TweakNet[.]update | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
TweakNet.update
Size 217KB
Sample260910-pr9tssw1ht
SHA256 fe7222cfc57d013b8013f6c8805febcb64b21a57d6877b4c4e0d9fd3394d407f
MD5 ee46af7df61195d8267dfaea275217a1
SHA1 c143b4111874f8f0938483f790af116b940ce717
SHA512 f2841db691b083b60152ee922665befcb71e52f48e002f296b63ca22a7290b100abf9ae835c27e85b66b2b40e0aca94a87ba8be960b395ca4645b9d56cc6b700
SSDEEP 6144:vlnhrwtqNGRwx3IgGRIAY8EYnI7tLyWcDIMadD:vlntNGu49Ivwn47MaJ
TLSH
T1D4240104F688C433D8320A348D7A52E73AE5FB17D7A4E38B1B907F5EB832386951B655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
TweakNet.update
unpack001/$EXEDIR/TPNET.EXE
unpack001/$PLUGINSDIR/nsProcess.dll

File Explorer

TweakNet.update

.exe 217KB
$EXEDIR/TPNET.EXE

.exe 584KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB

TweakNet.update

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 fe7222cfc57d013b8013f6c8805febcb64b21a57d6877b4c4e0d9fd3394d407f
MD5 ee46af7df61195d8267dfaea275217a1
SHA1 c143b4111874f8f0938483f790af116b940ce717
SHA512 f2841db691b083b60152ee922665befcb71e52f48e002f296b63ca22a7290b100abf9ae835c27e85b66b2b40e0aca94a87ba8be960b395ca4645b9d56cc6b700
SSDEEP 6144:vlnhrwtqNGRwx3IgGRIAY8EYnI7tLyWcDIMadD:vlntNGu49Ivwn47MaJ
TLSH
T1D4240104F688C433D8320A348D7A52E73AE5FB17D7A4E38B1B907F5EB832386951B655
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$EXEDIR/TPNET.EXE

IMPHASH db7b31988022f592b75d8604c8e000b2
SHA256 12c738122323e7d87c6c26b656ef7660a289de188e28025b26c6e9d979dbd008
MD5 59e77460591cc6966a3f3bd13a10c3ff
SHA1 5177cd9b11c177c5d5ab10fd46d06403dc928af5
SHA512 9c794b44f0c7f8501dfffc96850a475cd2949248e807301251174229548201c59a8cb822e8ca5ef51154b1285584b6fe9472436e244413c545d02616d7e3c72b
SSDEEP 6144:S4yus9v70qWkGRAjCJObEW9qbnZJUQAqsHulmoLGL4x5NBG:vdiz50W9SIfMyL4xn0
TLSH
T1D0D40862F6808550ED650B313CB5E5BD1EA3BD966F7BC20F320CB26D1B73A924821767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4708

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

TweakNet.update

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$EXEDIR/TPNET.EXE

msvbvm60

generic

$PLUGINSDIR/nsProcess.dll

kernel32

user32

generic