lrBLAhicxSpsRNH7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
lrBLAhicxSpsRNH7.exe
Size 30.9MB
Sample260825-3f196sbb76
SHA256 83581a06778bf345333e5c6b842a531be231054c7e6728c45a51e8a94afa4395
MD5 f9271694e6e873f990ccc65e81e4d29f
SHA1 0e6c1f3b77f913b257f76e6906724ddd65084aeb
SHA512 e684b24254f5dabb08e007774d4c7dc88d9b138f68befe89dde79a02da325151284e7f71b143107b76273596404cc865613698a0eada09d2da16ba3fa5c53eeb
SSDEEP 196608:Q9Ml6vYQ8VvPeb1UBDglPC0Y/OnFt7yO7uq5Evpq07kUM:QB8VvPeb1ADOC0Y/OnFt7yOBEh7kUM
TLSH
T1696796215B4D8745D126BD3CD0874A01D3F5BF88C32E8F1F9BE08CE9669B6427A1EA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lrBLAhicxSpsRNH7.exe

File Explorer

lrBLAhicxSpsRNH7.exe

.exe 30.9MB

lrBLAhicxSpsRNH7.exe

IMPHASH afb09139f77869da8b9bf95622e948d7
SHA256 83581a06778bf345333e5c6b842a531be231054c7e6728c45a51e8a94afa4395
MD5 f9271694e6e873f990ccc65e81e4d29f
SHA1 0e6c1f3b77f913b257f76e6906724ddd65084aeb
SHA512 e684b24254f5dabb08e007774d4c7dc88d9b138f68befe89dde79a02da325151284e7f71b143107b76273596404cc865613698a0eada09d2da16ba3fa5c53eeb
SSDEEP 196608:Q9Ml6vYQ8VvPeb1UBDglPC0Y/OnFt7yO7uq5Evpq07kUM:QB8VvPeb1ADOC0Y/OnFt7yOBEh7kUM
TLSH
T1696796215B4D8745D126BD3CD0874A01D3F5BF88C32E8F1F9BE08CE9669B6427A1EA4D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27491244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Documents\GitHub\web\loader\binary\Production\loader.pdb

ws2_32

freeaddrinfo WSASetLastError listen inet_ntop WSAStartup getaddrinfo WSACleanup WSAGetLastError setsockopt ioctlsocket htons htonl getsockopt ntohl select gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname recv send socket shutdown recvfrom sendto WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSARecv WSAAddressToStringW connect WSASend ntohs getsockname getpeername closesocket gethostname inet_pton __WSAFDIsSet accept bind WSAIoctl WSASocketW

iphlpapi

GetAdaptersInfo GetAdaptersAddresses GetNetworkParams

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoCreateInstance CoInitialize CoUninitialize

kernel32

CreateProcessA GetSystemFirmwareTable HeapFree DeviceIoControl GetComputerNameExW CreateFileA HeapAlloc GetProcessHeap GlobalMemoryStatusEx ResumeThread GetThreadContext GetThreadId SetThreadContext GetCommandLineA ExitProcess ReadFile WaitNamedPipeA SetWaitableTimer SetLastError GetUserDefaultLocaleName InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateMutexA CreateEventW GetTimeZoneInformation GetTickCount64 CreateWaitableTimerA GetFileSize SleepEx GetSystemTimeAsFileTime CreateIoCompletionPort FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection OutputDebugStringW VirtualFree InitializeCriticalSection CreateProcessW GetExitCodeProcess GetModuleFileNameW GetFileAttributesW CreateActCtxW GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW OutputDebugStringA GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First CreateNamedPipeW CreateThread GetExitCodeThread GetProcessId OpenProcess IsWow64Process Process32Next VirtualAllocEx VirtualFreeEx WriteProcessMemory VirtualProtectEx ReadProcessMemory CreateRemoteThread VirtualQueryEx LoadLibraryW SuspendThread GetThreadTimes OpenThread SetNamedPipeHandleState LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP SetFilePointerEx SetStdHandle FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW LoadLibraryExW RtlUnwind RtlUnwindEx GetCPInfo LCMapStringEx EncodePointer GetStringTypeW RaiseException WakeConditionVariable TryAcquireSRWLockExclusive CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW GetModuleFileNameA QueueUserAPC TerminateThread SetEvent CreateToolhelp32Snapshot Module32First Module32Next TerminateProcess Process32First FormatMessageA GetCurrentProcessId GetConsoleMode Sleep GetDynamicTimeZoneInformation WriteFile WriteConsoleA GetStdHandle SetConsoleTextAttribute CreateSemaphoreW GetConsoleScreenBufferInfo CreateDirectoryA DeleteCriticalSection LocalFree DecodePointer GetFileAttributesA GetLastError GetTempPathA GetCurrentThreadId InitializeCriticalSectionEx GetCurrentProcess QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW AreFileApisANSI ReleaseSemaphore SetUnhandledExceptionFilter WriteConsoleW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive SetFileInformationByHandle FormatMessageW PostQueuedCompletionStatus WaitForSingleObject LeaveCriticalSection WaitForMultipleObjects GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetLocaleInfoEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetFileSizeEx VerifyVersionInfoW PeekNamedPipe GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW FindNextFileW FindFirstFileW FindClose ReadConsoleW ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread SystemTimeToFileTime CreateFiberEx DeleteFiber SwitchToFiber CreateSemaphoreA GetACP HeapReAlloc HeapSize HeapQueryInformation EnterCriticalSection GetSystemTime SetEndOfFile IsValidCodePage DeleteFileA GetModuleHandleW CloseHandle GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW TransactNamedPipe WaitNamedPipeW GetFileType GetSystemInfo VirtualProtect GetSystemDirectoryA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc AcquireSRWLockShared InitializeSRWLock

user32

PostQuitMessage DefWindowProcA GetMonitorInfoA SetWindowLongA RegisterClassExW UnregisterClassW GetSystemMetrics GetUserObjectInformationW GetProcessWindowStation SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode UpdateWindow GetClientRect DispatchMessageA SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow LoadCursorA GetMessageExtraInfo GetKeyState MessageBoxW EnumDisplayDevicesW GetWindowRect SetProcessDPIAware GetDpiForSystem ShowWindow CreateWindowExW SetWindowPos PeekMessageA MoveWindow SetCursor PostMessageA DestroyWindow wsprintfW MessageBoxA TranslateMessage

gdi32

CreateRectRgn DeleteObject

advapi32

RegDeleteValueA RegSetValueExA RegCreateKeyExA RegQueryValueExA CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegDeleteKeyA RegCloseKey RegDeleteTreeA OpenServiceA OpenSCManagerA CloseServiceHandle QueryServiceStatus LookupPrivilegeValueA AdjustTokenPrivileges RegEnumKeyExA RegEnumValueA GetUserNameW ConvertSidToStringSidW CreateProcessAsUserA SetThreadToken SetTokenInformation LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegEnumValueW OpenSCManagerW GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority ConvertStringSecurityDescriptorToSecurityDescriptorA ControlService FreeSid CheckTokenMembership OpenServiceW RevertToSelf PrivilegeCheck RegOpenKeyExA

oleaut32

VariantClear SysFreeString

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

dwmapi

DwmGetColorizationColor DwmIsCompositionEnabled DwmEnableBlurBehindWindow

shlwapi

SHDeleteKeyW

ntdll

RtlInitAnsiString RtlNtStatusToDosError RtlFreeUnicodeString RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlAnsiStringToUnicodeString

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CryptStringToBinaryW CertOpenStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain PFXImportCertStore

wininet

InternetCrackUrlW InternetOpenW InternetCloseHandle InternetConnectW InternetReadFile HttpQueryInfoW InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetQueryDataAvailable

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

26.6MB

Virtual Size

26.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

403KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vmp

Size

400KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmpd

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vbreloc

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

lrBLAhicxSpsRNH7.exe

ws2_32

iphlpapi

d3d11

d3dcompiler_47

ole32

kernel32

user32

gdi32

advapi32

oleaut32

imm32

dwmapi

shlwapi

ntdll

bcrypt

crypt32

wininet

generic