mitamers vip emu[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mitamers vip emu.exe
Size 64.9MB
Sample260916-qfae8sba83
SHA256 010e0f7a75cbe552de3048e286cfb8cf120c76207ffa74eb70906afaead84f5a
MD5 333a6b67a5afb52a8fb51e6f3f0a3769
SHA1 c78a5dffca4cd41cdeb47cf8e538224d77153e73
SHA512 832035454eabdb231d558b0719a0e8c12cb307ef1119c342ff5bb215ff46256302771274e01f4540e336a3f147b643f84add397220b2046b1d638869960be317
SSDEEP 393216:BmhRxAt2h70ltAQTCoZWx1qgLSawA/ylgWEnmgY4evWF9M:BiAAhAlt5CoZWxhSaUgW0EvWF
TLSH
T1DDE7514C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mitamers vip emu.exe

File Explorer

mitamers vip emu.exe

.exe 64.9MB

mitamers vip emu.exe

IMPHASH 92a08752255224eaf33079a482c3dd98
SHA256 010e0f7a75cbe552de3048e286cfb8cf120c76207ffa74eb70906afaead84f5a
MD5 333a6b67a5afb52a8fb51e6f3f0a3769
SHA1 c78a5dffca4cd41cdeb47cf8e538224d77153e73
SHA512 832035454eabdb231d558b0719a0e8c12cb307ef1119c342ff5bb215ff46256302771274e01f4540e336a3f147b643f84add397220b2046b1d638869960be317
SSDEEP 393216:BmhRxAt2h70ltAQTCoZWx1qgLSawA/ylgWEnmgY4evWF9M:BiAAhAlt5CoZWxhSaUgW0EvWF
TLSH
T1DDE7514C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56793776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle FreeConsole SetFileAttributesA GetLocalTime AddVectoredExceptionHandler GetThreadContext GetProcAddress MoveFileExW ExitProcess SetConsoleCP GetCurrentProcessId GetModuleHandleW FreeLibrary GetConsoleWindow QueryFullProcessImageNameW GetTempFileNameW CreateProcessA SetConsoleOutputCP CreateDirectoryA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount AllocConsole LoadLibraryExW IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent FlushFileBuffers MultiByteToWideChar OutputDebugStringA GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA IsDBCSLeadByte TerminateProcess CreateThread MoveFileExA Process32NextW SetConsoleCursorInfo GetFileAttributesA GetLastError GetTickCount64 GetConsoleMode Sleep WriteConsoleW GetStringTypeW SetStdHandle OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP CreateEventW FindFirstFileExW GetFileSizeEx GetConsoleOutputCP ReadConsoleW SetFilePointerEx LCMapStringW GetFileType UnhandledExceptionFilter Process32FirstW GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError CreateFileMappingA GetFileSize VirtualQuery DeleteFileW DeleteFileA QueryPerformanceFrequency LoadLibraryA CreateToolhelp32Snapshot SetFileAttributesW OpenProcess GetModuleHandleA UnmapViewOfFile GetCurrentThreadId CreateFileW WaitForSingleObject GetVolumeInformationA CreateMutexA FindClose GetEnvironmentVariableA GetTempPathW SetEndOfFile GetEnvironmentVariableW SetFilePointer ReadFile SetConsoleWindowInfo SetCurrentConsoleFontEx SetConsoleMode WriteFile GetStdHandle SetConsoleScreenBufferSize GetCurrentProcess FindNextFileW SetConsoleTextAttribute VirtualProtect VirtualFree VirtualAlloc RemoveVectoredExceptionHandler VirtualAllocEx GetSystemDirectoryA VirtualFreeEx IsWow64Process GetSystemInfo DuplicateHandle HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetProcessHeap RaiseException K32GetModuleInformation DecodePointer DeleteCriticalSection InitializeCriticalSectionEx LocalFree GetExitCodeThread WaitForSingleObjectEx InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCurrentThread SetEvent CreateFileA IsProcessorFeaturePresent ReadConsoleInputW FindFirstFileW IsValidCodePage SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

UnregisterClassA GetClassNameW GetTopWindow PeekMessageW DispatchMessageW IsWindow TranslateMessage GetWindowLongPtrW SetWindowTextW UnregisterClassW DeleteMenu SetWindowLongPtrW IsWindowVisible ShowWindow DestroyWindow GetWindow SetWindowsHookExW GetWindowThreadProcessId LoadImageW UpdateWindow PostQuitMessage RegisterClassExW GetSystemMetrics ScreenToClient CreateWindowExW SetWindowPos DefWindowProcW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode FindWindowW PostThreadMessageW GetSystemMenu GetClientRect GetKeyState GetMessageExtraInfo SetCursor GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture

advapi32

CryptDecrypt CopySid GetLengthSid CryptDestroyKey CryptAcquireContextA RegCloseKey RegQueryValueExA CryptEncrypt CryptGenRandom RegDeleteKeyW RegCreateKeyExA GetUserNameA RegCreateKeyExW CryptCreateHash CryptDeriveKey CryptHashData CryptSetHashParam RegSetValueExW RegSetValueExA CryptDestroyHash RegOpenKeyExA RegOpenKeyExW CryptSetKeyParam CryptImportKey RegDeleteValueW CryptGetHashParam RegDeleteValueA CryptReleaseContext IsValidSid OpenProcessToken ConvertSidToStringSidA OpenThreadToken GetTokenInformation LookupAccountSidA

shell32

SHCreateDirectoryExA ShellExecuteW ShellExecuteA

vmprotectsdk64

VMProtectEnd VMProtectBeginUltra

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSetTimeouts WinHttpSetOption WinHttpReadData WinHttpQueryHeaders

wininet

InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

dbghelp

ImageDirectoryEntryToData

shlwapi

ord215

dwmapi

DwmSetWindowAttribute

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

userenv

UnloadUserProfile

ntdll

RtlImageNtHeader NtMapViewOfSection RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry NtClose NtUnmapViewOfSection NtCreateSection

Name

.text

Size

54.3MB

Virtual Size

54.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mitamers vip emu.exe

kernel32

user32

advapi32

shell32

vmprotectsdk64

winhttp

wininet

dbghelp

shlwapi

dwmapi

d3d11

imm32

d3dcompiler_47

userenv

ntdll

generic