KnoxModzLoader[.]exe

General

Target
KnoxModzLoader.exe
Size 1.4MB
Sample260920-215yes1drd
SHA256 49a3fe76609fe2e8244ad5742e6a970ae422c8d33ea1d2747061525608e5c3a1
MD5 fb96511c96dd236217705307888181f7
SHA1 63ab9cf0f16e0aab7f29263734f86bd2d7d711e6
SHA512 594baf0b8b5ab995849d16c7264f5358109db990ef8f6d65f40dec3855a3b432216a905f64a6aceb718dd2ea6970379a33148266e00300e52d80b06c1d87be61
SSDEEP 24576:rxvX1geVdh2r0O6V+Ypb5O1C1nWGlp4oUzTg7rE:YeVjDP54YWGpqA7
TLSH
T185657CE722D111ADD16BC2BEC602FC1FDBAFB9790721A5DB929016620D63DC07A39F01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KnoxModzLoader.exe

File Explorer

KnoxModzLoader.exe

.exe 1.4MB

KnoxModzLoader.exe

IMPHASH 2a46b57a4716c56771973bbea5e61745
SHA256 49a3fe76609fe2e8244ad5742e6a970ae422c8d33ea1d2747061525608e5c3a1
MD5 fb96511c96dd236217705307888181f7
SHA1 63ab9cf0f16e0aab7f29263734f86bd2d7d711e6
SHA512 594baf0b8b5ab995849d16c7264f5358109db990ef8f6d65f40dec3855a3b432216a905f64a6aceb718dd2ea6970379a33148266e00300e52d80b06c1d87be61
SSDEEP 24576:rxvX1geVdh2r0O6V+Ypb5O1C1nWGlp4oUzTg7rE:YeVjDP54YWGpqA7
TLSH
T185657CE722D111ADD16BC2BEC602FC1FDBAFB9790721A5DB929016620D63DC07A39F01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

134492

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegDeleteValueA RegOpenKeyExA RegDeleteTreeA CryptAcquireContextA CryptReleaseContext CryptGenRandom

shell32

SHGetFolderPathA

kernel32

SetEndOfFile WriteConsoleW GetStdHandle GetEnvironmentVariableA CreateFileA FindClose FindFirstFileA FindNextFileA SetFileAttributesA WriteFile GetTempPathA CloseHandle WaitForSingleObject Sleep TerminateProcess GetExitCodeProcess CreateThread CreateProcessA GetLogicalDriveStringsA GetConsoleMode SetConsoleMode SetConsoleTextAttribute SetConsoleTitleA HeapSize LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetConsoleCP ExitProcess GetModuleHandleExW GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW ReadConsoleInputW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle RtlUnwind

Name

.text

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

KnoxModzLoader.exe

advapi32

shell32

kernel32

generic