retrac[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
retrac.exe
Size 26.0MB
Sample260831-vrt18sdn6v
SHA256 8e659b326afa58276d95ae143af18786f3c47f9e45fa9f4bc9afdfcd10f99aef
MD5 274a0ba53a9c1bf4af8843978c680dd5
SHA1 b3006ef8c220ffa04308b4d58a8415c2b41e2d08
SHA512 3fccdcc36f31e161e19dcec092d2a8b9962e0cdbc94131d72548f396e4256043739574434ac0a4eb81743a926562d1e068e755d164c8bf0b905b197fdf9d31bf
SSDEEP 393216:+9hw3R8Vay7mii8lYMXKOsPAdaB+ld9qOwcB2U5:+9hr8y7NlIpPetxrp
TLSH
T17C575A207B9AA96CD19AC474834B4A725A7130DB1F35B9FF448492393F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
retrac.exe

File Explorer

retrac.exe

.exe 26.0MB

retrac.exe

IMPHASH ef225ded972cb1b5c1b9ac298f6e7de9
SHA256 8e659b326afa58276d95ae143af18786f3c47f9e45fa9f4bc9afdfcd10f99aef
MD5 274a0ba53a9c1bf4af8843978c680dd5
SHA1 b3006ef8c220ffa04308b4d58a8415c2b41e2d08
SHA512 3fccdcc36f31e161e19dcec092d2a8b9962e0cdbc94131d72548f396e4256043739574434ac0a4eb81743a926562d1e068e755d164c8bf0b905b197fdf9d31bf
SSDEEP 393216:+9hw3R8Vay7mii8lYMXKOsPAdaB+ld9qOwcB2U5:+9hr8y7NlIpPetxrp
TLSH
T17C575A207B9AA96CD19AC474834B4A725A7130DB1F35B9FF448492393F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7b:64:e4:06:8b:db:1c:cb:86:cf:a7:d3:d0:dd:7e:2d:d7:1c:be:5b:26:c5:9e:b7:6e:9e:fb:d9:bd:35:f2:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=16728944,CN=Lezah Limited,O=Lezah Limited,L=London,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jan 1, 0001

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

SERIALNUMBER=16728944,CN=Lezah Limited,O=Lezah Limited,L=London,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

05:56:44:1c:fd:d6:aa:7a:25:82:88:b0:36:8a:ff:3a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 7, 2026 - Jul 9, 2027

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

12688080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

retrac.pdb

oleaut32

SetErrorInfo SysAllocStringLen SysFreeString GetErrorInfo SysStringLen

kernel32

OpenProcess LoadLibraryW CreateThread SetWaitableTimer ReadProcessMemory CreateWaitableTimerExW GetProcessIoCounters GetSystemTimes GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar CancelIo QueryPerformanceFrequency SleepEx ReadFileEx WaitForMultipleObjects ExitProcess GetTempPathW SetEnvironmentVariableW FindClose FindFirstFileExW GetFinalPathNameByHandleW DeleteFileW SwitchToThread GetFileInformationByHandleEx CreateSymbolicLinkW CreateDirectoryW CopyFileExW RemoveDirectoryW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetProcessTimes DuplicateHandle FlushFileBuffers Sleep GetModuleHandleA SetFileInformationByHandle SetFilePointerEx CreateMutexA WaitForSingleObjectEx WideCharToMultiByte GetCurrentProcess HeapReAlloc SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort CancelIoEx WriteFile ReadFile PostQueuedCompletionStatus GetOverlappedResult SetHandleInformation GetConsoleMode GetFileAttributesW OutputDebugStringA OutputDebugStringW LoadLibraryExW GetFileInformationByHandle GetEnvironmentVariableW LoadLibraryExA RtlCaptureContext LocalFree VirtualQueryEx GlobalMemoryStatusEx GetCurrentProcessId WriteFileEx FormatMessageW RtlLookupFunctionEntry FindNextFileW FreeLibrary LoadLibraryA GetVersionExW FreeEnvironmentStringsW GetModuleFileNameW GetProcAddress GetSystemInfo MoveFileExW GetFullPathNameW LCIDToLocaleName GetUserDefaultUILanguage GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime DeleteCriticalSection GetExitCodeProcess WaitForSingleObject RtlPcToFileHeader RaiseException CreateFileW WaitNamedPipeW SetNamedPipeHandleState CreateProcessW CreateMutexW GetLastError FlsAlloc ReleaseMutex FlsGetValue FlsSetValue FlsFree GetModuleHandleW EncodePointer InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx RtlVirtualUnwind CreateEventW DeviceIoControl K32GetPerformanceInfo CloseHandle HeapFree InitializeCriticalSectionEx HeapAlloc GetProcessHeap GetSystemTimePreciseAsFileTime QueryPerformanceCounter lstrlenW

advapi32

RegCloseKey RegOpenKeyExW RegGetValueW RegQueryValueExW RegOpenKeyTransactedW RegSetValueExW RegDeleteTreeW RegCreateKeyTransactedW RegCreateKeyExW GetLengthSid CopySid OpenProcessToken GetTokenInformation OpenServiceW EventRegister EventSetInformation StartServiceW EventWriteTransfer EventUnregister SystemFunction036 QueryServiceConfigW OpenSCManagerW CloseServiceHandle QueryServiceStatusEx IsValidSid

bcryptprimitives

ProcessPrng

ntdll

NtDeviceIoControlFile RtlGetVersion RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtReadFile NtOpenFile NtWriteFile NtQuerySystemInformation NtQueryInformationProcess NtCreateNamedPipeFile

user32

CreateAcceleratorTableW DestroyAcceleratorTable GetMenuItemInfoW ToUnicodeEx GetKeyState GetAsyncKeyState GetKeyboardState MapVirtualKeyExW DestroyMenu GetRawInputData SystemParametersInfoA SetPropW SetWindowTextW GetWindowTextW GetWindowTextLengthW SendInput SetForegroundWindow SystemParametersInfoW TrackMouseEvent GetWindowLongW ClientToScreen GetMenu IsWindowVisible EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity DestroyIcon GetMenuBarInfo CreateIcon SetWindowLongW EnableMenuItem MonitorFromRect ClipCursor GetClipCursor ShowCursor TrackPopupMenu RedrawWindow InsertMenuW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx AppendMenuW SetMenuItemInfoW PostQuitMessage RegisterWindowMessageA GetTouchInputInfo CloseTouchInputHandle SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC GetDC IsProcessDPIAware GetSystemMenu GetParent FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled DrawIconEx FillRect GetSystemMetrics ScreenToClient SetCursor SendMessageW FindWindowW DrawMenuBar GetCursorPos CheckMenuItem RemoveMenu MonitorFromWindow GetClientRect DestroyWindow DefWindowProcW GetMonitorInfoW CreateWindowExW ValidateRect PostThreadMessageW SetWindowLongPtrW GetWindowLongPtrW SetMenu CreateMenu GetKeyboardLayout OffsetRect RegisterClassExW CreatePopupMenu GetForegroundWindow GetWindowDC DrawTextW RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos VkKeyScanW InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetMessageW MapVirtualKeyW IsIconic EnumChildWindows DispatchMessageA GetMessageA GetWindowRect AdjustWindowRect TranslateAcceleratorW SetWindowPos PostMessageW LoadCursorW DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

SHOpenFolderAndSelectItems ILFree SHCreateItemFromParsingName DragFinish ShellExecuteW ShellExecuteExW ILCreateFromPathW CommandLineToArgvW SHGetKnownFolderPath DragQueryFileW SHAppBarMessage

ole32

RegisterDragDrop CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoUninitialize CoInitializeSecurity CoCreateFreeThreadedMarshaler CoInitialize RevokeDragDrop OleInitialize CoCreateInstance CoInitializeEx

comctl32

TaskDialogIndirect RemoveWindowSubclass DefSubclassProc SetWindowSubclass

gdi32

SetTextColor SetBkMode DeleteObject CreateSolidBrush DeleteDC SelectObject CreateDIBSection GetDeviceCaps BitBlt CombineRgn CreateRectRgn CreateCompatibleDC

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shlwapi

SHCreateMemStream

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertCloseStore CertSetCertificateContextProperty CertVerifyCertificateChainPolicy CertGetCertificateChain CertOpenStore CertDuplicateCertificateChain CertAddEncodedCertificateToStore CertCreateCertificateChainEngine CertDuplicateStore CertDuplicateCertificateContext CertAddCertificateContextToStore CertEnumCertificatesInStore

ws2_32

WSACleanup WSAStartup freeaddrinfo getaddrinfo closesocket WSAGetLastError shutdown getsockopt bind WSASocketW WSAIoctl connect ioctlsocket setsockopt send WSASend recv getpeername getsockname

pdh

PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhRemoveCounter PdhOpenQueryA

powrprof

CallNtPowerInformation

secur32

InitializeSecurityContextW DecryptMessage EncryptMessage AcceptSecurityContext FreeContextBuffer AcquireCredentialsHandleA ApplyControlToken FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW

psapi

GetProcessMemoryInfo GetModuleFileNameExW

api-ms-win-crt-string-l1-1-0

strlen wcslen strcpy_s _wcsicmp wcscmp wcsncat

api-ms-win-crt-math-l1-1-0

round pow __setusermatherr roundf ceil floor trunc

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh calloc malloc

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _configure_narrow_argv _register_onexit_function _initialize_onexit_table _initialize_narrow_environment terminate abort _set_app_type _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _seh_filter_exe __p___argc _initterm _exit exit _initterm_e

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

retrac.exe

PE Signature issue

oleaut32

kernel32

advapi32

bcryptprimitives

ntdll

user32

api-ms-win-core-synch-l1-2-0

shell32

ole32

comctl32

gdi32

dwmapi

shlwapi

version

bcrypt

crypt32

ws2_32

pdh

powrprof

secur32

psapi

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic