umi[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
umi.exe
Size 8.4MB
Sample260822-p6gfssfb22
SHA256 fbc00d6f610dcd69fd75a70ce9d09020a0f0cbd65288983ea753f809ea791f84
MD5 c3b84bb3823c9584d0374701d8145b4a
SHA1 ce30b5d3e32b470024e9276f88724b11a4f06200
SHA512 ba1fd684522b2d2f6f0ace90e52a97d70e93c80ef61e0dfabd965f6bf3bd5e14299447298e2626072986a0b6b26573ff7edcdbb5fe1d40b00b18b6a7c5aa746c
SSDEEP 98304:0+VysLjqyKSARbU9pbZKvUlJf21tLAfS9GvaGBUuzbErFloX0nPEj16xYYYd/Xnr:0kaR43oJ1tWS9VrdsoA/XP8
TLSH
T152965A53F76280E8C17AC074935A6233FA617C494B357AEB5BE04B213E65F906B3DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
umi.exe

File Explorer

umi.exe

.exe 8.4MB

umi.exe

IMPHASH f0f83d286344b580130dd03f8dce6060
SHA256 fbc00d6f610dcd69fd75a70ce9d09020a0f0cbd65288983ea753f809ea791f84
MD5 c3b84bb3823c9584d0374701d8145b4a
SHA1 ce30b5d3e32b470024e9276f88724b11a4f06200
SHA512 ba1fd684522b2d2f6f0ace90e52a97d70e93c80ef61e0dfabd965f6bf3bd5e14299447298e2626072986a0b6b26573ff7edcdbb5fe1d40b00b18b6a7c5aa746c
SSDEEP 98304:0+VysLjqyKSARbU9pbZKvUlJf21tLAfS9GvaGBUuzbErFloX0nPEj16xYYYd/Xnr:0kaR43oJ1tWS9VrdsoA/XP8
TLSH
T152965A53F76280E8C17AC074935A6233FA617C494B357AEB5BE04B213E65F906B3DB18
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6517040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

umi.pdb

bcryptprimitives

ProcessPrng

ntdll

NtDeviceIoControlFile NtCreateNamedPipeFile NtCancelIoFileEx NtCreateFile NtWriteFile NtReadFile NtOpenFile RtlGetVersion RtlNtStatusToDosError

kernel32

RemoveDirectoryW DeleteFileW MoveFileExW SetFilePointerEx FindNextFileW DuplicateHandle CloseHandle GetLastError Sleep GetProcAddress GetModuleHandleA EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetProcessHeap HeapFree WaitForSingleObject SetThreadStackGuarantee GetCurrentThread HeapReAlloc SetWaitableTimer SwitchToThread GetModuleFileNameW SetLastError GetFinalPathNameByHandleW GetFileAttributesW lstrlenW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal GetExitCodeProcess WideCharToMultiByte TerminateProcess ExitProcess GetFileInformationByHandleEx GetFileInformationByHandle FindClose FindFirstFileExW SetFileInformationByHandle LoadLibraryA SetFileTime SetHandleInformation LoadLibraryW GetFullPathNameW CreatePipe DeviceIoControl CreateProcessW CancelIo FormatMessageW GetModuleHandleW CreateEventW CreateDirectoryW ReadFileEx WriteFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA CreateFileW CancelIoEx WriteFile CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx CreateWaitableTimerExW CreateThread SleepEx GetSystemInfo GetSystemTimePreciseAsFileTime GetCurrentProcessId GetTempPathW ReleaseMutex HeapAlloc SetFileCompletionNotificationModes GetCurrentThreadId MultiByteToWideChar FreeLibrary RtlLookupFunctionEntry WaitForSingleObjectEx OpenProcess GetCurrentProcess LoadLibraryExW OutputDebugStringW GetUserDefaultUILanguage LCIDToLocaleName OutputDebugStringA LoadLibraryExA CopyFileExW WaitForMultipleObjects GetProcessId InitializeSListHead InitializeCriticalSectionEx SetUnhandledExceptionFilter RtlUnwindEx SetEnvironmentVariableW AddVectoredExceptionHandler QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlVirtualUnwind GetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW Process32NextW CreateToolhelp32Snapshot Process32FirstW K32GetProcessMemoryInfo DeleteCriticalSection

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

user32

SetWindowRgn GetTouchInputInfo DestroyWindow TrackMouseEvent GetKeyboardState GetAsyncKeyState GetKeyState MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx ReleaseCapture SetWindowDisplayAffinity SetCapture ScreenToClient ValidateRect UpdateWindow InvalidateRect GetMessageW SetCursorPos GetForegroundWindow FlashWindowEx GetWindowTextLengthW CloseTouchInputHandle SetWindowPos MsgWaitForMultipleObjectsEx GetParent AdjustWindowRect RegisterTouchWindow IsWindow GetMessageA CreateWindowExW InvalidateRgn GetSystemMenu SetWindowLongW SetWindowTextW DispatchMessageA GetClipCursor EnumChildWindows GetSystemMetrics IsWindowEnabled ClipCursor SetCursor SetParent SetFocus GetWindow RegisterWindowMessageA PeekMessageW GetWindowTextW TranslateMessage GetRawInputData EnableWindow IsIconic IsWindowVisible IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos RedrawWindow SendInput EnumDisplayMonitors RegisterRawInputDevices DrawTextW SetWindowPlacement GetUpdateRect ChangeDisplaySettingsExW DispatchMessageW GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo FillRect ShowWindow SendMessageW PostQuitMessage PostMessageW GetActiveWindow SystemParametersInfoA LoadCursorW SetMenu PostThreadMessageW CreatePopupMenu CreateMenu CreateIcon RemoveMenu AppendMenuW InsertMenuW CheckMenuItem SetPropW DrawIconEx GetMonitorInfoW ReleaseDC MonitorFromRect GetDC SetWindowLongPtrW EnableMenuItem GetWindowLongPtrW GetMenuItemInfoW VkKeyScanW SetMenuItemInfoW DrawMenuBar CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu MapVirtualKeyW ShowCursor GetWindowPlacement AdjustWindowRectEx TranslateAcceleratorW GetMenu GetWindowLongW SystemParametersInfoW DefWindowProcW RegisterClassExW MonitorFromPoint FindWindowExW

gdi32

DeleteObject GetDeviceCaps CreateRectRgn SetBkMode SetTextColor DeleteDC SelectObject CreateDIBSection CreateCompatibleDC CombineRgn BitBlt CreateSolidBrush

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize RegisterDragDrop CoCreateFreeThreadedMarshaler CoTaskMemAlloc RevokeDragDrop CoInitialize

shell32

DragQueryFileW DragFinish ILCreateFromPathW ShellExecuteExW ShellExecuteW SHOpenFolderAndSelectItems ILFree SHCreateItemFromParsingName SHGetKnownFolderPath SHAppBarMessage

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

advapi32

RegGetValueW RegOpenKeyExW RegCloseKey RegQueryValueExW EventRegister EventSetInformation EventWriteTransfer EventUnregister SystemFunction036

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

SHCreateMemStream

ws2_32

WSASend shutdown send recv accept freeaddrinfo getaddrinfo WSACleanup WSAStartup select listen connect bind WSAIoctl ioctlsocket WSASocketW setsockopt closesocket getsockname WSAGetLastError getpeername getsockopt

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

floor roundf round trunc __setusermatherr pow

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s wcslen strlen _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm __p___argc _wassert _initterm_e __p___argv _seh_filter_exe _c_exit _register_thread_local_exe_atexit_callback exit _exit abort _initialize_onexit_table _register_onexit_function _crt_atexit terminate _cexit

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc free _callnewh

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale