DeltaNet[.]exe[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
DeltaNet.exe.bin
Size 2.3MB
Sample260930-en1rlsec37
SHA256 28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2
MD5 5d2a851492391161e22ec4de655ea1c4
SHA1 f7cca766d81fae6d50b211533e878d4decf70959
SHA512 2571cebbc018d8d8a51fa5574470e840eb64823f9c5d4cc41a89f9ae1f3c2c53fb7f76ac8c4b2b72988b5f33705654b164b0e62bd0c32998601cd2c647e35fb9
SSDEEP 49152:/HqMycZ3pHEueIJDvKRtx2rzgItSYIU6iU:/LytOJrr1Sn+U
TLSH
T1CDB56B03E795C4EAC49AC078C3579732BA72788A3720FDAB57D44A2C2E66BD05E1C717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DeltaNet.exe.bin

File Explorer

DeltaNet.exe.bin

.exe 2.3MB

DeltaNet.exe.bin

IMPHASH 1bead535ec132f8826c5e53ab3dc14f0
SHA256 28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2
MD5 5d2a851492391161e22ec4de655ea1c4
SHA1 f7cca766d81fae6d50b211533e878d4decf70959
SHA512 2571cebbc018d8d8a51fa5574470e840eb64823f9c5d4cc41a89f9ae1f3c2c53fb7f76ac8c4b2b72988b5f33705654b164b0e62bd0c32998601cd2c647e35fb9
SSDEEP 49152:/HqMycZ3pHEueIJDvKRtx2rzgItSYIU6iU:/LytOJrr1Sn+U
TLSH
T1CDB56B03E795C4EAC49AC078C3579732BA72788A3720FDAB57D44A2C2E66BD05E1C717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1310832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

upd_1_6.pdb

bcryptprimitives

ProcessPrng

kernel32

HeapSize LCMapStringW CompareStringW GetProcAddress LoadLibraryExA GetProcessHeap HeapFree HeapAlloc FormatMessageW FindNextFileW FindClose SetFileTime SetFileAttributesW CopyFileExW GetOverlappedResult LoadLibraryExW VirtualProtect GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetStringTypeW SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage CreateDirectoryW GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW CreateFileW SetFileInformationByHandle UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent DeleteFileW WriteFileEx ReadFileEx CancelIo ReadFile GetFileAttributesW GetCommandLineW SetFilePointerEx GetCommandLineA GetModuleHandleExW PostQueuedCompletionStatus TerminateProcess ExitProcess RtlPcToFileHeader DeleteCriticalSection InitializeCriticalSectionEx DuplicateHandle SetHandleInformation SetLastError LeaveCriticalSection SwitchToThread WaitForMultipleObjects WaitForSingleObject GetExitCodeProcess GetCurrentProcess EnterCriticalSection GetTickCount64 GetSystemInfo CreateMutexW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc RaiseException FlsFree FlsSetValue CloseHandle GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetModuleHandleW GetModuleHandleA GetModuleFileNameW QueryPerformanceFrequency CreateThread SleepEx GetSystemTimePreciseAsFileTime QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimer Sleep CreateEventW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetLastError LoadLibraryA FlsGetValue FreeLibrary EncodePointer WriteFile GetFileType FlushFileBuffers GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc

ole32

CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

VariantClear SysFreeString SysStringLen GetErrorInfo SysAllocStringLen

ntdll

NtReadFile NtCreateFile NtDeviceIoControlFile NtOpenFile RtlNtStatusToDosError NtCancelIoFileEx NtWriteFile NtCreateNamedPipeFile

advapi32

SystemFunction036 OpenProcessToken RegCloseKey RegQueryValueExW RegOpenKeyExW GetTokenInformation

ws2_32

bind setsockopt ioctlsocket WSASocketW closesocket WSASend WSAIoctl WSAStartup WSACleanup getaddrinfo getsockname WSAGetLastError getpeername freeaddrinfo recv getsockopt send shutdown connect

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcrypt

BCryptGenRandom

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

893KB

Virtual Size

893KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DeltaNet.exe.bin

bcryptprimitives

kernel32

ole32

oleaut32

ntdll

advapi32

ws2_32

api-ms-win-core-synch-l1-2-0

bcrypt

generic