roxie[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
roxie.exe
Size 956KB
Sample260827-slapaswsft
SHA256 bd407efc85bf3bd3bc33b8ae9464b8895db7d6a45747e066e820cb2d620394df
MD5 9e436f64de415061f9657383e40d489a
SHA1 71d96c0599e093192ff0d1564db8968fbd211afb
SHA512 9e147b845d5212ca05d34001fc6a26f55457b703f99cd232f1e0c93e6783690531bfb8ba4e062e446ecb8961ca2306c1df8154356d0579d6a3e8730899f7aa48
SSDEEP 24576:KvZT0AivewuREIF2zIWZKMjMKJRhBMkayZww1R+gwy:KvZTQmwuREIF2zdoMjMK7L1Rd
TLSH
T113258D19AB5402F4D0B7D57CCE835413FB72784A43759AEB17D09A6A3F276E08A3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
roxie.exe

File Explorer

roxie.exe

.exe 956KB

roxie.exe

IMPHASH 98184f3df3fc0152b01a76800210a593
SHA256 bd407efc85bf3bd3bc33b8ae9464b8895db7d6a45747e066e820cb2d620394df
MD5 9e436f64de415061f9657383e40d489a
SHA1 71d96c0599e093192ff0d1564db8968fbd211afb
SHA512 9e147b845d5212ca05d34001fc6a26f55457b703f99cd232f1e0c93e6783690531bfb8ba4e062e446ecb8961ca2306c1df8154356d0579d6a3e8730899f7aa48
SSDEEP 24576:KvZT0AivewuREIF2zIWZKMjMKJRhBMkayZww1R+gwy:KvZTQmwuREIF2zdoMjMK7L1Rd
TLSH
T113258D19AB5402F4D0B7D57CCE835413FB72784A43759AEB17D09A6A3F276E08A3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

31313131

Minor OS version

Major OS version

Entry point

970240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError Process32NextW CreateFileA FileTimeToSystemTime LoadLibraryA QueryPerformanceFrequency DeleteFileA Process32FirstW CloseHandle GetLocalTime FillConsoleOutputAttribute Beep GetProcAddress SetFilePointerEx CreateFileMappingA LocalFree ExitProcess GetCurrentProcessId CreateProcessW FreeLibrary CreateProcessA GetSystemTimeAsFileTime GetSystemTime SetConsoleCursorPosition QueryPerformanceCounter GetTickCount SetConsoleTitleW ConnectNamedPipe GetTickCount64 GetExitCodeProcess SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess DisconnectNamedPipe ReleaseMutex GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexA FindClose GetEnvironmentVariableA CreateMutexW SetSystemTime CreateNamedPipeW GetModuleFileNameW TerminateProcess DeviceIoControl OutputDebugStringA ExpandEnvironmentStringsW WriteFile GetStdHandle GetCurrentProcess SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW HeapReAlloc GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FindNextFileW SetConsoleTextAttribute GetConsoleScreenBufferInfo GetFileSizeEx FindFirstFileW SetConsoleCtrlHandler FillConsoleOutputCharacterA GetModuleFileNameA ReadFile FlushFileBuffers CreateDirectoryW FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection FormatMessageA GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread LCMapStringEx InitializeCriticalSectionEx

user32

GetWindowThreadProcessId MessageBoxW GetShellWindow GetAsyncKeyState

advapi32

CloseServiceHandle DuplicateTokenEx CryptGetHashParam ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceW CheckTokenMembership FreeSid OpenProcessToken CryptDestroyHash LookupPrivilegeValueW AdjustTokenPrivileges CryptAcquireContextW QueryServiceStatus CryptReleaseContext OpenSCManagerW AllocateAndInitializeSid CreateProcessWithTokenW CryptCreateHash CryptHashData

shell32

ShellExecuteExW ShellExecuteW ShellExecuteA

bcrypt

BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptDecrypt BCryptFinalizeKeyPair BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptExportKey BCryptFinishHash BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptGenRandom BCryptCloseAlgorithmProvider

crypt32

CryptDecodeObjectEx CertCreateSelfSignCertificate CertFreeCertificateContext CryptStringToBinaryA CryptBinaryToStringA PFXExportCertStore CertCloseStore CertStrToNameA CryptImportPublicKeyInfoEx2 CertOpenStore

wininet

InternetConnectA InternetQueryOptionA HttpOpenRequestA InternetSetOptionA HttpAddRequestHeadersA InternetReadFile InternetOpenA HttpSendRequestA InternetCloseHandle HttpQueryInfoA

winhttp

WinHttpSetOption WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle

ws2_32

htons setsockopt htonl recv accept bind closesocket listen inet_pton WSAStartup send WSAGetLastError socket connect

secur32

DeleteSecurityContext FreeCredentialsHandle EncryptMessage FreeContextBuffer DecryptMessage QueryContextAttributesW AcquireCredentialsHandleW InitializeSecurityContextW AcceptSecurityContext

Name

.text

Size

617KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

roxie.exe

kernel32

user32

advapi32

shell32

bcrypt

crypt32

wininet

winhttp

ws2_32

secur32

generic