Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Loader.exe
Size 157KB
Sample260922-yffagswt4r
SHA256 5caf2ec01fd840e3dc126668ea5def81d75cefd0ff06c5149f1c9bc348f95939
MD5 e3ace7ccb0a5f45c0fafc9819c8af166
SHA1 8501dc59a17fe36fae6cdd30ba923299f3f1af04
SHA512 935519471d2f7d2e46ac9df5d70487473d27f682160bda0db6fa3249b350a9ffe68f00a5ea91b4dfeed097842a7e025b5b2ba8b8aba10b1ed1d26218bfc13d24
SSDEEP 3072:5GXcrQWUFsQiRhbXaxqeQg7iZcWmE8xTDa4M/VLvqnzEAr9wIG9cRuScrDfAHm:gMMrFsQGaxqel7GcWmE8xTDnM/VLaIdX
TLSH
T14AF34A5BF65500BAD267D478CE534903FB73BC4A0361A7CB57819BB60E179E4AE3EA00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.exe

File Explorer

Loader.exe

.exe 157KB

Loader.exe

IMPHASH a8bd3d9b3026dacf3abcd0405a7f1b50
SHA256 5caf2ec01fd840e3dc126668ea5def81d75cefd0ff06c5149f1c9bc348f95939
MD5 e3ace7ccb0a5f45c0fafc9819c8af166
SHA1 8501dc59a17fe36fae6cdd30ba923299f3f1af04
SHA512 935519471d2f7d2e46ac9df5d70487473d27f682160bda0db6fa3249b350a9ffe68f00a5ea91b4dfeed097842a7e025b5b2ba8b8aba10b1ed1d26218bfc13d24
SSDEEP 3072:5GXcrQWUFsQiRhbXaxqeQg7iZcWmE8xTDa4M/VLvqnzEAr9wIG9cRuScrDfAHm:gMMrFsQGaxqel7GcWmE8xTDnM/VLaIdX
TLSH
T14AF34A5BF65500BAD267D478CE534903FB73BC4A0361A7CB57819BB60E179E4AE3EA00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

password

Minor OS version

Major OS version

Entry point

102480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Teox\Desktop\Teox\Loader\x64\Release\Loader.pdb

kernel32

SetConsoleMode SetCurrentConsoleFontEx TerminateProcess GetProcessId CreateToolhelp32Snapshot GetConsoleMode GetTempPathA Process32NextW CreateFileA DeleteFileA Process32FirstW CloseHandle SetFileAttributesA GetCurrentConsoleFontEx Beep GetFileSize RemoveDirectoryA SetConsoleCP GetConsoleWindow CreateDirectoryA GetExitCodeProcess GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW SetConsoleTitleA SetConsoleTextAttribute SetConsoleCtrlHandler GetModuleFileNameA SetConsoleOutputCP GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte Sleep GetCurrentThreadId SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStdHandle LocalFree InitializeSListHead FormatMessageA

user32

GetSystemMenu SetWindowPos GetSystemMetrics SetWindowLongW RemoveMenu GetWindowLongW

advapi32

FreeSid AllocateAndInitializeSid CheckTokenMembership

shell32

ShellExecuteExA

msvcp140

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Random_device@std@@YAIXZ _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks __crtLCMapStringA _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Strcoll ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __RTtypeid strchr memcpy __std_type_info_compare __std_exception_copy __std_exception_destroy memmove memset __current_exception __current_exception_context _CxxThrowException __C_specific_handler __std_terminate

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vsprintf fclose _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc _set_fmode setvbuf fgetpos fwrite fgetc fputc __p__commode

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode malloc free _callnewh

api-ms-win-crt-string-l1-1-0

_stricmp strlen wcscpy_s isalnum wcslen

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-runtime-l1-1-0

__p___argc _seh_filter_exe __p___argv _set_app_type _c_exit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _exit _initterm_e _initterm abort _cexit _get_initial_narrow_environment exit terminate system _beginthreadex

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func ___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr