prob a rat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
prob a rat.exe
Size 7.9MB
Sample260824-tmpqaaal71
SHA256 db77aa8a2a0b98594899ba9dc103a31c72164dc77c74eab2f72c85396f998906
MD5 fcc0ddafc2368c569900b6d444d959ab
SHA1 c5704aec87569b55eda5153150f04785e7bcdc0c
SHA512 8b1e94e3a60446cd5c78dcee1351e6d23d7176412b4c23c51f2bc2c70bdc1e1836f391028d4b1bf334ff8315d0b5f663a0557f7a5a89a4cfd8b0e537857f5c0c
SSDEEP 49152:SY6vw3RX9VMw08K333/oZmru/N3fOpPcO6KXT/eBS5R0mS5S3pP43Yhn7Ht:X6I3lMj3n/otZOp09KXTqUJdHt
TLSH
T1218659B48A5C9B4EF066B039C187521757F1BC0E57A2DFCB9AC09DB7481F488F61A60E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
prob a rat.exe

File Explorer

prob a rat.exe

.exe 7.9MB

prob a rat.exe

IMPHASH 726b0e5af62373163e5e898794f79db8
SHA256 db77aa8a2a0b98594899ba9dc103a31c72164dc77c74eab2f72c85396f998906
MD5 fcc0ddafc2368c569900b6d444d959ab
SHA1 c5704aec87569b55eda5153150f04785e7bcdc0c
SHA512 8b1e94e3a60446cd5c78dcee1351e6d23d7176412b4c23c51f2bc2c70bdc1e1836f391028d4b1bf334ff8315d0b5f663a0557f7a5a89a4cfd8b0e537857f5c0c
SSDEEP 49152:SY6vw3RX9VMw08K333/oZmru/N3fOpPcO6KXT/eBS5R0mS5S3pP43Yhn7Ht:X6I3lMj3n/otZOp09KXTqUJdHt
TLSH
T1218659B48A5C9B4EF066B039C187521757F1BC0E57A2DFCB9AC09DB7481F488F61A60E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7857392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\Projects !\YhujinFFLAG\x64\Release\yhujin.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

shell32

DragQueryFileW DragAcceptFiles DragFinish SHCreateItemFromParsingName SHGetFolderPathA ShellExecuteA

kernel32

RtlUnwindEx ReadFile GetModuleFileNameA GetFileSizeEx WriteProcessMemory FindFirstFileA GetCurrentProcess WriteFile VirtualAlloc FindNextFileA SetFilePointer GetEnvironmentVariableA FindClose WaitForSingleObject GetCurrentThreadId GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTickCount64 GetLastError GetFileAttributesA Process32NextW QueryFullProcessImageNameA CreateFileA DeleteFileA lstrcpyA Process32FirstW CloseHandle CreateThread Module32FirstW GetLocalTime VirtualProtectEx GetProcAddress GetCurrentProcessId GetModuleHandleW WideCharToMultiByte Module32NextW CreateDirectoryA SetUnhandledExceptionFilter GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA FlsSetValue QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW GetStringTypeW WakeAllConditionVariable GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx GetExitCodeThread WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive RaiseException RtlPcToFileHeader SetLastError FlsAlloc VirtualQueryEx FlsGetValue IsProcessorFeaturePresent ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess GetModuleFileNameW GetStdHandle RtlCaptureContext RtlVirtualUnwind FlsFree IsDebuggerPresent UnhandledExceptionFilter SetFilePointerEx SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile LoadLibraryA RtlUnwind GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetFileType HeapFree HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetCommandLineA VirtualProtect FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage ReadConsoleW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW

user32

GetWindow ReleaseDC IsIconic GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId DefWindowProcW ScreenToClient GetWindowRect DestroyWindow GetDC IsWindowVisible CreateWindowExW SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW GetForegroundWindow MoveWindow EnumWindows SetLayeredWindowAttributes TranslateMessage GetClassNameW UpdateLayeredWindow PostQuitMessage UpdateWindow

gdi32

SelectObject CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse

gdiplus

GdipCreateFontFamilyFromName GdipSetPenStartCap GdipDeleteBrush GdipDeletePath GdipCreateLineBrushFromRect GdipSetSmoothingMode GdipFlush GdipSetClipPath GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipResetPath GdipFillPath GdipDrawLine GdipResetClip GdipFillRectangle GdipClosePathFigure GdipDrawPath GdipDrawString GdipSetPenLineJoin GdipCreateFromHDC GdipFillEllipse GdipSetPenEndCap GdipSetTextRenderingHint GdipDrawEllipse GdipAddPathArc GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipSetStringFormatAlign GdipDeleteFontFamily GdipCreateStringFormat GdiplusShutdown GdiplusStartup GdipSetPixelOffsetMode GdipCreatePen1

dbghelp

MiniDumpWriteDump

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

Name

.text

Size

7.7MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

prob a rat.exe

d3d11

d3dcompiler_47

dwmapi

shell32

kernel32

user32

gdi32

ole32

winhttp

gdiplus

dbghelp

imm32

generic