Atlas temp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Atlas temp.exe
Size 2.5MB
Sample260828-c16ghssfle
SHA256 799a358d735e97aa494cf436b0159fc790e51abbe2fd58f052acdc2ba4299ef7
MD5 e001d1d41557e6123372efa5e3a026b0
SHA1 91a149a4759aa73f573074aa695349619d73742f
SHA512 f423ca6021923617f705487c270c970bbee9168ae68fa85a152be3737718523ee124ab692b44a90174ea05f7c8620ca94be83142f91455787ec929e289511ff0
SSDEEP 24576:0HvDoxz6N5GvKhaAHaLGpcqLuZibxARnjgKw4EEn7mYy8Ufm850UbHhEu1Mum:0H7oxz6/WAHhpcclAdsqnfyNbHj
TLSH
T147C5BE83FE0356DDD602AA7466A2631BB32736691B19C6FF70E12D616B072D007A73CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Atlas temp.exe

File Explorer

Atlas temp.exe

.exe 2.5MB

Atlas temp.exe

IMPHASH 0d6cd6f31ac014cd78edf529ab9b87b5
SHA256 799a358d735e97aa494cf436b0159fc790e51abbe2fd58f052acdc2ba4299ef7
MD5 e001d1d41557e6123372efa5e3a026b0
SHA1 91a149a4759aa73f573074aa695349619d73742f
SHA512 f423ca6021923617f705487c270c970bbee9168ae68fa85a152be3737718523ee124ab692b44a90174ea05f7c8620ca94be83142f91455787ec929e289511ff0
SSDEEP 24576:0HvDoxz6N5GvKhaAHaLGpcqLuZibxARnjgKw4EEn7mYy8Ufm850UbHhEu1Mum:0H7oxz6/WAHhpcclAdsqnfyNbHj
TLSH
T147C5BE83FE0356DDD602AA7466A2631BB32736691B19C6FF70E12D616B072D007A73CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1127740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BEST FREE CHEETOS SOURCES\Done Temp\Atlas Free Temp\build\Atlas Free Temp.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GetCurrentProcess TerminateProcess SetProcessShutdownParameters CreatePipe WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW DeleteFileA Process32FirstW CloseHandle CreateProcessW WideCharToMultiByte CreateProcessA VirtualQuery IsDebuggerPresent CheckRemoteDebuggerPresent MultiByteToWideChar GlobalAlloc GlobalFree VirtualProtect GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent SetPriorityClass ReadFile GetModuleHandleW FreeLibrary GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead HeapFree HeapAlloc GetProcAddress GetFileSizeEx CreateFileA GlobalLock

user32

DispatchMessageW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard MoveWindow GetWindowRect UpdateWindow CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetForegroundWindow GetWindowLongW DefWindowProcW ShowWindow RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW DestroyWindow PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage SetWindowLongA

advapi32

OpenServiceA OpenSCManagerA ControlService StartServiceA CloseServiceHandle

shell32

ShellExecuteA

msvcp140

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException memchr longjmp strrchr strstr __std_terminate __std_exception_copy __std_exception_destroy memcmp memcpy memset

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-runtime-l1-1-0

terminate _invoke_watson _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type exit _get_narrow_winmain_command_line _initterm _initterm_e _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_wfopen __p__commode _set_fmode _fseeki64 __stdio_common_vsscanf fclose __acrt_iob_func fseek ftell __stdio_common_vfprintf fflush _get_stream_buffer_pointers fread fsetpos ungetc setvbuf fgetpos fwrite __stdio_common_vsprintf fgetc fputc

api-ms-win-crt-string-l1-1-0

strncpy strcmp tolower strncmp

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

sin powf sinf sqrtf fmodf __setusermatherr expf cosf acosf ceilf tan

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

547KB

Virtual Size

546KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

894KB

Virtual Size

897KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1337

Size

512B

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Atlas temp.exe

d3d11

d3dcompiler_47

dwmapi

kernel32

user32

advapi32

shell32

msvcp140

ntdll

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic