client[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
client.exe
Size 2.2MB
Sample260930-wwl2vstsft
SHA256 1eb51e82267b2ea1d3216919dbac9d5297ca8565baf8e39ccfc07323136b1849
MD5 d3cde4bd1869a3edbd6573557d6b1912
SHA1 7a98e44d10312b5a4d419c21cb246b9f09385e22
SHA512 ba5d1b6fb5ec03ac30c334f01798ff02b54450fe37eb94f37cf8feaceafb071d1e5e8ab7fa2ba5ae7cd080d5a66b3e0010a7ed7cdea3e0a5895a0116a59a66fc
SSDEEP 24576:NyiMVtRC0iHgNW5nGTESie8JHvYK4ClI+0SnxuyETawg+tbcQAsqv:Ny1qgticK4ClfITX
TLSH
T13DB59E3662AC11C8F17BD17D8ADB4A47D6B274090331A6DB019446DD2F2BEEA0F7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

File Explorer

client.exe

.exe 2.2MB

client.exe

IMPHASH 3c749128d6840b96e40ea6972b07c348
SHA256 1eb51e82267b2ea1d3216919dbac9d5297ca8565baf8e39ccfc07323136b1849
MD5 d3cde4bd1869a3edbd6573557d6b1912
SHA1 7a98e44d10312b5a4d419c21cb246b9f09385e22
SHA512 ba5d1b6fb5ec03ac30c334f01798ff02b54450fe37eb94f37cf8feaceafb071d1e5e8ab7fa2ba5ae7cd080d5a66b3e0010a7ed7cdea3e0a5895a0116a59a66fc
SSDEEP 24576:NyiMVtRC0iHgNW5nGTESie8JHvYK4ClI+0SnxuyETawg+tbcQAsqv:Ny1qgticK4ClfITX
TLSH
T13DB59E3662AC11C8F17BD17D8ADB4A47D6B274090331A6DB019446DD2F2BEEA0F7E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\lakup\Documents\dev_tools\LARP HERE\Studio\client.pdb

ws2_32

inet_addr htons getsockopt __WSAFDIsSet recv socket getsockname ioctlsocket connect closesocket WSAStartup WSACleanup WSAGetLastError getaddrinfo freeaddrinfo inet_ntop select send setsockopt shutdown

gdiplus

GdipDisposeImage GdipSaveImageToStream GdipCloneImage GdipGetImageEncodersSize GdipGetImageEncoders GdipAlloc GdiplusStartup GdipFree GdipCreateBitmapFromScan0

advapi32

RegOpenKeyExA CheckTokenMembership FreeSid GetUserNameW RegQueryValueExW RegQueryValueExA RegOpenKeyExW AllocateAndInitializeSid RegEnumKeyExA RegCloseKey

user32

GetCursorPos SetCursorPos GetWindowTextW RedrawWindow GetIconInfo EnumDisplayDevicesW SystemParametersInfoW GetMonitorInfoA EnumDisplayMonitors SetProcessDPIAware GetCursorInfo ReleaseDC GetDC GetForegroundWindow GetSystemMetrics GetLastInputInfo DrawIconEx SendInput

gdi32

StretchBlt GdiFlush CreateDIBSection SetStretchBltMode SelectObject DeleteObject DeleteDC CreateCompatibleDC BitBlt

ole32

CoInitializeEx CreateStreamOnHGlobal CoCreateInstance CoTaskMemFree CoUninitialize

shell32

SHChangeNotify CommandLineToArgvW ShellExecuteW SHGetFolderPathW ShellExecuteExW

winmm

waveOutClose waveOutOpen waveOutGetNumDevs waveOutWrite waveInReset waveOutReset waveInGetNumDevs waveInGetDevCapsW waveInOpen waveInClose waveInStop waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveOutUnprepareHeader waveOutPrepareHeader

mf

MFEnumDeviceSources

mfplat

MFShutdown MFStartup MFCreateMediaType MFCreateAttributes MFCreateMemoryBuffer MFCreateSample

mfreadwrite

MFCreateSourceReaderFromMediaSource

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

crypt32

CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider

kernel32

GetDateFormatW LoadLibraryExW VirtualProtect IsThreadAFiber SetFilePointerEx GetFileSizeEx GetConsoleMode GetTimeZoneInformation OutputDebugStringW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers ReadConsoleW HeapSize GetTimeFormatW GetFileType HeapReAlloc HeapFree HeapAlloc GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ResumeThread ExitThread CreateThread IsProcessorFeaturePresent UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext SetEndOfFile FlsSetValue CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetOEMCP EnumSystemLocalesW IsValidCodePage GetACP GetConsoleOutputCP FlsGetValue FlsAlloc SetLastError RtlLookupFunctionEntry RtlUnwindEx RaiseException InterlockedFlushSList InterlockedPushEntrySList RtlPcToFileHeader GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer WakeAllConditionVariable WakeConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFile2 CreateDirectoryExW DeviceIoControl AreFileApisANSI CreateFile2 SetFileTime SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW SetCurrentDirectoryW GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW WriteConsoleW FlsFree SetErrorMode TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetLogicalProcessorInformationEx GetCommandLineW ExpandEnvironmentStringsA CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesA GetFileAttributesW GetFileSize GetLogicalDriveStringsW ReadFile RemoveDirectoryW SetFileAttributesW WriteFile GetTempPathW CloseHandle SetHandleInformation SetUnhandledExceptionFilter GetLastError RtlUnwind CreatePipe PeekNamedPipe WaitForSingleObject CreateMutexA CreateEventA Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetCurrentThread SetThreadPriority CreateProcessA CreateProcessW OpenProcess GlobalMemoryStatusEx GetTickCount GetTickCount64 GetSystemDirectoryA SetProcessWorkingSetSize GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LocalFree WinExec MulDiv QueryFullProcessImageNameW GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetGeoInfoW GetUserGeoID GetUserDefaultLocaleName SetConsoleCtrlHandler CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessMemoryInfo QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

307KB

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

client.exe

ws2_32

gdiplus

advapi32

user32

gdi32

ole32

shell32

winmm

mf

mfplat

mfreadwrite

d3d11

dxgi

crypt32

bcrypt

kernel32

generic