StellaWare[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
StellaWare.exe
Size 906KB
Sample260923-2vcppawt9j
SHA256 952adf0797e1feb77a431e8288c00af5da1f5cfbc323b065fcb4b5f7ece868f4
MD5 efb274b3cf386c9505504145f3138428
SHA1 6994b51b153b222d0209737435b5401527c2f9d1
SHA512 39661e02c200b00b955de8210a00a474079f8fad14d1b60ebf00ded95117790628f711e8573eb586b5aaf40ef1e96041cd815036fdbcdd4d70413f4f5f971ee6
SSDEEP 24576:ueGc186C5N6feqzIzOlnhtRDBiZnxXlJ:u0BCzMPzIkvRDgZnpl
TLSH
T17B159F19F2A801ECD1ABE178DA67E907E531388903305DDB23E0495A3F777E49A7BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StellaWare.exe

File Explorer

StellaWare.exe

.exe 906KB

StellaWare.exe

IMPHASH 1e647dc4ca5b09ec680776b89626636a
SHA256 952adf0797e1feb77a431e8288c00af5da1f5cfbc323b065fcb4b5f7ece868f4
MD5 efb274b3cf386c9505504145f3138428
SHA1 6994b51b153b222d0209737435b5401527c2f9d1
SHA512 39661e02c200b00b955de8210a00a474079f8fad14d1b60ebf00ded95117790628f711e8573eb586b5aaf40ef1e96041cd815036fdbcdd4d70413f4f5f971ee6
SSDEEP 24576:ueGc186C5N6feqzIzOlnhtRDBiZnxXlJ:u0BCzMPzIkvRDgZnpl
TLSH
T17B159F19F2A801ECD1ABE178DA67E907E531388903305DDB23E0495A3F777E49A7BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

744144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

user32

GetWindowRect DefWindowProcW GetWindowThreadProcessId SendInput GetForegroundWindow InvalidateRect UnregisterClassW SetClipboardData GetClipboardData EmptyClipboard DestroyWindow OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetCursor SetCapture LoadCursorW GetKeyboardLayout TrackMouseEvent GetSystemMetrics ClientToScreen GetCapture GetMessageExtraInfo GetKeyState SetWindowLongPtrW CreateWindowExW CloseClipboard MsgWaitForMultipleObjects GetWindowLongPtrW RegisterClassExW ShowWindow DispatchMessageW SetTimer PeekMessageW GetRawInputData RegisterRawInputDevices TranslateMessage GetClientRect KillTimer PostQuitMessage UpdateWindow SetForegroundWindow LoadImageW IsIconic SetProcessDpiAwarenessContext MessageBoxW MessageBoxA GetAsyncKeyState ScreenToClient

shell32

ShellExecuteW SHGetFolderPathW

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpReadData WinHttpSetOption WinHttpAddRequestHeaders

wlanapi

WlanQueryInterface WlanEnumInterfaces WlanCloseHandle WlanFreeMemory WlanOpenHandle

bcrypt

BCryptGenRandom BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider

ws2_32

WSACleanup htonl htons sendto recvfrom socket WSAStartup accept ioctlsocket setsockopt select closesocket bind recv send shutdown listen

mfplat

MFShutdown

winmm

timeEndPeriod timeBeginPeriod

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW TerminateProcess GetCurrentThread GetCurrentProcess SetThreadPriority GetCurrentProcessId GetCurrentThreadId

api-ms-win-core-com-l1-1-0

CoUninitialize CoCreateInstance CoInitializeEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW FreeLibrary GetProcAddress GetModuleHandleW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-file-l1-1-0

CreateFileW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW SetFileInformationByHandle FindNextFileW FindFirstFileExW GetLogicalDriveStringsW FindClose CreateDirectoryW SetFileAttributesW WriteFile ReadFile FindFirstFileW

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW Process32NextW CreateToolhelp32Snapshot

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW GetCurrentDirectoryW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe SetNamedPipeHandleState

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW Sleep WakeAllConditionVariable

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-heap-l2-1-0

GlobalFree LocalFree GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-localization-l1-2-0

FormatMessageA GetLocaleInfoA GetLocaleInfoEx

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

msvcp140

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??7ios_base@std@@QEBA_NXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??Bios_base@std@@QEBA_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mtx_unlock _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ _Xtime_get_ticks _Thrd_id _Thrd_join ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_terminate __C_specific_handler strstr _CxxThrowException strchr memcmp __current_exception_context __current_exception memset memchr memmove memcpy __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-stdio-l1-1-0

__p__commode fclose _set_fmode _wfopen __stdio_common_vfprintf fflush fseek fputc __acrt_iob_func ftell __stdio_common_vswprintf_s __stdio_common_vsscanf fwrite _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fgetc

api-ms-win-crt-string-l1-1-0

isalnum _wcsicmp tolower towlower strncpy strncmp strlen strcmp wcslen

api-ms-win-crt-math-l1-1-0

sqrtf powf fmodf floorf cosf acosf ceilf _dsign sinf __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtol strtod strtof atoi strtoll strtoull

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _seh_filter_exe _c_exit _register_thread_local_exe_atexit_callback _cexit _beginthreadex _crt_atexit _register_onexit_function _set_app_type _initialize_onexit_table abort terminate _errno

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-time-l1-1-0

_gmtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-core-file-l1-2-0

CreateFile2 GetTempPathW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx CopyFile2

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead