potemkin_loader | 13be062d5b58585ddf4b04d9e43f370eb5185f7acbfadfb803e0adf2089d7e49

Target
13be062d5b58585ddf4b04d9e43f370eb5185f7acbfadfb803e0adf2089d7e49
Size 849KB
Sample260916-gzb9hazz2l
SHA256 13be062d5b58585ddf4b04d9e43f370eb5185f7acbfadfb803e0adf2089d7e49
MD5 74c701d7825f9859d740f64d5902ffc1
SHA1 58d88620615bb5dac99376dca76d7bd6b82b3b5e
SHA512 aed25428aec488768a9cb25d5febd4935f57873ce773a816cd53fcac550d71d8da560d5bdd187307638920c4c5dd54f260b7ad9d7d6a35eac828dbe09639d35e
SSDEEP 24576:r+on5HrDNsCG3jztl2dm32f8JlxCpQqcRyTE664i+Va:Son5HrDNsCGTztl2dm32f8Jn6Qrt4D
TLSH
T162055B1D7B8511A8E07A81B98B8E97F7F370F45807A057CB229045761E7BBEC8E3A351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader potemkin_loader

Malware Config

Signatures

Family: PotemkinLoader
Potemkin Loader is a Windows loader.
loader potemkin_loader

Detects PotemkinLoader 1 IoCs

resource	yara_rule
sample	family_potemkinloader

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
13be062d5b58585ddf4b04d9e43f370eb5185f7acbfadfb803e0adf2089d7e49

File Explorer

13be062d5b58585ddf4b04d9e43f370eb5185f7acbfadfb803e0adf2089d7e49

.exe 849KB

13be062d5b58585ddf4b04d9e43f370eb5185f7acbfadfb803e0adf2089d7e49

IMPHASH b69e5fef0a591e314b65ff8477ac05be
SHA256 13be062d5b58585ddf4b04d9e43f370eb5185f7acbfadfb803e0adf2089d7e49
MD5 74c701d7825f9859d740f64d5902ffc1
SHA1 58d88620615bb5dac99376dca76d7bd6b82b3b5e
SHA512 aed25428aec488768a9cb25d5febd4935f57873ce773a816cd53fcac550d71d8da560d5bdd187307638920c4c5dd54f260b7ad9d7d6a35eac828dbe09639d35e
SSDEEP 24576:r+on5HrDNsCG3jztl2dm32f8JlxCpQqcRyTE664i+Va:Son5HrDNsCGTztl2dm32f8Jn6Qrt4D
TLSH
T162055B1D7B8511A8E07A81B98B8E97F7F370F45807A057CB229045761E7BBEC8E3A351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects PotemkinLoader
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d3:3f:88:20:c2:de:5b:65:9c:1f:a8:5e:53:38:6b:f3:b8:9c:66:65:66:c6:e7:57:36:fe:a9:39:fc:4c:7d:36:d5:68:e5:88:b9:bf:1a:e9:77:14:eb:8e:27:26:dc:cc:7e:50:bd:b3:65:35:2f:56:6e:74:ee:95:9e:13:1d:4c

Digest Algorithm

sha512

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=DocuSign\, Inc.,OU=Engineering,O=DocuSign\, Inc.,L=San Francisco,ST=California,C=US

Chains

Oct 4, 2021

CN=DocuSign\, Inc.,OU=Engineering,O=DocuSign\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=DocuSign\, Inc.,OU=Engineering,O=DocuSign\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

04:d2:af:3d:dc:87:8b:d0:90:14:e8:23:63:90:8e:25

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 26, 2021 - Aug 20, 2024

Minor OS version

Major OS version

Entry point

407796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess ExitProcess CreateFileA WriteFile GetTempPathA CloseHandle GetLocalTime WideCharToMultiByte EnterCriticalSection LeaveCriticalSection GetProcAddress InitializeCriticalSection GetSystemInfo Beep GetModuleHandleW SetLastError DebugBreak VirtualAlloc VirtualFree RtlCompareMemory SetEndOfFile WriteConsoleW CreateFileW HeapSize SetStdHandle GetProcessHeap FreeLibrary LoadLibraryA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead QueryPerformanceFrequency Sleep TryAcquireSRWLockExclusive InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError RtlUnwind

user32

DispatchMessageA DefWindowProcA TranslateMessage CreateWindowExA LoadCursorA LoadIconA GetMessageA RegisterClassA

gdi32

CreateSolidBrush

shell32

SHGetFolderPathW

ws2_32

__WSAFDIsSet closesocket connect ioctlsocket getpeername getsockname getsockopt ntohs recv select send setsockopt shutdown getnameinfo freeaddrinfo getaddrinfo WSASocketW WSAGetLastError WSACleanup WSAStartup socket

ntdll

RtlAllocateHeap RtlFreeHeap LdrLockLoaderLock LdrUnlockLoaderLock NtCreateSection NtOpenSection NtMapViewOfSection NtUnmapViewOfSection NtClose RtlImageNtHeader RtlGetNtVersionNumbers NtProtectVirtualMemory NtQueryVirtualMemory RtlImageDirectoryEntryToData LdrUnloadDll NtQuerySystemTime RtlUpcaseUnicodeChar RtlHashUnicodeString RtlNtStatusToDosError RtlExitUserThread RtlRaiseStatus RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

Name

.text

Size

611KB

Virtual Size

610KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

79KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

13be062d5b58585ddf4b04d9e43f370eb5185f7acbfadfb803e0adf2089d7e49

PE Signature issue

kernel32

user32

gdi32

shell32

ws2_32

ntdll

generic