ExitLag[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ExitLag.exe
Size 19.3MB
Sample260819-kwnd5ssxes
SHA256 85d0410fe743b4bd8273de3f7cee374076ed6260940bb021c52585c234caf329
MD5 6432ba30c2dc95a87ff29dac2c9f060c
SHA1 24ada72c2a0d004be09104b2e51e33205a1a4374
SHA512 1471c255edf1c6078e71a4003ca29d016ee9336bab963257a8dfeec86e6ac0420270e71f0971bc794010bb70b9ab49e61ade9c412057fd43906d7a925fb536b2
SSDEEP 393216:pIXC6XTv8mFQRmRBU1iCh/2MVWJdDQqXoQLs4sR9k:SS+vlWQBOia/4ToQLshr
TLSH
T16017E0B58A5C9B4EF066B039C187521797F0BC0E17A1DFCB9AC09DB7481F589F61A20E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ExitLag.exe

File Explorer

ExitLag.exe

.exe 19.3MB

ExitLag.exe

IMPHASH 8b44f55af831d5264f22e5a33187f782
SHA256 85d0410fe743b4bd8273de3f7cee374076ed6260940bb021c52585c234caf329
MD5 6432ba30c2dc95a87ff29dac2c9f060c
SHA1 24ada72c2a0d004be09104b2e51e33205a1a4374
SHA512 1471c255edf1c6078e71a4003ca29d016ee9336bab963257a8dfeec86e6ac0420270e71f0971bc794010bb70b9ab49e61ade9c412057fd43906d7a925fb536b2
SSDEEP 393216:pIXC6XTv8mFQRmRBU1iCh/2MVWJdDQqXoQLs4sR9k:SS+vlWQBOia/4ToQLshr
TLSH
T16017E0B58A5C9B4EF066B039C187521797F0BC0E17A1DFCB9AC09DB7481F589F61A20E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8106804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpOpen WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpConnect

bcrypt

BCryptFinishHash BCryptHashData BCryptGetProperty BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptGenerateSymmetricKey BCryptDestroyKey BCryptDecrypt BCryptSetProperty BCryptOpenAlgorithmProvider

shell32

ShellExecuteA SHGetFolderPathW

kernel32

GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue GetProcAddress FreeLibrary GetVolumeInformationA Sleep ExitProcess GetModuleHandleW GetTickCount GetComputerNameA ReadFile GetFileSizeEx GetModuleFileNameW CreateFileW CloseHandle CreateDirectoryW SizeofResource WriteFile LockResource DeleteFileW LoadLibraryW LoadResource FindResourceW MoveFileExW GetEnvironmentVariableA LocalFree MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency ReadConsoleW QueryPerformanceCounter CreateFileA HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile WriteConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId FormatMessageA GetLocaleInfoEx FindClose FindFirstFileExW FindNextFileW AreFileApisANSI GetLastError InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection

user32

ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW GetMessageExtraInfo TranslateMessage LoadIconW PostQuitMessage UpdateWindow PeekMessageA GetKeyState CloseClipboard PeekMessageW

advapi32

RegGetValueA

crypt32

CryptUnprotectData

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

Name

.text

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

285KB

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.0MB

Virtual Size

11.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ExitLag.exe

d3d11

d3dcompiler_43

d3dx11_43

winhttp

bcrypt

shell32

kernel32

user32

advapi32

crypt32

imm32

generic