loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 3.5MB
Sample260819-nndrhsshke
SHA256 2309010b241375ecf41af3600f099d65187534c7b3b4def12c5b27e44a785b5d
MD5 a4ac0f6b91bd69eacee4989d3d977176
SHA1 0c61fb7093f7f8858635b830a9d4f1c9739f6c85
SHA512 20b1b3270b827960a62639d0b43f48e8d439b79c7fb693a3dd92bdf8956a28b3a61c4c7ca56c2967ee3af29aae22105d9037e5478e3a708f75e127f90bfd8a2d
SSDEEP 49152:JW7Yl9YIZep4wu2y5PC22eNoErfcMEOQcz8Y4/0EmT954zSSCzIU6i78hhG:lWc5PCsNQu8N/+7
TLSH
T14C067B82F6A280E8C47AC074D35A6633FA727C89573176EB16D087353E62FD06A3DB45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 3.5MB

loader.exe

IMPHASH 6c5624f50da9b049aa6508441cc809f9
SHA256 2309010b241375ecf41af3600f099d65187534c7b3b4def12c5b27e44a785b5d
MD5 a4ac0f6b91bd69eacee4989d3d977176
SHA1 0c61fb7093f7f8858635b830a9d4f1c9739f6c85
SHA512 20b1b3270b827960a62639d0b43f48e8d439b79c7fb693a3dd92bdf8956a28b3a61c4c7ca56c2967ee3af29aae22105d9037e5478e3a708f75e127f90bfd8a2d
SSDEEP 49152:JW7Yl9YIZep4wu2y5PC22eNoErfcMEOQcz8Y4/0EmT954zSSCzIU6i78hhG:lWc5PCsNQu8N/+7
TLSH
T14C067B82F6A280E8C47AC074D35A6633FA727C89573176EB16D087353E62FD06A3DB45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2535616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

loader.pdb

ntdll

RtlNtStatusToDosError NtReadFile NtDeviceIoControlFile NtCreateFile NtCancelIoFileEx RtlVirtualUnwind NtQuerySystemInformation NtQueryInformationProcess RtlGetVersion NtWriteFile RtlCaptureContext

kernel32

GetVolumePathNamesForVolumeNameW GetVolumeInformationW GetDiskFreeSpaceExW GetDriveTypeW GetSystemTimePreciseAsFileTime CreateToolhelp32Snapshot Module32FirstW Module32NextW GetModuleHandleW VirtualAllocEx WriteProcessMemory VirtualFreeEx InitializeSRWLock FindNextFileW DeleteFileW GetTempPathW ExitProcess ReleaseSRWLockExclusive WaitForSingleObject ReleaseSRWLockShared CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle FreeLibrary GetFileAttributesW SetFileTime DeviceIoControl CreateFileW GetFullPathNameW SetHandleInformation AcquireSRWLockExclusive AcquireSRWLockShared GetLastError GetUserDefaultUILanguage LCIDToLocaleName InitOnceExecuteOnce FindFirstVolumeW CreateMutexA WaitForSingleObjectEx HeapReAlloc IsDebuggerPresent CheckRemoteDebuggerPresent LoadLibraryW Process32FirstW GetProcessIoCounters FindNextVolumeW CloseHandle HeapAlloc TlsAlloc GetSystemInfo RtlLookupFunctionEntry LoadLibraryA lstrlenW WideCharToMultiByte MultiByteToWideChar FormatMessageW GlobalMemoryStatusEx ReadProcessMemory VirtualQueryEx GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort FindVolumeClose TlsGetValue TlsSetValue GetQueuedCompletionStatusEx SetWaitableTimer CreateWaitableTimerExW GetCurrentThread SetThreadStackGuarantee QueryFullProcessImageNameW GetCurrentProcess MoveFileExW RemoveDirectoryW WakeAllConditionVariable SleepConditionVariableSRW TerminateProcess IsProcessorFeaturePresent GetExitCodeThread CreateRemoteThread GetProcessTimes OpenProcess GetSystemTimes GetProcAddress PostQueuedCompletionStatus Sleep FlushFileBuffers GetSystemTimeAsFileTime GetCurrentProcessId LoadLibraryExA SwitchToThread FindClose GetCurrentThreadId CreateThread GetProcessHeap HeapFree OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW Process32NextW ReleaseMutex GetModuleHandleA LocalFree SetUnhandledExceptionFilter QueryPerformanceFrequency QueryPerformanceCounter UnhandledExceptionFilter AddVectoredExceptionHandler GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW GetEnvironmentVariableW K32GetPerformanceInfo InitializeSListHead

bcryptprimitives

ProcessPrng

oleaut32

VariantClear SafeArrayAccessData SafeArrayUnaccessData SysStringLen SysAllocStringLen SetErrorInfo GetErrorInfo SysFreeString SafeArrayDestroy

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

setsockopt getaddrinfo freeaddrinfo WSACleanup WSAStartup WSASend recv getsockopt WSAGetLastError WSAIoctl connect ioctlsocket WSASocketW closesocket bind send

advapi32

IsValidSid RegSetValueExW RegCloseKey RegQueryValueExW RegGetValueW GetLengthSid CopySid GetTokenInformation RegOpenKeyExW OpenProcessToken RegCreateKeyExW EventSetInformation EventUnregister EventRegister SystemFunction036 EventWriteTransfer

user32

DestroyIcon SetWindowLongW EnableMenuItem GetSystemMenu ShowWindow ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW RegisterWindowMessageA GetActiveWindow ShowCursor InvalidateRgn EnumChildWindows IsProcessDPIAware GetDC DispatchMessageA GetMessageA SetWindowPos GetClipCursor GetWindowLongPtrW SetWindowRgn ClipCursor RegisterTouchWindow IsWindow MonitorFromPoint RegisterClassExW CreateIcon RegisterRawInputDevices GetMenu AdjustWindowRectEx SendInput SetForegroundWindow GetForegroundWindow GetWindowRect SetCursor LoadCursorW GetWindowPlacement CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FillRect GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient SetPropW GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData DefWindowProcW GetKeyboardState GetAsyncKeyState RedrawWindow SetWindowLongPtrW GetKeyState MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW SendMessageW DestroyWindow PostMessageW SystemParametersInfoA DispatchMessageW TranslateMessage GetMessageW SetFocus ChangeDisplaySettingsExW SetWindowPlacement GetWindow CreateWindowExW

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass

ole32

RevokeDragDrop CoUninitialize OleInitialize RegisterDragDrop CoCreateFreeThreadedMarshaler CoSetProxyBlanket CoCreateInstance CoInitializeEx CoInitializeSecurity CoTaskMemAlloc CoTaskMemFree

gdi32

CreateSolidBrush CreateRoundRectRgn CreateRectRgn GetDeviceCaps DeleteObject

shell32

DragFinish CommandLineToArgvW DragQueryFileW SHAppBarMessage

shlwapi

SHCreateMemStream

crypt32

CryptProtectData CryptUnprotectData

bcrypt

BCryptGenRandom

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

iphlpapi

GetAdaptersAddresses

pdh

PdhRemoveCounter PdhCloseQuery PdhOpenQueryA PdhCollectQueryData PdhGetFormattedCounterValue PdhAddEnglishCounterW

psapi

GetModuleFileNameExW

powrprof

CallNtPowerInformation

vcruntime140

__std_exception_destroy __std_exception_copy _CxxThrowException _purecall memcpy __current_exception_context memcmp memmove memset __CxxFrameHandler3 wcsrchr __current_exception __C_specific_handler strchr memchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

floor round roundf pow __setusermatherr trunc

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen strlen strcmp wcscmp

api-ms-win-crt-convert-l1-1-0

strtol _wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_exit _initialize_onexit_table _register_onexit_function _errno _register_thread_local_exe_atexit_callback _wassert exit _c_exit _initterm_e _cexit terminate _initterm __p___argc abort _crt_atexit _seh_filter_exe _set_app_type __p___argv _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fwrite fseek fread _fileno fopen fgets ferror feof __p__commode fclose ftell _setmode __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fflush __acrt_iob_func _set_fmode

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh _set_new_mode free

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale