loyal[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loyal.exe
Size 1.1MB
Sample260827-t97vdaybpc
SHA256 0b20747dc327046e9f8ec7abf25f262b35ac3a06323d2d273e433bd38f009aa8
MD5 86d3cf9b322782abcf1a1d352c561105
SHA1 3648c2dabadd4b15a44fb652cb94e08db24e3075
SHA512 724016ffc06be9c6807defce69aecdc3b2aa6bd8837ca2c1c55a24f9ff08b14c30c0a54d3c9d12a4105771c8df234fe85ffe7ec6cc73940d621d99b248838e85
SSDEEP 24576:sZKvY6YZrSHVWINPqbHhEu1MumKynyv81hu:sZOY1bHjyn
TLSH
T14C35BE13F36482ACD42B5838C6969787FB3578101B2986DB33D42B596F972F01BBB2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loyal.exe

File Explorer

loyal.exe

.exe 1.1MB

loyal.exe

IMPHASH 35a3d7cc03262daf82f2050661b83295
SHA256 0b20747dc327046e9f8ec7abf25f262b35ac3a06323d2d273e433bd38f009aa8
MD5 86d3cf9b322782abcf1a1d352c561105
SHA1 3648c2dabadd4b15a44fb652cb94e08db24e3075
SHA512 724016ffc06be9c6807defce69aecdc3b2aa6bd8837ca2c1c55a24f9ff08b14c30c0a54d3c9d12a4105771c8df234fe85ffe7ec6cc73940d621d99b248838e85
SSDEEP 24576:sZKvY6YZrSHVWINPqbHhEu1MumKynyv81hu:sZOY1bHjyn
TLSH
T14C35BE13F36482ACD42B5838C6969787FB3578101B2986DB33D42B596F972F01BBB2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

535152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CloseServiceHandle OpenSCManagerA OpenServiceW QueryServiceConfigW QueryServiceStatusEx RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW

wintrust

WinVerifyTrust

crypt32

CryptQueryObject CertGetNameStringA CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext

setupapi

SetupDiGetDeviceInstanceIdA SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

InitializeSListHead QueryDosDeviceW GetSystemTimeAsFileTime GetTickCount64 SearchPathW CreateFileA FileTimeToLocalFileTime FindClose FindFirstFileA FindNextFileA ReleaseSRWLockExclusive GetFileAttributesExA GetFileSize ReadFile CloseHandle GetModuleHandleW GetProcAddress FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte GetLastError LocalAlloc LocalFree SystemTimeToTzSpecificLocalTime GetTempPathA GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA Sleep GetCurrentProcessId GetCurrentThreadId GetDynamicTimeZoneInformation GetStdHandle WriteFile GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetFileAttributesA

user32

GetIconInfo TranslateMessage LoadCursorA ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture DrawIconEx GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetCursorPos GetWindowRect UpdateWindow GetSystemMetrics SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageA DispatchMessageA DestroyIcon ReleaseDC GetDC GetKeyState

gdi32

CreateDIBSection DeleteDC CreateCompatibleDC GetObjectA SelectObject DeleteObject

shell32

ShellExecuteA SHGetFileInfoW

msvcp140

??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Cnd_signal _Thrd_id _Thrd_join ?id@?$numpunct@D@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xbad_function_call@std@@YAXXZ _Xtime_get_ticks _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z

urlmon

URLDownloadToFileA

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

vcruntime140

__current_exception_context memmove __std_exception_copy __std_exception_destroy _CxxThrowException __current_exception memchr memcmp memcpy _purecall memset __std_terminate strstr __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

_stricmp isdigit towlower strcmp strncmp wcslen strncpy toupper strlen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh calloc

api-ms-win-crt-stdio-l1-1-0

fputs fopen fclose fflush _set_fmode _wfopen fseek _fsopen ftell __stdio_common_vsprintf_s __p__commode fwrite __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf fread __acrt_iob_func

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr fmodf sqrtf _dsign acosf cosf sinf

api-ms-win-crt-runtime-l1-1-0

_get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv exit _initterm _errno _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _exit terminate _beginthreadex _initterm_e

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

strftime _gmtime64_s _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_mkdir _stat64i32

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale