SyncRuntime98071[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SyncRuntime98071.exe
Size 89.7MB
Sample260928-yyj2dsda49
SHA256 017611d5d583630cb6cac78ce18e9906854b2797dfdc717d17053e97b9279ecb
MD5 86ed056e8d6879c0fd4c6bba574d9763
SHA1 d1b4695280b5484f630682d8cd57995c4a6f6057
SHA512 52861d3d3cd9848ab59c192b32baa8b6183a6ac6bb2986a7a5181c9d6029cd699e6127456c505bbdfb935e981199f0a87b2378109ac8a61fe412ef0df8eaefe2
SSDEEP 786432:v32DHnnh2aXbi0QGSCTA2lFgAjsGnZivqtd8:v2DHnpXbi0QGRTAugA4GZij
TLSH
T183288D03F29340E8D0AEC1758796A233FA71BC494B34A6DF57845B222E76FE06B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SyncRuntime98071.exe

File Explorer

SyncRuntime98071.exe

.exe 89.7MB

SyncRuntime98071.exe

IMPHASH 669f501b79207f4e6c9909905e0d06ee
SHA256 017611d5d583630cb6cac78ce18e9906854b2797dfdc717d17053e97b9279ecb
MD5 86ed056e8d6879c0fd4c6bba574d9763
SHA1 d1b4695280b5484f630682d8cd57995c4a6f6057
SHA512 52861d3d3cd9848ab59c192b32baa8b6183a6ac6bb2986a7a5181c9d6029cd699e6127456c505bbdfb935e981199f0a87b2378109ac8a61fe412ef0df8eaefe2
SSDEEP 786432:v32DHnnh2aXbi0QGSCTA2lFgAjsGnZivqtd8:v2DHnpXbi0QGRTAugA4GZij
TLSH
T183288D03F29340E8D0AEC1758796A233FA71BC494B34A6DF57845B222E76FE06B39715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53652172

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

denort.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

kernel32

SetHandleInformation GetCurrentThreadId OpenThread GetThreadTimes WaitForMultipleObjects ResetEvent FormatMessageA LocalFree CreateProcessW ResumeThread GetProcessId FindResourceA LoadResource SizeofResource LockResource WaitForSingleObjectEx CreateSemaphoreW ReleaseSemaphore GetModuleHandleA IsThreadAFiber ConvertThreadToFiber CreateFiber SwitchToFiber DeleteFiber ConvertFiberToThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError LoadLibraryA CreateMutexA ReleaseMutex QueryPerformanceFrequency GetModuleHandleW QueryPerformanceCounter CreateThread CreateEventW ExitProcess GetModuleFileNameW CreateWaitableTimerExW SetWaitableTimer GetCurrentProcessId FormatMessageW GetACP IsValidCodePage GetStringTypeW RemoveVectoredExceptionHandler HeapQueryInformation GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CreateEventA LoadLibraryExA LoadLibraryW GetLocaleInfoW LCMapStringW SetThreadErrorMode CompareStringW GetProcessHeap HeapFree HeapAlloc GetTimeFormatW GetDateFormatW GetCommandLineA GetCPInfo SetFileAttributesW SetStdHandle InitializeCriticalSectionEx FlsFree FreeLibraryAndExitThread ExitThread SleepEx InitializeCriticalSectionAndSpinCount EncodePointer InterlockedPushEntrySList RtlUnwindEx GetQueuedCompletionStatusEx PostQueuedCompletionStatus GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter SetErrorMode WaitForSingleObject CreateIoCompletionPort GetOverlappedResult GetNumberFormatEx GetCurrencyFormatEx CancelIoEx CancelIo GetTimeFormatEx GetDateFormatEx SystemTimeToTzSpecificLocalTime ResolveLocaleName DeviceIoControl GetProcAddress InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue GetActiveProcessorCount TlsFree QueryThreadCycleTime GetThreadPriority SetThreadPriority WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FlsAlloc FlsGetValue FlsSetValue SuspendThread InitializeConditionVariable DuplicateHandle GetConsoleMode SetConsoleMode HeapReAlloc GetCurrentProcess ReadConsoleW GetFileType GetNumberOfConsoleInputEvents ReadConsoleInputW WriteFile WriteConsoleW CreateFileW GetNamedPipeInfo CreateNamedPipeW SetNamedPipeHandleState WaitNamedPipeW GetFileInformationByHandle FindClose GetDiskFreeSpaceW SetConsoleCursorPosition RegisterWaitForSingleObject GetStdHandle ConnectNamedPipe GetExitCodeProcess TerminateProcess GetOEMCP GetProcessTimes SetPriorityClass GetPriorityClass GetModuleHandleExW GetConsoleScreenBufferInfo GetFileAttributesW CreatePipe GetLogicalProcessorInformation GetSystemInfo UnregisterWaitEx SwitchToThread Sleep FreeLibrary SetConsoleTitleW FileTimeToSystemTime GlobalMemoryStatusEx GetTickCount64 GetLastError FreeEnvironmentStringsW GetGeoInfoW WriteConsoleInputW PeekConsoleInputW FlushConsoleInputBuffer WriteFileEx GetBinaryTypeW CreateToolhelp32Snapshot Process32First Process32Next SetConsoleCtrlHandler CreateJobObjectW SetInformationJobObject AssignProcessToJobObject GetSystemDefaultLangID CompareStringOrdinal GetShortPathNameW NeedCurrentDirectoryForExePathW GetSystemDirectoryW LoadLibraryExW GetUserGeoID CreateDirectoryW SetFileInformationByHandle SetCurrentDirectoryW WideCharToMultiByte SetFileTime GetCurrentThread SetThreadStackGuarantee CreateFileMappingW MapViewOfFile UnmapViewOfFile VirtualProtect GetDynamicTimeZoneInformation GetThreadContext CreateSemaphoreA SetFileCompletionNotificationModes ReadFile ReadDirectoryChangesW GetLocaleInfoEx RtlCaptureStackBackTrace GlobalLock GlobalSize SetUnhandledExceptionFilter GetConsoleCursorInfo SetConsoleCursorInfo FillConsoleOutputCharacterA FillConsoleOutputAttribute LockFileEx UnlockFile VirtualQuery GetCurrentDirectoryW lstrlenW GetConsoleOutputCP RtlDeleteFunctionTable MultiByteToWideChar GetEnvironmentVariableW ReadFileEx GetFullPathNameW FindFirstFileExW GetFileInformationByHandleEx RtlAddFunctionTable FlushFileBuffers GetSystemTimePreciseAsFileTime GetCommandLineW GetEnvironmentStringsW GetTempPathW RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW AddVectoredExceptionHandler CopyFileExW MoveFileExW CreateSymbolicLinkW CreateHardLinkW SetEnvironmentVariableW FindNextFileW SetFilePointerEx VirtualAlloc VirtualFree InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetTickCount GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetFileSize HeapDestroy HeapCompact GetNativeSystemInfo DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA HeapCreate AreFileApisANSI RaiseException TryEnterCriticalSection IsDebuggerPresent GetTimeZoneInformation GetTempFileNameA VerSetConditionMask VerifyVersionInfoW MapViewOfFileEx CloseHandle OpenProcess GlobalUnlock RtlUnwind

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile NtOpenFile NtCreateFile NtCancelIoFileEx NtDeviceIoControlFile RtlPcToFileHeader NtQueryInformationFile RtlGetVersion NtQuerySystemInformation

advapi32

EventSetInformation LookupPrivilegeValueW EventRegister EventWriteTransfer SystemFunction036 AdjustTokenPrivileges RegGetValueW RegQueryInfoKeyW RegCloseKey GetUserNameW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW OpenProcessToken

user32

ReleaseDC GetClientRect CreateWindowExA MapVirtualKeyW GetClassInfoExA RegisterClassExA DefWindowProcA GetClipboardData CloseClipboard DestroyWindow GetDC OpenClipboard

ws2_32

WSAIoctl GetHostNameW bind WSAStartup recvfrom freeaddrinfo getaddrinfo WSASocketW WSADuplicateSocketW listen getsockname WSAGetLastError ioctlsocket recv setsockopt closesocket getsockopt connect sendto accept WSASend send WSASendMsg shutdown WSACleanup getpeername GetNameInfoW socket

crypt32

CertFreeCertificateContext CertVerifyTimeValidity CertDuplicateCertificateContext CertEnumCertificatesInStore CertGetEnhancedKeyUsage CertOpenStore CertCloseStore

userenv

GetUserProfileDirectoryW

shell32

SHGetKnownFolderPath

bcrypt

BCryptGenRandom

CrashForExceptionInNonABICompliantCodeRange aws_lc_0_40_0_jent_entropy_collector_alloc aws_lc_0_40_0_jent_entropy_collector_free aws_lc_0_40_0_jent_entropy_init aws_lc_0_40_0_jent_entropy_init_ex aws_lc_0_40_0_jent_entropy_switch_notime_impl aws_lc_0_40_0_jent_read_entropy aws_lc_0_40_0_jent_read_entropy_safe aws_lc_0_40_0_jent_set_fips_failure_callback aws_lc_0_40_0_jent_version llhttp_errno_name llhttp_execute llhttp_finish llhttp_get_errno llhttp_get_error_pos llhttp_get_error_reason llhttp_get_http_major llhttp_get_http_minor llhttp_get_method llhttp_get_status_code llhttp_get_type llhttp_get_upgrade llhttp_init llhttp_message_needs_eof llhttp_method_name llhttp_pause llhttp_reset llhttp_resume llhttp_resume_after_upgrade llhttp_set_error_reason llhttp_set_lenient_chunked_length llhttp_set_lenient_data_after_close llhttp_set_lenient_headers llhttp_set_lenient_keep_alive llhttp_set_lenient_optional_cr_before_lf llhttp_set_lenient_optional_crlf_after_chunk llhttp_set_lenient_optional_lf_after_cr llhttp_set_lenient_spaces_after_chunk_size llhttp_set_lenient_transfer_encoding llhttp_set_lenient_version llhttp_settings_init llhttp_should_keep_alive llhttp_status_name napi_acquire_threadsafe_function napi_add_async_cleanup_hook napi_add_env_cleanup_hook napi_add_finalizer napi_adjust_external_memory napi_async_destroy napi_async_init napi_call_function napi_call_threadsafe_function napi_cancel_async_work napi_check_object_type_tag napi_close_callback_scope napi_close_escapable_handle_scope napi_close_handle_scope napi_coerce_to_bool napi_coerce_to_number napi_coerce_to_object napi_coerce_to_string napi_create_array napi_create_array_with_length napi_create_arraybuffer napi_create_async_work napi_create_bigint_int64 napi_create_bigint_uint64 napi_create_bigint_words napi_create_buffer napi_create_buffer_copy napi_create_dataview napi_create_date napi_create_double napi_create_error napi_create_external napi_create_external_arraybuffer napi_create_external_buffer napi_create_function napi_create_int32 napi_create_int64 napi_create_object napi_create_promise napi_create_range_error napi_create_reference napi_create_string_latin1 napi_create_string_utf16 napi_create_string_utf8 napi_create_symbol napi_create_threadsafe_function napi_create_type_error napi_create_typedarray napi_create_uint32 napi_define_class napi_define_properties napi_delete_async_work napi_delete_element napi_delete_property napi_delete_reference napi_detach_arraybuffer napi_escape_handle napi_fatal_error napi_fatal_exception napi_get_all_property_names napi_get_and_clear_last_exception napi_get_array_length napi_get_arraybuffer_info napi_get_boolean napi_get_buffer_info napi_get_cb_info napi_get_dataview_info napi_get_date_value napi_get_element napi_get_global napi_get_instance_data napi_get_last_error_info napi_get_named_property napi_get_new_target napi_get_node_version napi_get_null napi_get_property napi_get_property_names napi_get_prototype napi_get_reference_value napi_get_threadsafe_function_context napi_get_typedarray_info napi_get_undefined napi_get_uv_event_loop napi_get_value_bigint_int64 napi_get_value_bigint_uint64 napi_get_value_bigint_words napi_get_value_bool napi_get_value_double napi_get_value_external napi_get_value_int32 napi_get_value_int64 napi_get_value_string_latin1 napi_get_value_string_utf16 napi_get_value_string_utf8 napi_get_value_uint32 napi_get_version napi_has_element napi_has_named_property napi_has_own_property napi_has_property napi_instanceof napi_is_array napi_is_arraybuffer napi_is_buffer napi_is_dataview napi_is_date napi_is_detached_arraybuffer napi_is_error napi_is_exception_pending napi_is_promise napi_is_typedarray napi_make_callback napi_module_register napi_new_instance napi_object_freeze napi_object_seal napi_open_callback_scope napi_open_escapable_handle_scope napi_open_handle_scope napi_queue_async_work napi_ref_threadsafe_function napi_reference_ref napi_reference_unref napi_reject_deferred napi_release_threadsafe_function napi_remove_async_cleanup_hook napi_remove_env_cleanup_hook napi_remove_wrap napi_resolve_deferred napi_run_script napi_set_element napi_set_instance_data napi_set_named_property napi_set_property napi_strict_equals napi_throw napi_throw_error napi_throw_range_error napi_throw_type_error napi_type_tag_object napi_typeof napi_unref_threadsafe_function napi_unwrap napi_wrap node_api_create_buffer_from_arraybuffer node_api_create_external_string_latin1 node_api_create_external_string_utf16 node_api_create_object_with_named_properties node_api_create_object_with_properties node_api_create_property_key_latin1 node_api_create_property_key_utf16 node_api_create_property_key_utf8 node_api_create_syntax_error node_api_get_module_file_name node_api_post_finalizer node_api_symbol_for node_api_throw_syntax_error node_module_register uv_async_init uv_async_send uv_check_init uv_check_start uv_check_stop uv_close uv_cond_broadcast uv_cond_destroy uv_cond_init uv_cond_signal uv_cond_timedwait uv_cond_wait uv_cpu_info uv_default_loop uv_free_cpu_info uv_handle_get_data uv_handle_get_loop uv_handle_get_type uv_handle_set_data uv_handle_size uv_has_ref uv_hrtime uv_idle_init uv_idle_start uv_idle_stop uv_is_active uv_is_closing uv_mutex_destroy uv_mutex_init uv_mutex_lock uv_mutex_unlock uv_os_getpid uv_poll_init uv_poll_init_socket uv_poll_start uv_poll_stop uv_queue_work uv_ref uv_sem_destroy uv_sem_init uv_sem_post uv_sem_trywait uv_sem_wait uv_strerror uv_thread_create uv_thread_equal uv_thread_join uv_thread_self uv_timer_again uv_timer_get_repeat uv_timer_init uv_timer_set_repeat uv_timer_start uv_timer_stop uv_unref

Name

.text

Size

51.9MB

Virtual Size

51.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22.3MB

Virtual Size

22.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

322KB

Virtual Size

501KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

264KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pedata

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SyncRuntime98071.exe

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

advapi32

user32

ws2_32

crypt32

userenv

shell32

bcrypt

generic