client[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
client.exe
Size 17.8MB
Sample260819-w15prsha35
SHA256 7e74a48ebaf713b7ecc828938a114bf32a9d3383aa51df88434b5a04a7f7915f
MD5 ae2102521c9ee919a914bdcf93caa94a
SHA1 4ebc8a02065eb06ef66d851727747f8cfaeb5aa0
SHA512 2b278ceb25fdf28ecc05138ff0b5152de589dd6d80dd06e6efa84d68cea25b50e7c787a35d75ce5fe53b46b5843537e9fa0c4fd05da5a1f084cd3adac5de1b7f
SSDEEP 196608:wrTP+eIOIvKRBVRB0EW8QkkplzPApX+1z/iMR052fM1fICRcyXo:qTP+eI1q1kfPAR+1z/hR052EJp74
TLSH
T15717BE45F2A252E8D667C074C166AA17FB7438BE03502AFB9AD099746F37BD06D3B301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

File Explorer

client.exe

.exe 17.8MB

client.exe

IMPHASH fc88bc9682352dfaf769becc8004ae0b
SHA256 7e74a48ebaf713b7ecc828938a114bf32a9d3383aa51df88434b5a04a7f7915f
MD5 ae2102521c9ee919a914bdcf93caa94a
SHA1 4ebc8a02065eb06ef66d851727747f8cfaeb5aa0
SHA512 2b278ceb25fdf28ecc05138ff0b5152de589dd6d80dd06e6efa84d68cea25b50e7c787a35d75ce5fe53b46b5843537e9fa0c4fd05da5a1f084cd3adac5de1b7f
SSDEEP 196608:wrTP+eIOIvKRBVRB0EW8QkkplzPApX+1z/iMR052fM1fICRcyXo:qTP+eI1q1kfPAR+1z/hR052EJp74
TLSH
T15717BE45F2A252E8D667C074C166AA17FB7438BE03502AFB9AD099746F37BD06D3B301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13944672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

kernel32

Sleep GetTickCount64 GetLastError Process32NextW K32GetProcessMemoryInfo GetCurrentThread QueryPerformanceFrequency Process32FirstW CloseHandle CreateThread GetLocalTime ExitProcess GetComputerNameW GetCurrentProcessId CreateProcessW WideCharToMultiByte QueryFullProcessImageNameW CreateProcessA QueryPerformanceCounter GetTickCount MoveFileW GetProcessTimes GetExitCodeProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx InitializeSRWLock InitializeConditionVariable GetModuleHandleW GetProcAddress FreeLibrary LoadLibraryExA LoadLibraryExW GetSystemDirectoryW CreateEventA GetStdHandle GetConsoleMode WriteConsoleW MultiByteToWideChar SetConsoleTextAttribute GetProcessAffinityMask GetSystemTimeAsFileTime LoadLibraryA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW LoadLibraryW GetThreadPriority SwitchToThread GetModuleHandleExW SetThreadErrorMode GetEnvironmentVariableA GetEnvironmentVariableW GetCurrentDirectoryW LCMapStringW ExpandEnvironmentStringsW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree SetFilePointerEx GetFileSizeEx GetTimeZoneInformation FreeLibraryAndExitThread ExitThread MoveFileExW DeleteFileW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime CreateToolhelp32Snapshot OpenProcess ReleaseMutex GetCurrentThreadId WaitForSingleObject CreateMutexA FindClose CreatePipe SetThreadPriority GetModuleFileNameW GetConsoleScreenBufferInfo TerminateProcess WriteFile GetCurrentProcess FindNextFileW GetFullPathNameW SetPriorityClass SetHandleInformation FindFirstFileW GetLogicalDrives ReadFile CreateDirectoryW GetLocaleInfoW IsValidLocale PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP CreateFileW TlsFree TlsSetValue GetACP TlsGetValue TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext IsValidCodePage FindFirstFileExW HeapQueryInformation HeapSize HeapReAlloc SetEndOfFile OutputDebugStringW ReadConsoleW GetConsoleOutputCP FlushFileBuffers SetStdHandle EnumSystemLocalesW CompareStringW RtlUnwind GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetNativeSystemInfo TryAcquireSRWLockExclusive GetStringTypeW InitializeCriticalSectionEx GetUserDefaultLCID

user32

MessageBoxW GetDC GetDesktopWindow FillRect GetWindowTextW SendInput ReleaseDC SetProcessDPIAware DrawIconEx wsprintfW OpenInputDesktop GetForegroundWindow GetMonitorInfoA GetCursorInfo CloseDesktop GetAsyncKeyState GetThreadDesktop SetThreadDesktop GetSystemMetrics EnumDisplayMonitors GetIconInfo

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetStockObject GetDIBits DeleteDC SetDIBitsToDevice SetStretchBltMode DeleteObject

advapi32

RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegEnumKeyExW RegCloseKey GetTokenInformation RegSetValueExW RegSetValueExA OpenProcessToken RegOpenKeyExA

shell32

ShellExecuteW SHFileOperationW ShellExecuteExW

ole32

CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx StringFromGUID2

oleaut32

VariantClear VariantInit

d3d11

D3D11CreateDevice

ws2_32

WSAGetLastError setsockopt ioctlsocket freeaddrinfo htons getsockopt recv connect socket send WSAStartup getaddrinfo select closesocket WSACleanup

gdiplus

GdipGetImageEncoders GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdiplusShutdown GdipFree GdipBitmapLockBits GdipGetImageEncodersSize GdipSaveImageToStream GdipCreateBitmapFromScan0 GdiplusStartup GdipDisposeImage

d3dcompiler_47

D3DCompile

rstrtmgr

RmEndSession RmStartSession RmGetList RmRegisterResources

winmm

waveInAddBuffer waveInStart waveInOpen waveInGetDevCapsW waveInUnprepareHeader timeBeginPeriod waveInReset waveInGetNumDevs waveInPrepareHeader waveInStop waveInClose

Name

.text

Size

13.6MB

Virtual Size

13.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

client.exe

bcrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

d3d11

ws2_32

gdiplus

d3dcompiler_47

rstrtmgr

winmm

generic