UltariNEO-portable-build58[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
UltariNEO-portable-build58.exe
Size 17.2MB
Sample260907-tml96acn41
SHA256 f84ba7a6e7485824ad6eedd51d197dd6ed0c2299caa6ccc14c783c1213746850
MD5 048bd535496d294727b008a752299dcc
SHA1 6a17f9359131d01561a5cf1650bbf5c7d5f967a3
SHA512 13021fa936d1acbeb9e8759243965cf0b1a3f1021311bfd681591f6cdea3cf00ba7f75289f1934076f9d6f1468921b1af52a74c53f294f6dc02c16c281dd5034
SSDEEP 98304:eIR9y0Wyxtj9Fm73Jwjip4s6FigGuOqTnzcaTpJrMLw+ggFWiLeRusxtXCjec:fR9t94SMeFifFKJrM8ngS+
TLSH
T1900707217A5A996CD05BC474834B8AB24A3130CB1B35B9FF449496393F6EBF46F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UltariNEO-portable-build58.exe

File Explorer

UltariNEO-portable-build58.exe

.exe 17.2MB

UltariNEO-portable-build58.exe

IMPHASH 804b70e4968359f4389263a96087783f
SHA256 f84ba7a6e7485824ad6eedd51d197dd6ed0c2299caa6ccc14c783c1213746850
MD5 048bd535496d294727b008a752299dcc
SHA1 6a17f9359131d01561a5cf1650bbf5c7d5f967a3
SHA512 13021fa936d1acbeb9e8759243965cf0b1a3f1021311bfd681591f6cdea3cf00ba7f75289f1934076f9d6f1468921b1af52a74c53f294f6dc02c16c281dd5034
SSDEEP 98304:eIR9y0Wyxtj9Fm73Jwjip4s6FigGuOqTnzcaTpJrMLw+ggFWiLeRusxtXCjec:fR9t94SMeFifFKJrM8ngS+
TLSH
T1900707217A5A996CD05BC474834B8AB24A3130CB1B35B9FF449496393F6EBF46F38358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12782224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ultari_neo_app.pdb

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister SystemFunction036

ntdll

RtlGetVersion NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlNtStatusToDosError NtReadFile

kernel32

GetProcessTimes QueryFullProcessImageNameW OpenProcess GetTickCount64 GetTickCount MapViewOfFile LCIDToLocaleName GetUserDefaultUILanguage GetModuleHandleW WaitForSingleObject GetCurrentThreadId UnmapViewOfFile FormatMessageA ReleaseSRWLockExclusive GetSystemTime AcquireSRWLockExclusive HeapValidate GetSystemTimeAsFileTime OutputDebugStringA FindNextFileW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW WideCharToMultiByte FreeLibrary GetProcessHeap SetEnvironmentVariableW GetFinalPathNameByHandleW WakeAllConditionVariable ReleaseMutex CreateMutexA SwitchToThread ExitProcess FindClose FindFirstFileExW CopyFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW HeapSize GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime GetCurrentProcessId RtlCaptureContext LocalFree HeapFree DuplicateHandle GetCurrentProcess GetOverlappedResult GetModuleFileNameW LoadLibraryExW ReadFileEx SetHandleInformation SleepConditionVariableSRW CreateEventW CreateThread MultiByteToWideChar HeapDestroy QueryPerformanceFrequency SetFileTime SetFileInformationByHandle MoveFileExW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW RtlVirtualUnwind DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection ReadFile WriteFile UnlockFileEx CreateMutexW CreateFileA LockFileEx SystemTimeToFileTime HeapCompact CreateFileMappingW lstrlenW QueryPerformanceCounter HeapAlloc Process32NextW LoadLibraryExA Process32FirstW CreateToolhelp32Snapshot ReadDirectoryChangesW LoadLibraryW RaiseException CreateFileW RtlPcToFileHeader FlushFileBuffers GetFileSize UnlockFile DeleteFileW DeleteFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA GetFileAttributesW GetTempPathW SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW AreFileApisANSI GetFileInformationByHandle GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx GetModuleHandleA Sleep GetLastError GetProcAddress CloseHandle FormatMessageW OutputDebugStringW HeapCreate RtlLookupFunctionEntry GetTimeZoneInformation FlushViewOfFile LoadLibraryA WaitForSingleObjectEx HeapReAlloc GetEnvironmentStringsW GetSystemInfo InitializeCriticalSectionEx

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

TrackMouseEvent RedrawWindow GetTouchInputInfo CloseTouchInputHandle SetCursor FillRect ValidateRect PostThreadMessageW GetSystemMetrics GetMonitorInfoW VkKeyScanW DrawTextW GetWindowDC OffsetRect PeekMessageW GetMenuBarInfo GetUpdateRect DestroyMenu DrawIconEx CheckMenuItem GetMenuItemInfoW RemoveMenu CreatePopupMenu CreateMenu SetMenu DrawMenuBar SendMessageW TranslateMessage SetMenuItemInfoW DispatchMessageW AppendMenuW InsertMenuW PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable SetTimer KillTimer TrackPopupMenu ChangeWindowMessageFilterEx LoadCursorW MonitorFromRect SetWindowPos RegisterClassW MonitorFromWindow CreateIcon GetKeyboardLayout ToUnicodeEx GetKeyState GetAsyncKeyState GetKeyboardState MapVirtualKeyExW SystemParametersInfoA SetPropW SetWindowTextW GetWindowTextW GetCursorPos GetWindowTextLengthW SendInput SetForegroundWindow SystemParametersInfoW GetMenu IsWindowVisible EnumDisplayMonitors MonitorFromPoint AdjustWindowRect RegisterClassExW DestroyIcon SetWindowDisplayAffinity GetRawInputData CreateWindowExW SetWindowLongW EnableMenuItem GetMessageA DispatchMessageA EnumChildWindows IsIconic GetSystemMenu ClipCursor GetClipCursor ShowCursor ClientToScreen RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RegisterWindowMessageA SetParent MapWindowPoints GetWindow GetClientRect GetWindowLongW SetFocus ShowWindow ScreenToClient ReleaseDC GetDC IsProcessDPIAware GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled TranslateAcceleratorW DestroyWindow GetLastInputInfo GetWindowThreadProcessId PostMessageW GetForegroundWindow MapVirtualKeyW GetMessageW RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos DefWindowProcW InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW

ole32

CoTaskMemAlloc CoTaskMemFree CoCreateFreeThreadedMarshaler CoUninitialize RegisterDragDrop RevokeDragDrop CoInitializeEx CoCreateInstance OleInitialize

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass TaskDialogIndirect

gdi32

CreateRectRgn CreateCompatibleDC BitBlt CreateDIBSection GetDeviceCaps SelectObject CombineRgn SetBkMode DeleteDC DeleteObject CreateSolidBrush SetTextColor

shell32

SHAppBarMessage Shell_NotifyIconW Shell_NotifyIconGetRect DragFinish DragQueryFileW ShellExecuteW SHGetKnownFolderPath

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

SHCreateMemStream

oleaut32

SysFreeString GetErrorInfo SysStringLen SetErrorInfo

bcrypt

BCryptGenRandom

ws2_32

listen getsockname WSADuplicateSocketW sendto WSASocketW recvfrom select connect WSASend WSARecv freeaddrinfo getpeername send recv ioctlsocket getsockopt setsockopt WSAGetLastError WSAStartup getaddrinfo WSACleanup bind accept closesocket

iphlpapi

GetPerTcpConnectionEStats GetExtendedUdpTable GetExtendedTcpTable SetPerTcpConnectionEStats SendARP

crypt32

CryptQueryObject CertFreeCertificateContext CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CryptMsgClose CertCloseStore

wintrust

CryptCATAdminAcquireContext2 CryptCATAdminReleaseContext CryptCATCatalogInfoFromContext CryptCATAdminCalcHashFromFileHandle2 WinVerifyTrust CryptCATAdminReleaseCatalogContext CryptCATAdminEnumCatalogFromHash

wlanapi

WlanOpenHandle WlanCloseHandle WlanGetNetworkBssList WlanGetAvailableNetworkList WlanEnumInterfaces WlanFreeMemory

api-ms-win-crt-math-l1-1-0

floor roundf round log pow __setusermatherr trunc

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen strlen strcpy_s strncmp strcmp strcspn strspn wcscmp

api-ms-win-crt-heap-l1-1-0

_msize realloc malloc free calloc _callnewh _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _beginthreadex _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _crt_atexit _seh_filter_exe terminate abort _endthreadex _register_onexit_function

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale