SecretService[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecretService.exe
Size 62.0MB
Sample260825-2wva5abb42
SHA256 a62d7807ced87bd74680419263592c22613b9f18d073fcfcc5250ba9c0b327a9
MD5 036bef2f3b8df356673fe87c7b340479
SHA1 f8b6b3570f4836f7bb290cca45fbb6e7a04852a6
SHA512 d31ff805e67aa089a858efecae0ae5a6e84698b3816fe9540957481bc133ef75102a0c5352a731486814bed0c1234f14e52d806fbc8be3d0ac599fb175a684a8
SSDEEP 393216:oEkYkUw6pz9uRq/QahhdIUcq9gqS4SzWUw6pz9uRq/QahhdIUch9gqS4SzrUw6pe:M1q984H1h984sF4Nw4
TLSH
T117E77BD276E5D098C126D1B9CE02E6EFD66F7C198F2069DB36D0375F5A33A90263A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecretService.exe

File Explorer

SecretService.exe

.exe 62.0MB

SecretService.exe

IMPHASH 1a20197afa29823541fba03a42463200
SHA256 a62d7807ced87bd74680419263592c22613b9f18d073fcfcc5250ba9c0b327a9
MD5 036bef2f3b8df356673fe87c7b340479
SHA1 f8b6b3570f4836f7bb290cca45fbb6e7a04852a6
SHA512 d31ff805e67aa089a858efecae0ae5a6e84698b3816fe9540957481bc133ef75102a0c5352a731486814bed0c1234f14e52d806fbc8be3d0ac599fb175a684a8
SSDEEP 393216:oEkYkUw6pz9uRq/QahhdIUcq9gqS4SzWUw6pz9uRq/QahhdIUch9gqS4SzrUw6pe:M1q984H1h984sF4Nw4
TLSH
T117E77BD276E5D098C126D1B9CE02E6EFD66F7C198F2069DB36D0375F5A33A90263A700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

d3d9

Direct3DCreate9

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

gdi32

CreateRectRgn CreateRoundRectRgn DeleteObject GetDeviceCaps

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

user32

ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageW EmptyClipboard EnumWindows GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindow GetWindowLongPtrW GetWindowRect GetWindowThreadProcessId IsWindow IsWindowUnicode IsWindowVisible LoadCursorW MessageBoxW MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SendMessageTimeoutW SetCapture SetClipboardData SetCursor SetCursorPos SetProcessDPIAware SetWindowPos SetWindowRgn ShowWindow TrackMouseEvent TranslateMessage UnregisterClassA UpdateWindow

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strrchr strstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsscanf _close _fileno _fseeki64 _ftelli64 _get_osfhandle _setmode _wfopen _wopen fclose fflush fgetwc fopen fputc fputwc fread fseek ftell fwrite getc setbuf setvbuf ungetc ungetwc

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___wargv __p__wcmdln __sys_nerr _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler _wassert abort exit signal strerror strerror_s

api-ms-win-crt-environment-l1-1-0

__p__wenviron _putenv_s getenv

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _stricmp _strnicmp _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsxfrm_l isdigit isspace isxdigit mbrlen memset strcat strcmp strcpy strlen strncmp strncpy strnlen tolower toupper wcscmp wcscpy wcslen wcsncmp wcsnlen

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoui64 atof mbrtowc mbsrtowcs strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_strftime_l _time64

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen acosf atan2f ceilf cosf fmodf log logf lroundf pow powf sinf sqrtf

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort rand_s

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CopyFileW CreateDirectoryA CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateMutexW CreateRemoteThread CreateSymbolicLinkW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FreeLibrary GetActiveProcessorCount GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetProcAddress GetProcessId GetProcessTimes GetStartupInfoW GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadId GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MapViewOfFile Module32First Module32FirstW Module32Next Module32NextW MoveFileExW MultiByteToWideChar OpenProcess OpenThread Process32FirstW Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory ReleaseSRWLockExclusive RemoveDirectoryA ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetErrorMode SetEvent SetFileAttributesA SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SuspendThread SwitchToThread TerminateThread Thread32First Thread32Next TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnmapViewOfFile VerSetConditionMask VirtualAllocEx VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

515KB

Virtual Size

514KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ssc_evt

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

59.4MB

Virtual Size

59.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SecretService.exe

advapi32

bcrypt

d3d9

dwmapi

gdi32

ole32

user32

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic