Private Slotted Emulator[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Private Slotted Emulator.exe
Size 3.7MB
Sample260822-bctblsel6z
SHA256 9715fadd2e7c16e7bab1ac783303ad761107e8048e89b807974b82c35386a0d5
MD5 3aedb035bde80bca1130aef0cda40c39
SHA1 bf0d1011431c8e7da6d7ca2194026a6f03134e32
SHA512 c75216d8dd7c2bb089914cf76d2ed31f5b4f3df20146e98ee5c808b5a408a156b13d8b7a2e8ebaff4bc02b62bddccb040784de9da6bccc87d31fed523943ce41
SSDEEP 98304:khPm8M3h6AwK7SVn6j98EzmBmhzA2ZpXGP:0+1h6AwK7SVn6j9FmBmhzA2ZpXG
TLSH
T12906AE4AB3F801F8D17BC138C656960BE7B274551360A7DF13A086A96F23BE16B3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Private Slotted Emulator.exe

File Explorer

Private Slotted Emulator.exe

.exe 3.7MB

Private Slotted Emulator.exe

IMPHASH a45b5c1b3075399b988ca5aa6f944af6
SHA256 9715fadd2e7c16e7bab1ac783303ad761107e8048e89b807974b82c35386a0d5
MD5 3aedb035bde80bca1130aef0cda40c39
SHA1 bf0d1011431c8e7da6d7ca2194026a6f03134e32
SHA512 c75216d8dd7c2bb089914cf76d2ed31f5b4f3df20146e98ee5c808b5a408a156b13d8b7a2e8ebaff4bc02b62bddccb040784de9da6bccc87d31fed523943ce41
SSDEEP 98304:khPm8M3h6AwK7SVn6j98EzmBmhzA2ZpXGP:0+1h6AwK7SVn6j9FmBmhzA2ZpXG
TLSH
T12906AE4AB3F801F8D17BC138C656960BE7B274551360A7DF13A086A96F23BE16B3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3738112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

WSAResetEvent send getsockopt WSACloseEvent WSACreateEvent getsockname WSAEventSelect gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl select __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv WSAWaitForMultipleEvents getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons WSAGetLastError closesocket WSAEnumNetworkEvents

iphlpapi

if_nametoindex

crypt32

CertFreeCertificateChainEngine CertCloseStore CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain CertOpenStore CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore

secur32

InitSecurityInterfaceW

kernel32

FlushFileBuffers FreeLibraryAndExitThread HeapFree HeapReAlloc SetStdHandle SetEndOfFile GetCurrentDirectoryW HeapAlloc OutputDebugStringW IsValidCodePage GetACP GetOEMCP ExitProcess EnumSystemLocalesW GetTimeZoneInformation GetModuleHandleW GetTempPathA CloseHandle TerminateProcess CreateProcessA OpenProcess WinExec CreateToolhelp32Snapshot Process32FirstW Process32NextW OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock RemoveVectoredExceptionHandler GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetSystemInfo IsDBCSLeadByte GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive FindClose LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetTickCount Sleep GetLastError SetLastError CreateFileW GetFullPathNameW MoveFileExW WaitForSingleObjectEx CreateThread GetUserDefaultLCID GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW FormatMessageW GetFileSizeEx LocalFree GetTickCount64 ExitThread IsProcessorFeaturePresent GetCurrentProcess UnhandledExceptionFilter GetDriveTypeW IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns WriteConsoleW IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap DeleteFileW HeapSize SleepConditionVariableSRW WakeAllConditionVariable GetModuleFileNameW SetFilePointerEx GetConsoleOutputCP WriteFile LoadLibraryExW GetDateFormatW GetTimeFormatW GetEnvironmentVariableA CompareStringW EnterCriticalSection RtlUnwind ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle RtlPcToFileHeader RaiseException InitOnceBeginInitialize InitOnceComplete GetCurrentThreadId

user32

ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard GetMessageExtraInfo EmptyClipboard GetClipboardData SetClipboardData GetCursorPos GetWindowRect SetWindowPos UpdateWindow GetSystemMetrics SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage PeekMessageW DispatchMessageW TranslateMessage GetKeyState CloseClipboard DefWindowProcW

advapi32

CryptDestroyHash CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptAcquireContextW CryptHashData CryptCreateHash CryptGetHashParam

shell32

ShellExecuteW

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntryA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

bcrypt

BCryptGenRandom

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

717KB

Virtual Size

717KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

138KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Private Slotted Emulator.exe

d3d11

dwmapi

ws2_32

iphlpapi

crypt32

secur32

kernel32

user32

advapi32

shell32

urlmon

wininet

imm32

d3dcompiler_47

bcrypt

generic