loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 20.9MB
Sample260825-dwmpaastgs
SHA256 6974b80a3a9cc4c174e3a7fcdfb27bb07d91d15ce3456fd464fc2ef96592d6f9
MD5 4602130910a2325a4808cb796b1b3f32
SHA1 9d0193253d33529a88a8f0a468a8c8c52642ba33
SHA512 403333dc73cfa1254726e8e7f84aaafc61711e0cd47ccde43db6025dbf865695d72cf60fc8544a66629e6de0edc553e7530a78259c45b50212d2734c4d465b13
SSDEEP 393216:e0WoQ4PyQjAGgL542QOCzDIact9pBP00zAVpLRM8I7YSjbb7IlPuS0rG:7WoQ+yuFf3Ib/zYMTYsb5G
TLSH
T18D273356F36A03E8D0758038524B760FEE7134051B2095EB23A2259F6BAF7E5ABF1707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 20.9MB

loader.exe

IMPHASH 5dac18547480b7c126ddd8fd7ce8fdc8
SHA256 6974b80a3a9cc4c174e3a7fcdfb27bb07d91d15ce3456fd464fc2ef96592d6f9
MD5 4602130910a2325a4808cb796b1b3f32
SHA1 9d0193253d33529a88a8f0a468a8c8c52642ba33
SHA512 403333dc73cfa1254726e8e7f84aaafc61711e0cd47ccde43db6025dbf865695d72cf60fc8544a66629e6de0edc553e7530a78259c45b50212d2734c4d465b13
SSDEEP 393216:e0WoQ4PyQjAGgL542QOCzDIact9pBP00zAVpLRM8I7YSjbb7IlPuS0rG:7WoQ+yuFf3Ib/zYMTYsb5G
TLSH
T18D273356F36A03E8D0758038524B760FEE7134051B2095EB23A2259F6BAF7E5ABF1707
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

411552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Asus\Desktop\Loader\build\x64\Release\loader.pdb

dwmapi

DwmSetWindowAttribute

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

iphlpapi

GetAdaptersInfo

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData

shell32

ShellExecuteW SHGetKnownFolderPath

kernel32

FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter LocalFree GetCurrentThreadId GetCurrentProcess GetModuleHandleA GetProcAddress IsDebuggerPresent TerminateProcess OpenProcess CloseHandle RaiseException K32EnumProcessModulesEx K32GetModuleBaseNameW GetModuleFileNameA OutputDebugStringA WriteProcessMemory GetFullPathNameA WaitForSingleObject CreateToolhelp32Snapshot GetExitCodeThread Sleep GetTempPathA Process32NextW DeleteFileA Process32FirstW VirtualAllocEx CreateRemoteThread VirtualFreeEx GetLocaleInfoEx SizeofResource FindResourceA LoadResource UnmapViewOfFile GetLastError CreateFileMappingA MapViewOfFile GetModuleHandleW VirtualProtectEx GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFile2 CreateDirectoryW FindClose FindFirstFileW GetFileInformationByHandleEx WakeAllConditionVariable GetFileAttributesExW LockResource GetTickCount

user32

ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture EmptyClipboard GetKeyState DestroyWindow SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW CloseClipboard DispatchMessageW PeekMessageW TranslateMessage LoadIconW LoadCursorW GetWindowRect IsWindowVisible GetMessageExtraInfo GetWindowThreadProcessId GetCursorPos SetClipboardData DefWindowProcW OpenClipboard EnumWindows UpdateWindow GetClipboardData SetWindowLongW SetCursorPos PostQuitMessage SetLayeredWindowAttributes ShowWindow SetWindowPos GetWindowLongW GetWindowTextA

gdi32

CreateRoundRectRgn

advapi32

RegQueryValueExA RegOpenKeyExW RegCloseKey

ole32

CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoCreateInstance CoUninitialize CoTaskMemFree

oleaut32

SysFreeString VariantClear SysAllocString VariantInit

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??Bios_base@std@@QEBA_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Xbad_alloc@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Xtime_get_ticks

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException memset memmove memcpy memcmp __current_exception_context strchr strstr __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy memchr

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_narrow_argv _get_narrow_winmain_command_line _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback abort _initialize_narrow_environment _errno _beginthreadex

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strncpy_s toupper _wcsicmp strcmp strlen strncmp strncpy wcslen

api-ms-win-crt-stdio-l1-1-0

_wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell __stdio_common_vsscanf __p__commode __stdio_common_vsprintf_s _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fwrite __stdio_common_vsnprintf_s fgetc fclose fflush fputc _set_fmode __stdio_common_vsprintf fgetpos

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

acosf fmodf sqrtf cosf sinf ceilf __setusermatherr