW OpenThreadToken ConvertSidToStringSidW PrivilegeCheck EnableTraceEx2 OpenTraceW ControlTraceW CloseTrace ProcessTrace StartTraceW

dbghelp

SymGetModuleBase64 SymCleanup SymFunctionTableAccess64 SymFromAddr SymSetOptions StackWalk64 SymLoadModuleExW SymInitialize

wintrust

WinVerifyTrust

crypt32

CertGetNameStringW CertFindCertificateInStore CertFreeCertificateContext CryptMsgGetParam CertCloseStore CryptQueryObject CryptMsgClose

ws2_32

setsockopt send WSAStartup listen recv htons socket inet_pton closesocket WSACleanup accept bind

shell32

ShellExecuteExW ShellExecuteW

tdh

TdhGetProperty TdhGetPropertySize

bcrypt

BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCreateHash

kernel32

GetACP IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile GetProcessHeap HeapReAlloc GetConsoleOutputCP FlushFileBuffers SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode HeapAlloc SetConsoleTitleW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteFile GetConsoleMode WriteConsoleW WideCharToMultiByte SetConsoleOutputCP GetCurrentProcess GetModuleFileNameW Thread32Next Thread32First OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId GetLastError Process32NextW Process32FirstW CloseHandle QueryFullProcessImageNameW IsWow64Process K32GetModuleFileNameExW K32EnumProcessModulesEx K32GetModuleInformation GetSystemInfo VirtualQueryEx Wow64GetThreadContext GetCurrentThreadId SuspendThread ResumeThread GetThreadContext GetProcAddress GetModuleHandleW GetProcessInformation OpenThread Sleep Module32FirstW GetCurrentProcessId GetTickCount ReadFile GetFileSizeEx CreateFileW LocalFree Wow64SuspendThread ReadProcessMemory GetLocalTime SetHandleInformation CreatePipe WaitForSingleObject LoadLibraryW CreateProcessW FreeLibrary HeapFree MultiByteToWideChar FormatMessageA GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW RtlUnwind

Name

.text

Size

363KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DFIRThread.exe

advapi32

dbghelp

wintrust

crypt32

ws2_32

shell32

tdh

bcrypt

kernel32

generic