Setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Setup.exe
Size 8.2MB
Sample260828-kr464awake
SHA256 01ba424a2b0f8be9b4a31a1b365eded53426f8cda91ef381c1aa1f198a187f2a
MD5 9ab89cd64a6a444fedb5aaa3a98336c5
SHA1 f601f802a530339538ce7d08f9fe9cd7856fda7d
SHA512 1b25c74ca687e11736164d3ac584f4cfdb7fe9de81d9ab64eee9c3613947d35857da265e2dcf9a232577a5062482d816b6fc166d9c0941d9c584cc6fc39f1b17
SSDEEP 49152:7Z2LuqkQufps65n6cVUzyGJmwhegZuUzzX/MEIkLidkaVLl6FWTOnsGacxNNVUF/:FAHN/Xd3fqXEMN2yc5UiMnV
TLSH
T123864A12BB6A49ACC59BC0B4825647625A3174CB0B34BAFF44C486393F7AAF11F7C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Setup.exe

File Explorer

Setup.exe

.exe 8.2MB

Setup.exe

IMPHASH 205f8e708e516fb425cee75978003de6
SHA256 01ba424a2b0f8be9b4a31a1b365eded53426f8cda91ef381c1aa1f198a187f2a
MD5 9ab89cd64a6a444fedb5aaa3a98336c5
SHA1 f601f802a530339538ce7d08f9fe9cd7856fda7d
SHA512 1b25c74ca687e11736164d3ac584f4cfdb7fe9de81d9ab64eee9c3613947d35857da265e2dcf9a232577a5062482d816b6fc166d9c0941d9c584cc6fc39f1b17
SSDEEP 49152:7Z2LuqkQufps65n6cVUzyGJmwhegZuUzzX/MEIkLidkaVLl6FWTOnsGacxNNVUF/:FAHN/Xd3fqXEMN2yc5UiMnV
TLSH
T123864A12BB6A49ACC59BC0B4825647625A3174CB0B34BAFF44C486393F7AAF11F7C758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5729712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

emi_client.pdb

kernel32

AreFileApisANSI GetCurrentThreadId SetThreadPriority WaitForMultipleObjectsEx GetFullPathNameA SetEndOfFile UnregisterWaitEx DuplicateHandle UnlockFileEx GetTempPathW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA GetDiskFreeSpaceA GetFileAttributesA SetHandleInformation GetFileAttributesExW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc LoadLibraryW HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize GetSystemTimeAsFileTime CreateIoCompletionPort SetFileCompletionNotificationModes GetSystemTime CreateFileMappingW GetOverlappedResult PostQueuedCompletionStatus CancelIoEx GetQueuedCompletionStatusEx MapViewOfFile GetTickCount FlushFileBuffers HeapCreate GetModuleHandleA OpenProcess GetProcessIoCounters GetSystemTimes GetExitCodeProcess GetSystemInfo VirtualQueryEx GlobalMemoryStatusEx GetCurrentProcessId GetProcessTimes GetComputerNameExW GetModuleHandleW LocalFree SetNamedPipeHandleState CreateFileW CloseHandle FreeLibrary K32GetPerformanceInfo GetProcAddress WaitForSingleObject CreateEventW CreateMutexW GetCurrentProcess CreateEventA SetEvent GetConsoleWindow FormatMessageW LoadLibraryExA GetLastError InitializeSListHead ReadProcessMemory HeapFree ReadFile GetFullPathNameW FindNextFileW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext HeapAlloc GetProcessHeap WriteFile TerminateProcess GetProcessId GetSystemTimePreciseAsFileTime GetDiskFreeSpaceW LockFile WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW QueryPerformanceCounter FormatMessageA WideCharToMultiByte SystemTimeToFileTime OutputDebugStringW MultiByteToWideChar OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection CompareStringOrdinal FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW CancelIo QueryPerformanceFrequency SleepEx ReadFileEx WaitForMultipleObjects ExitProcess GetModuleFileNameW GetConsoleMode SetFilePointer FindClose lstrlenW CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle FindFirstFileExW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW GetFinalPathNameByHandleW GetFileInformationByHandle SwitchToThread GetFileInformationByHandleEx CopyFileExW MoveFileExW CreateDirectoryW SetUnhandledExceptionFilter

advapi32

RegCloseKey RegQueryValueExW IsValidSid GetLengthSid CopySid GetUserNameW RegOpenKeyTransactedW RegCreateKeyTransactedW RegDeleteValueW SystemFunction036 RegSetValueExW RegCreateKeyExW RegOpenKeyExW OpenProcessToken GetTokenInformation

oleaut32

GetErrorInfo SysStringLen SysFreeString

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

getsockname getsockopt getpeername recv WSASend send setsockopt ioctlsocket connect WSASocketW bind shutdown closesocket WSAStartup WSACleanup WSAGetLastError freeaddrinfo WSAIoctl getaddrinfo

crypt32

CryptUnprotectData CertGetCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateStore CertFreeCertificateChain CertDuplicateCertificateChain CertAddCertificateContextToStore CertOpenStore CertEnumCertificatesInStore CertCloseStore

secur32

InitializeSecurityContextW AcquireCredentialsHandleA FreeCredentialsHandle QueryContextAttributesW DeleteSecurityContext ApplyControlToken DecryptMessage EncryptMessage AcceptSecurityContext FreeContextBuffer

bcrypt

BCryptGenRandom

ntdll

RtlGetVersion NtQuerySystemInformation NtOpenFile NtQueryInformationProcess NtCreateFile NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtReadFile NtCreateNamedPipeFile

bcryptprimitives

ProcessPrng

user32

ShowWindow GetMonitorInfoW EnumDisplaySettingsExW MonitorFromPoint EnumDisplayMonitors

shell32

CommandLineToArgvW ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree PropVariantClear CoUninitialize

gdi32

DeleteDC DeleteObject StretchBlt SetStretchBltMode SelectObject CreateCompatibleBitmap CreateCompatibleDC GetObjectW CreateDCW GetDIBits GetDeviceCaps

pdh

PdhCloseQuery PdhCollectQueryData PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetProcessMemoryInfo

vcruntime140

__current_exception_context __C_specific_handler strrchr strchr _CxxThrowException memmove memcmp __current_exception memset memchr memcpy __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

expf logf pow __setusermatherr round log powf cosf ceilf sinf floorf roundf

api-ms-win-crt-string-l1-1-0

strncmp strcmp strspn wcslen strcspn strlen

api-ms-win-crt-heap-l1-1-0

realloc _msize free malloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _beginthreadex _initialize_narrow_environment terminate exit _endthreadex _get_initial_narrow_environment _initterm _initterm_e _initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _c_exit _crt_atexit __p___argv _cexit __p___argc _exit _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale