5meo-dmt[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
5meo-dmt.exe
Size 3.5MB
Sample260825-xp5fasae99
SHA256 b07bdd86fc10c6372016159a3211e34066490e57145258e5fa117c8d3feefd01
MD5 bb498ebd5a556ccb89689b7a4f629bfc
SHA1 daa5a36caae651b53cd367ffcdcc8c4ac2359ee9
SHA512 bf61c26bb772333f3fd285299f8b85359bde3a5363a59451f3988d80e0a9f7e71fb877f339f939821c835b8178d2b4aba1a54f496187665ccd316175369d4741
SSDEEP 98304:9DTjkRdfDoLQ9cRw62Tdo/f7mgTm05AwJHE6h:VkRdfDoLQ9ceaX7PAmk
TLSH
T15106AE0EF2EA06ADE2A2D17CC5665313E376741E172096FB26D401D86F63AD85B3DF02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5meo-dmt.exe

File Explorer

5meo-dmt.exe

.exe 3.5MB

5meo-dmt.exe

IMPHASH 3f75c73354e317ab0734e0af60bc7e47
SHA256 b07bdd86fc10c6372016159a3211e34066490e57145258e5fa117c8d3feefd01
MD5 bb498ebd5a556ccb89689b7a4f629bfc
SHA1 daa5a36caae651b53cd367ffcdcc8c4ac2359ee9
SHA512 bf61c26bb772333f3fd285299f8b85359bde3a5363a59451f3988d80e0a9f7e71fb877f339f939821c835b8178d2b4aba1a54f496187665ccd316175369d4741
SSDEEP 98304:9DTjkRdfDoLQ9cRw62Tdo/f7mgTm05AwJHE6h:VkRdfDoLQ9ceaX7PAmk
TLSH
T15106AE0EF2EA06ADE2A2D17CC5665313E376741E172096FB26D401D86F63AD85B3DF02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

824416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\za\Documents\Injector\build\5meo-dmt.pdb

advapi32

RegSetValueExW RegDeleteTreeW RegCreateKeyExW RegCloseKey GetTokenInformation GetLengthSid ConvertSidToStringSidW OpenProcessToken IsValidSid CopySid CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptEncrypt SetSecurityInfo RegDeleteKeyA RegCreateKeyExA InitializeAcl AddAccessAllowedAce

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetTickCount64 GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA AddDllDirectory SetDefaultDllDirectories QueryFullProcessImageNameW SetDllDirectoryW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection QueryPerformanceFrequency FreeLibrary LoadLibraryW SleepEx GetSystemInfo GetTickCount GetLastError WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CheckRemoteDebuggerPresent SleepConditionVariableSRW GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW CreateDirectoryW GetLocaleInfoEx FormatMessageA HeapSize InitializeCriticalSectionEx HeapFree GlobalFindAtomA FreeConsole WideCharToMultiByte MultiByteToWideChar DeleteFileW Process32FirstW Process32NextW CreateToolhelp32Snapshot FlushInstructionCache GetModuleHandleW GetCurrentDirectoryW FindClose VirtualAlloc IsDebuggerPresent GetThreadContext GetCurrentThread GetFileAttributesA GetModuleFileNameW GetProcessHeap DeleteCriticalSection LocalFree HeapDestroy HeapAlloc WakeAllConditionVariable HeapReAlloc GetCurrentProcess FindNextFileW VirtualFree VirtualProtect FindFirstFileW AllocConsole ExitProcess GetProcAddress CreateThread CloseHandle Sleep GetModuleHandleA CreateFileW GetStartupInfoW OutputDebugStringW MoveFileExW

user32

MessageBoxA

shell32

ShellExecuteA

msvcp140

??7ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Random_device@std@@YAIXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Xtime_get_ticks ?uncaught_exception@std@@YA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??Bios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain CertFindExtension CertOpenStore

ws2_32

sendto gethostname listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername WSAGetLastError connect bind WSACleanup WSAStartup WSASetLastError ntohs closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt inet_ntop inet_pton freeaddrinfo getaddrinfo ntohl ioctlsocket recvfrom

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memcpy memmove memset __std_exception_destroy memchr strstr wcschr __current_exception __current_exception_context __C_specific_handler _CxxThrowException __std_terminate strrchr __std_exception_copy strchr

api-ms-win-crt-string-l1-1-0

isspace tolower _stricmp towlower strcmp isxdigit strspn _wcsicmp strlen _strdup wcsncpy strpbrk wcsncmp wcslen strcspn wcspbrk _wcsdup strncmp

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _popen ftell _close _fileno fseek _write feof _read fputs _fseeki64 fgetpos _pclose __p__commode fgetc __stdio_common_vsscanf _wopen _set_fmode fclose __stdio_common_vfprintf _wfopen fflush fputc fread _lseeki64 fsetpos freopen_s ungetc __acrt_iob_func __stdio_common_vsprintf fwrite setvbuf fgets

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlink _fstat64 _unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _invoke_watson _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e _exit _beginthreadex _cexit _invalid_parameter_noinfo _register_thread_local_exe_atexit_callback __sys_errlist __sys_nerr system terminate _initialize_onexit_table _register_onexit_function _crt_atexit abort _resetstkoflw _c_exit _errno exit

api-ms-win-crt-heap-l1-1-0

_recalloc realloc calloc malloc free _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

_dsign __setusermatherr _dclass _fdopen

api-ms-win-crt-convert-l1-1-0

strtoll strtoul strtoull wcstombs strtol atoi strtod

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _localtime64 _time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort