XcLeek[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
XcLeek.exe
Size 4.5MB
Sample260924-tk11jaxyaz
SHA256 076cea57cc34d511a1d6bff86ab7df77df92b5857e6960a60351217ff462dc1c
MD5 020c9f630f62e5baca8a5d881f0e205c
SHA1 b951283aacfa59643f5586364dccd70c263bcd64
SHA512 5fab429383e3616e84e74b046a4e02b09d9b06531bd5f941e8322aedb94fcec43575ac2e6836517bd0bdbcb994c033452fe704494eadb679ef0fc10203be5018
SSDEEP 49152:rbYDdSt2LxMGsubZm6V/xYjifVDn/uEFo2Hko+uudYl1vHsOp:HY5StwxdhV/x8Sx9W2
TLSH
T14A269E83B3ED8989E0177A388752970BE3717834075583DBBF85496ADEAF4D08B76B40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XcLeek.exe

File Explorer

XcLeek.exe

.exe 4.5MB

XcLeek.exe

IMPHASH 62ad9c130e6e7e5200a79f4d52653991
SHA256 076cea57cc34d511a1d6bff86ab7df77df92b5857e6960a60351217ff462dc1c
MD5 020c9f630f62e5baca8a5d881f0e205c
SHA1 b951283aacfa59643f5586364dccd70c263bcd64
SHA512 5fab429383e3616e84e74b046a4e02b09d9b06531bd5f941e8322aedb94fcec43575ac2e6836517bd0bdbcb994c033452fe704494eadb679ef0fc10203be5018
SSDEEP 49152:rbYDdSt2LxMGsubZm6V/xYjifVDn/uEFo2Hko+uudYl1vHsOp:HY5StwxdhV/x8Sx9W2
TLSH
T14A269E83B3ED8989E0177A388752970BE3717834075583DBBF85496ADEAF4D08B76B40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1352236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpOpen

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash

kernel32

GetFileSizeEx CreateProcessW GetExitCodeProcess GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetSystemFirmwareTable GetModuleFileNameA GetCurrentProcess CreateMutexA OpenProcess Sleep GetTickCount64 GetLastError GetFileAttributesA QueryFullProcessImageNameA DeleteFileA CloseHandle GetLocalTime GetProcAddress LocalFree GetModuleHandleW GetConsoleWindow SetConsoleTitleW IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW ReadProcessMemory GetEnvironmentVariableA MultiByteToWideChar SetFileAttributesA WriteProcessMemory SetThreadPriority WaitForSingleObject GetCurrentThread CreateThread SetLastError GetModuleHandleA LoadLibraryA GetSystemInfo VirtualProtectEx VirtualAllocEx FlushInstructionCache WideCharToMultiByte Module32NextW VirtualFreeEx VirtualQueryEx Thread32Next Thread32First GetCurrentProcessId GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetLocaleInfoA QueryPerformanceFrequency FreeLibrary SetFilePointerEx CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW ReadFile FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable GetSystemTimeAsFileTime FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW ReadConsoleW GetTimeZoneInformation HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize SetEndOfFile QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread FormatMessageA CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx GetLocaleInfoEx InitializeCriticalSectionEx

user32

GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout LoadCursorW SetCursor IsWindowUnicode GetKeyState OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyboardState SetCapture ToUnicode ReleaseCapture GetWindowLongW DefWindowProcW PostMessageW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW CallNextHookEx UnregisterClassW RegisterClassExW DispatchMessageW ClientToScreen PeekMessageW SetWindowDisplayAffinity UnhookWindowsHookEx SetLayeredWindowAttributes TranslateMessage ClipCursor EnumThreadWindows SetWindowsHookExW SetWindowLongW PostQuitMessage UpdateWindow IsIconic EnumDisplaySettingsA GetSystemMetrics GetClassNameW SetCursorPos ScreenToClient IsWindow GetAsyncKeyState GetClientRect GetCursorPos SendInput GetForegroundWindow GetWindowThreadProcessId IsWindowVisible MessageBoxW ShowWindow GetWindowTextA MsgWaitForMultipleObjectsEx EnumWindows

advapi32

CloseServiceHandle OpenProcessToken GetUserNameA OpenSCManagerA RegQueryValueExA GetTokenInformation OpenServiceA ConvertSidToStringSidA RegCloseKey RegOpenKeyExA

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

500KB

Virtual Size

499KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XcLeek.exe

d3d11

d3dcompiler_47

dcomp

dwmapi

winhttp

bcrypt

kernel32

user32

advapi32

shell32

imm32

generic