Process[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Process.exe
Size 1.1MB
Sample260822-b4actaem5s
SHA256 ad5411e341a2c51841d8af3f8791d473fde26025a6bc77e9aa66c95522027fad
MD5 5c79ec9f0451d4e1eb87ed8c692f0d05
SHA1 96b891cee0c5df5d3ec7c56d2a5bc37681f8e208
SHA512 2cd450d89e92f33ea4625b623e8204efbcae199b04c075967af22e64f4b5e36763e3d88ae65bebe9a9df4597551ac49b454a541ed3780726e22453200384e69e
SSDEEP 24576:to6KfmwcUApLvpZvlcRY9lhh5TAenQkpv:66KuwFAHZvmRY9lhhH
TLSH
T1FB453A47E26395ECC66BC07487539772FA30B4590234BE6E1A99D7321F32E509B2EB34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Process.exe

File Explorer

Process.exe

.exe 1.1MB

Process.exe

IMPHASH e8665478c895ec295976055423990dad
SHA256 ad5411e341a2c51841d8af3f8791d473fde26025a6bc77e9aa66c95522027fad
MD5 5c79ec9f0451d4e1eb87ed8c692f0d05
SHA1 96b891cee0c5df5d3ec7c56d2a5bc37681f8e208
SHA512 2cd450d89e92f33ea4625b623e8204efbcae199b04c075967af22e64f4b5e36763e3d88ae65bebe9a9df4597551ac49b454a541ed3780726e22453200384e69e
SSDEEP 24576:to6KfmwcUApLvpZvlcRY9lhh5TAenQkpv:66KuwFAHZvmRY9lhhH
TLSH
T1FB453A47E26395ECC66BC07487539772FA30B4590234BE6E1A99D7321F32E509B2EB34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1178112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidA GetUserNameA LookupAccountNameA

crypt32

CertFreeCertificateChain CryptHashCertificate

kernel32

CloseHandle CreateEventA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStdHandle GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleA SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _lseeki64 _read _setjmp _setmode _strdup _vscprintf _vsnprintf _wfopen _write abort atexit calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isalnum isleadbyte iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset putc putwc remove realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm system towlower ungetwc towupper ungetc vfprintf wcscoll wcsftime wcslen wcsxfrm

wininet

HttpOpenRequestA HttpQueryInfoA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetQueryOptionA InternetReadFile

Name

.text

Size

897KB

Virtual Size

896KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Process.exe

advapi32

crypt32

kernel32

msvcrt

wininet

generic