patcher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
patcher.exe
Size 56KB
Sample260820-cn7ttaba35
SHA256 8ec55d3235d02246f344c97d6dac1dbd1c3fa2f8f920a255501d26a2e338d23c
MD5 163db278863a6883c0fc66bbc662e497
SHA1 118453b41af1d58cf381fdc88fbd421d9fcf257e
SHA512 eac5b4b21b4fd62bca8e4e0905412317543977a2f45cc58c8cf9c5d0336b19d09df1fcf1bf745dbd717bee4023ee277f58d2899f0bbb3da38a621f7b1ec0bf73
SSDEEP 768:bGzUGlyA/EtlG6V2wpOOKb1rRoFMuakzx/BFqttwIDyeVJNKGjojHMLHqK:bG7KXQwpo1ROakzfFMFVJFoYDqK
TLSH
T106431B278E1A406FD36A9DB4D1574902DB72BC8647B1BACF97810CE60F156D8EB3BD02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
patcher.exe

File Explorer

patcher.exe

.exe 56KB

patcher.exe

IMPHASH c63e0a028fb9ec27eb2fac754523173a
SHA256 8ec55d3235d02246f344c97d6dac1dbd1c3fa2f8f920a255501d26a2e338d23c
MD5 163db278863a6883c0fc66bbc662e497
SHA1 118453b41af1d58cf381fdc88fbd421d9fcf257e
SHA512 eac5b4b21b4fd62bca8e4e0905412317543977a2f45cc58c8cf9c5d0336b19d09df1fcf1bf745dbd717bee4023ee277f58d2899f0bbb3da38a621f7b1ec0bf73
SSDEEP 768:bGzUGlyA/EtlG6V2wpOOKb1rRoFMuakzx/BFqttwIDyeVJNKGjojHMLHqK:bG7KXQwpo1ROakzfFMFVJFoYDqK
TLSH
T106431B278E1A406FD36A9DB4D1574902DB72BC8647B1BACF97810CE60F156D8EB3BD02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\0x21\Downloads\runtime-memory-patcher-2-main\x64\Release\RuntimePatcher.pdb

kernel32

SetConsoleMode Thread32Next Thread32First SuspendThread ResumeThread OpenProcess CreateToolhelp32Snapshot GetConsoleMode GetLastError GetStdHandle Process32FirstW CloseHandle GetSystemInfo Module32FirstW VirtualProtectEx Module32NextW SetConsoleTitleW OpenThread VirtualQueryEx GetCurrentProcess SetConsoleTextAttribute Process32NextW WriteProcessMemory Sleep GetCurrentThreadId SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __current_exception_context __current_exception __std_exception_copy __std_terminate memcpy memmove memset __C_specific_handler _CxxThrowException

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback exit terminate __p___argv _configure_narrow_argv _initialize_narrow_environment __p___argc _c_exit _initialize_onexit_table _beginthreadex _initterm _get_initial_narrow_environment _initterm_e _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _exit

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale