e71a0f57c64355ef_syshost_loader[.]exe

General

Target
e71a0f57c64355ef_syshost_loader.exe
Size 226KB
Sample260928-hchnfayvfx
SHA256 f455be7600086c8accc8831bd73127c12c3b043c8445ba3d1a8e44d7435f31b1
MD5 f0877d8aa7edc76007cb1826d8283671
SHA1 56a9b5691e6077fc43fc6eee61714d6ed1eac5ab
SHA512 088af2a8beab8017de299d62757f9a7fb2d6a301e79b546711c9f428a92b59437f234c510b5d7eebafc82b3b1126267df064d85a7cf28a12e0e3bc6d5ea962bb
SSDEEP 3072:Cju3SbCx1KA8x2frHp8kYyP4tBSOow88TzxqO3MkjvGpPIrSuMuL5IPc3EMmTqA8:CKOCx4vx2syPIgOLHQO3Mkix3RCb
TLSH
T1CE344A5B72A508FBE876823CC4931A05E772B8160761DFAF07A4026A5F237D19D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e71a0f57c64355ef_syshost_loader.exe

File Explorer

e71a0f57c64355ef_syshost_loader.exe

.exe 226KB

e71a0f57c64355ef_syshost_loader.exe

IMPHASH 56bfda7073ea0a159d22e925194a7054
SHA256 f455be7600086c8accc8831bd73127c12c3b043c8445ba3d1a8e44d7435f31b1
MD5 f0877d8aa7edc76007cb1826d8283671
SHA1 56a9b5691e6077fc43fc6eee61714d6ed1eac5ab
SHA512 088af2a8beab8017de299d62757f9a7fb2d6a301e79b546711c9f428a92b59437f234c510b5d7eebafc82b3b1126267df064d85a7cf28a12e0e3bc6d5ea962bb
SSDEEP 3072:Cju3SbCx1KA8x2frHp8kYyP4tBSOow88TzxqO3MkjvGpPIrSuMuL5IPc3EMmTqA8:CKOCx4vx2syPIgOLHQO3Mkix3RCb
TLSH
T1CE344A5B72A508FBE876823CC4931A05E772B8160761DFAF07A4026A5F237D19D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW RegCloseKey RegCreateKeyExW RegSetValueExW OpenProcessToken

kernel32

SetFileAttributesW CloseHandle GetLastError WaitForSingleObject CreateMutexW GetCurrentProcess CreateProcessW OpenProcess GetModuleFileNameW CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateRemoteThread VirtualAllocEx WriteProcessMemory WriteConsoleW CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW TerminateProcess GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

shell32

SHGetFolderPathW

Sharing