Tolz Loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Tolz Loader.exe
Size 3.8MB
Sample260924-vb3nfayzes
SHA256 17876df36a2e2375e7ff97a07d33240db0fe475b5c2efd7aeddf5beae0e9c702
MD5 6e17fb8b676260d6cab27550d77f0473
SHA1 4981134894ccc70cd0ea46956b8364a7951cc4e0
SHA512 8c9e2bc75d17d12345fd220781670d4ead74b99ee8545f9298d29aa325e77d1294f74d53663f3ce7e3e82b8e17a2a17ee7c8a24416bf6cd79f2a83ba7703df68
SSDEEP 49152:SnV0TReklP9uQ50zjRzn2j46L3tc/0iCgOhmeSB69L6L3tc/0iCgOhmeSB69:7Ph5uM4uZiCpIeSguZiCpIeS
TLSH
T1F706E103E35582DCD56799788AA69747F371B8411F24EBCB32D82A59AF532F00E7B390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Tolz Loader.exe

File Explorer

Tolz Loader.exe

.exe 3.8MB

Tolz Loader.exe

IMPHASH ebc64e3deea6fae7a5a40059bac97ed5
SHA256 17876df36a2e2375e7ff97a07d33240db0fe475b5c2efd7aeddf5beae0e9c702
MD5 6e17fb8b676260d6cab27550d77f0473
SHA1 4981134894ccc70cd0ea46956b8364a7951cc4e0
SHA512 8c9e2bc75d17d12345fd220781670d4ead74b99ee8545f9298d29aa325e77d1294f74d53663f3ce7e3e82b8e17a2a17ee7c8a24416bf6cd79f2a83ba7703df68
SSDEEP 49152:SnV0TReklP9uQ50zjRzn2j46L3tc/0iCgOhmeSB69L6L3tc/0iCgOhmeSB69:7Ph5uM4uZiCpIeSguZiCpIeS
TLSH
T1F706E103E35582DCD56799788AA69747F371B8411F24EBCB32D82A59AF532F00E7B390
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1225520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider

kernel32

GetLocaleInfoW LCMapStringW CompareStringW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter LoadLibraryW ReadFile VirtualProtect SetLastError GetCurrentProcess OutputDebugStringA GetModuleFileNameW CreateFileW ReleaseMutex CreateToolhelp32Snapshot Sleep GetLastError Process32NextW CreateFileA GetCurrentThread GetSystemDirectoryA Process32FirstW CloseHandle RaiseException Module32FirstW AddVectoredExceptionHandler GetThreadContext GetFileSize GetCurrentProcessId GetProcessHeap GetModuleHandleW Module32NextW IsDebuggerPresent SizeofResource GetPrivateProfileIntW GetEnvironmentVariableW GetEnvironmentVariableA WaitForSingleObject GetPrivateProfileStringW GetTempPathA GetFileAttributesExW FileTimeToSystemTime LockResource DeleteFileA LoadResource FindResourceW FileTimeToLocalFileTime IsValidLocale GetVolumeInformationA GetComputerNameA GetTimeFormatW GetDateFormatW LoadLibraryExW GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle IsProcessorFeaturePresent DeleteFileW TerminateProcess ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetTimeZoneInformation GetExitCodeProcess IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW SetEndOfFile GetEnvironmentStringsW LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize AcquireSRWLockExclusive ReleaseSRWLockExclusive WriteConsoleW CreateProcessW GetFileSizeEx HeapAlloc HeapReAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GetCurrentThreadId LocalFree FormatMessageA GetLocaleInfoEx GetSystemTimePreciseAsFileTime FindClose FindFirstFileW FindFirstFileExW FindNextFileW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx

user32

SetClipboardData OpenClipboard GetCursorPos EmptyClipboard CloseClipboard GetClipboardData GetForegroundWindow SetCursorPos PostMessageW GetWindowLongW DefWindowProcW DestroyWindow SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage FindWindowA UpdateWindow GetWindowRect MoveWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent ReleaseCapture LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode

gdi32

CreateRoundRectRgn

advapi32

RegGetValueA CheckTokenMembership FreeSid AllocateAndInitializeSid RegCloseKey RegSetValueExW RegCreateKeyExW

shell32

ShellExecuteW ShellExecuteA

ole32

CoInitializeEx CoCreateInstance

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

iphlpapi

GetAdaptersInfo

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

828KB

Virtual Size

835KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Tolz Loader.exe

d3d11

d3dcompiler_47

winhttp

bcrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

dwmapi

iphlpapi

generic