retrac[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
retrac.exe
Size 796KB
Sample260929-2dfd9azv4n
SHA256 4c6a47b1307f576a926c77e6f547c2e2318cc9ca5694550bce49762dab5fbe92
MD5 5ea30a57c6a3a6c8401a0b5d3433c7fd
SHA1 3212dd12422118de10b4772164c07b28d658ae79
SHA512 e4acf4fefeb79de892655a76698b630ca61529d794f029c9195a04b223472ea6e5131eb4b1c1d78179cf41efd4e3aa565c8f148ffb5310299dc032e04a7a07f4
SSDEEP 12288:Yo7gxpxzTedtQUOF4s3OeF7Fpya3JtDt1IWW0yk8a8URYiDSn2lbSb:Yo7upxzTedted7Fpn3nZLh8aeiGn2S
TLSH
T1C805BF45F2FD41F8D07BD1389686AA0FEA363809072025DB63E046987FB77F45BB6612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
retrac.exe

File Explorer

retrac.exe

.exe 796KB

retrac.exe

IMPHASH 668ae6168d4d0985c77186478d766938
SHA256 4c6a47b1307f576a926c77e6f547c2e2318cc9ca5694550bce49762dab5fbe92
MD5 5ea30a57c6a3a6c8401a0b5d3433c7fd
SHA1 3212dd12422118de10b4772164c07b28d658ae79
SHA512 e4acf4fefeb79de892655a76698b630ca61529d794f029c9195a04b223472ea6e5131eb4b1c1d78179cf41efd4e3aa565c8f148ffb5310299dc032e04a7a07f4
SSDEEP 12288:Yo7gxpxzTedtQUOF4s3OeF7Fpya3JtDt1IWW0yk8a8URYiDSn2lbSb:Yo7upxzTedted7Fpn3nZLh8aeiGn2S
TLSH
T1C805BF45F2FD41F8D07BD1389686AA0FEA363809072025DB63E046987FB77F45BB6612
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

590768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTickCount64 GetLastError GetFileAttributesA Process32NextW QueryPerformanceFrequency DeleteFileA Process32FirstW CloseHandle CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte GetConsoleWindow CreateDirectoryA QueryPerformanceCounter AllocConsole VirtualQueryEx OutputDebugStringA GetModuleHandleA GetEnvironmentVariableW GlobalAlloc CreateToolhelp32Snapshot GetProcAddress GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA IsDBCSLeadByte FreeLibrary FindNextFileA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleFileNameW DeviceIoControl Sleep OpenProcess CreateFileW GlobalFree FindClose SetConsoleTitleA FindFirstFileA MultiByteToWideChar CreateDirectoryW

user32

GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture RegisterClassExW IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW DestroyWindow SetWindowPos SetWindowLongPtrW SetCursor DispatchMessageW PeekMessageW MessageBoxA SetLayeredWindowAttributes TranslateMessage LoadCursorW mouse_event GetClientRect PostQuitMessage GetCursorPos CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW GetWindowLongPtrW GetAsyncKeyState

gdi32

CreateSolidBrush

shell32

SHGetFolderPathA ShellExecuteA ShellExecuteW

msvcp140

??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeEndPeriod timeBeginPeriod

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate strchr memchr memcmp memcpy memmove memset __C_specific_handler _CxxThrowException __current_exception __current_exception_context

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsscanf _wfopen ftell __stdio_common_vfprintf _fseeki64 __p__commode fputc ungetc fsetpos __stdio_common_vswprintf_s setvbuf freopen_s fgetpos __stdio_common_vsprintf fwrite fread fgetc __stdio_common_vsprintf_s __acrt_iob_func fseek _get_stream_buffer_pointers fclose fflush

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

_stricmp strncmp strncpy strlen strcmp _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type exit _get_initial_narrow_environment _initterm _initterm_e terminate

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol atoi atof

api-ms-win-crt-math-l1-1-0

tanf sqrtf atan2f sinf acosf ldexp powf ceilf pow cosf logf log __setusermatherr fmodf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale