upconsec[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
upconsec.exe
Size 448KB
Sample260829-n3lexaff58
SHA256 47aa531e3963fddfb99f06da2a007bd3dbaf8f24d6928074048475d91099995d
MD5 52caa9bdda2b18b322443fab1bb5071b
SHA1 66e147b176b892ba9cb169fc42b8df0dfdf23511
SHA512 56e7ddf4c98df96b28463ec56e8688732d8448435b522eedde6228f98f384b195fda61854d336ac58f61b466f892d97b9512a2adf06df737d992512db66fdffb
SSDEEP 6144:YyTCTpvNS0vTvdy0sqERH36g5H8uMmn7v2FQFi3+JOnOTNvT4:96pjdNsqERX63sv2IJn
TLSH
T1B6A46D4BE39104F8E06AC17487475665BA76B4850731FAEF27AC82312F6AAD16F3CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
upconsec.exe

File Explorer

upconsec.exe

.exe 448KB

upconsec.exe

IMPHASH f12c9a2eac65c6a12d59d4f00533f0b7
SHA256 47aa531e3963fddfb99f06da2a007bd3dbaf8f24d6928074048475d91099995d
MD5 52caa9bdda2b18b322443fab1bb5071b
SHA1 66e147b176b892ba9cb169fc42b8df0dfdf23511
SHA512 56e7ddf4c98df96b28463ec56e8688732d8448435b522eedde6228f98f384b195fda61854d336ac58f61b466f892d97b9512a2adf06df737d992512db66fdffb
SSDEEP 6144:YyTCTpvNS0vTvdy0sqERH36g5H8uMmn7v2FQFi3+JOnOTNvT4:96pjdNsqERX63sv2IJn
TLSH
T1B6A46D4BE39104F8E06AC17487475665BA76B4850731FAEF27AC82312F6AAD16F3CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

257516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FlushFileBuffers GetConsoleOutputCP GetFileType FreeLibrary SetStdHandle CloseHandle FindFirstFileExW FindNextFileW SetFilePointerEx GetProcAddress GetModuleHandleA Sleep GetSystemTimeAsFileTime SetFileInformationByHandle GetFullPathNameW GetTempPathW WriteConsoleW GetConsoleMode GetStdHandle SetHandleInformation SetFileCompletionNotificationModes GetFinalPathNameByHandleW SetLastError GetLastError GetSystemInfo GetConsoleWindow FindClose GetCommandLineW GetCommandLineA GetModuleHandleExW TerminateProcess GetModuleFileNameW WriteFile RtlPcToFileHeader DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer FlsFree HeapSize LCMapStringW FlsSetValue FlsGetValue FlsAlloc AcquireSRWLockExclusive ReleaseSRWLockExclusive LockFileEx QueryPerformanceCounter AddVectoredExceptionHandler SetThreadStackGuarantee HeapFree HeapReAlloc TryAcquireSRWLockExclusive GetQueuedCompletionStatusEx CreateIoCompletionPort GetCurrentThread WaitForSingleObject MultiByteToWideChar QueryPerformanceFrequency GetModuleHandleW FormatMessageW GetCurrentProcess GetEnvironmentVariableW CreateFileW ExitProcess GetProcessHeap HeapAlloc GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry GetCurrentProcessId CreateMutexA WaitForSingleObjectEx LoadLibraryA ReleaseMutex RtlVirtualUnwind AcquireSRWLockShared ReleaseSRWLockShared PostQueuedCompletionStatus CreateThread CompareStringW LoadLibraryExW VirtualProtect GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW RtlUnwindEx GetEnvironmentStringsW GetStartupInfoW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent SetUnhandledExceptionFilter InitializeSListHead GetCurrentThreadId IsProcessorFeaturePresent

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile NtCancelIoFileEx

ws2_32

bind WSASocketW WSAIoctl WSAStartup WSACleanup freeaddrinfo recv WSAGetLastError connect getsockopt ioctlsocket socket closesocket send shutdown getaddrinfo

user32

ShowWindow

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

315KB

Virtual Size

314KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

upconsec.exe

kernel32

ntdll

ws2_32

user32

bcrypt

advapi32

generic