darien[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
darien.exe
Size 3.6MB
Sample260930-crjldsvtdx
SHA256 9173c4f4fb503ba2e9bfe9a9e9e4e7f3480688075daa8201782de36f0dc345d2
MD5 e96d798f57073cca31f8f11a14ffd166
SHA1 e3a4483de8fc082b0a7a69c7f700c9d94913b3d6
SHA512 54c81e66c474af6f5ce2c67422e2c7ca78d9e53d9f2e5ad68e4b0872363ede08fbc4c450696b0470de91e3c13f045ab874de56858fae4f9cfc7ee070e590f3cc
SSDEEP 49152:24lzCCoj+kCpg6Gvhe8FCNB/2IpqMvAs8pWy4y3VLuxPNyA+2dmKrTZ8TpCS0zcI:24kJ+tGvhmARjVqxDmGTZ80S0zcJ
TLSH
T1E006D041A2D38A6DCF22A73461AB233BE270BCD0477196C7465C46346F63AF48DBEB45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
darien.exe

File Explorer

darien.exe

.exe 3.6MB

darien.exe

IMPHASH daf15139ead37b50a4bcf54ef90fb5ce
SHA256 9173c4f4fb503ba2e9bfe9a9e9e4e7f3480688075daa8201782de36f0dc345d2
MD5 e96d798f57073cca31f8f11a14ffd166
SHA1 e3a4483de8fc082b0a7a69c7f700c9d94913b3d6
SHA512 54c81e66c474af6f5ce2c67422e2c7ca78d9e53d9f2e5ad68e4b0872363ede08fbc4c450696b0470de91e3c13f045ab874de56858fae4f9cfc7ee070e590f3cc
SSDEEP 49152:24lzCCoj+kCpg6Gvhe8FCNB/2IpqMvAs8pWy4y3VLuxPNyA+2dmKrTZ8TpCS0zcI:24kJ+tGvhmARjVqxDmGTZ80S0zcJ
TLSH
T1E006D041A2D38A6DCF22A73461AB233BE270BCD0477196C7465C46346F63AF48DBEB45
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

winmm

timeBeginPeriod timeEndPeriod

ole32

CoCreateInstance CoInitializeEx

shell32

ShellExecuteExW

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove strstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsscanf _fileno _setmode fclose fflush fopen fputc fputwc fread fseek ftell fwrite setvbuf

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __sys_nerr _beginthreadex _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler _wassert abort exit signal strerror strerror_s

api-ms-win-crt-string-l1-1-0

memset strcmp strcpy strlen strncmp strncpy strnlen toupper wcslen wcsnlen

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr acosf atan2f ceilf cosf floorf fmodf log logf pow powf sinf sqrtf

api-ms-win-crt-convert-l1-1-0

atof mbrtowc strtof strtol strtoll strtoul strtoull wcrtomb wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort rand

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard FindWindowW GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorInfo GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindowRect IsWindowUnicode IsWindowVisible LoadCursorW MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetProcessDPIAware SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW UpdateWindow

kernel32

AcquireSRWLockExclusive CloseHandle DeleteCriticalSection EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue FormatMessageA FreeLibrary GetActiveProcessorCount GetCurrentThreadId GetLastError GetLocaleInfoA GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetThreadId GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryA LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VerSetConditionMask VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

1001KB

Virtual Size

1000KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

darien.exe

d3d11

d3dcompiler_47

dwmapi

winmm

ole32

shell32

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

gdi32

user32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic