Usermode[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Usermode.exe
Size 888KB
Sample260910-mbacwsge46
SHA256 5567ccecd0b69e7953b8125681779a416fb688a5a464dc0732e439a217eb4ebb
MD5 b2dfdc479ade0cb5f548073589291f1a
SHA1 32d8419518bd3134cfd1aa702eae9c012345e39a
SHA512 75949827bc00797d307b966efb77e8af95c133dfc323ec7795b9cd2c0567f79e80cc86e2385d3a18c29609ef8032d47a1898bce699b03f5720bd85de0af14dad
SSDEEP 12288:JAZgSS0HKygApQ1lPO/nu8GmYPXS+iosLM2QPcbaAblpbkAbCnUdl:JAdKyLpQnG/njGmYPaLMdcbPblBdbCs
TLSH
T10B15AE13F38AA744C9626638246DE72FE674F83C6A17C70B35F82B645BC70805D297E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Usermode.exe

File Explorer

Usermode.exe

.exe 888KB

Usermode.exe

IMPHASH e5d954eab7dda4591d9a6b641f4caba1
SHA256 5567ccecd0b69e7953b8125681779a416fb688a5a464dc0732e439a217eb4ebb
MD5 b2dfdc479ade0cb5f548073589291f1a
SHA1 32d8419518bd3134cfd1aa702eae9c012345e39a
SHA512 75949827bc00797d307b966efb77e8af95c133dfc323ec7795b9cd2c0567f79e80cc86e2385d3a18c29609ef8032d47a1898bce699b03f5720bd85de0af14dad
SSDEEP 12288:JAZgSS0HKygApQ1lPO/nu8GmYPXS+iosLM2QPcbaAblpbkAbCnUdl:JAdKyLpQnG/njGmYPaLMdcbPblBdbCs
TLSH
T10B15AE13F38AA744C9626638246DE72FE674F83C6A17C70B35F82B645BC70805D297E9
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

224068

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

WideCharToMultiByte GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary VirtualFree LoadLibraryA CreateFileA SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetModuleHandleW GetCurrentProcessId GetCurrentThreadId MultiByteToWideChar VirtualAlloc TerminateProcess Beep CloseHandle InitializeSListHead GetSystemTimeAsFileTime GetProcAddress UnhandledExceptionFilter

user32

GetKeyState ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW LoadCursorW GetWindowRect DefWindowProcA RegisterClassExA DestroyWindow

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z

imm32

ImmReleaseContext ImmAssociateContextEx ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow

vcruntime140

memmove memset strstr memchr memcmp memcpy __current_exception_context _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate __current_exception __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

exit _get_initial_narrow_environment _initterm _initterm_e _exit _crt_atexit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback terminate _invoke_watson _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _set_app_type _cexit _seh_filter_exe

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vsscanf fwrite ftell fseek _set_fmode fread fflush fclose _wfopen __acrt_iob_func __stdio_common_vsnprintf_s __p__commode __stdio_common_vsprintf_s

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-math-l1-1-0

ceilf acosf sinf __setusermatherr cosf sqrtf

api-ms-win-crt-string-l1-1-0

wcscmp strlen wcslen strcmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

235KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

562KB

Virtual Size

573KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Usermode.exe

ntdll

d3d11

kernel32

user32

msvcp140

imm32

d3dcompiler_47

dwmapi

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic