Potassium[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Potassium.exe
Size 23.9MB
Sample260930-xpcqaawtct
SHA256 d4a06aed70cfddaf747e6d2564bed581d4686d854d4771b199ef1ec6c7b3dfbd
MD5 2bfb8df7baeb371440bf440257597b44
SHA1 880241dae0058f349a8ad3c187e5c363f7dd94fc
SHA512 a0bb1296ec97c33d396bb30881291b8a9e4048b2fb84fa770c06454c17e5825c2a5dbfa9141c538316a3c182b20854652cdad390245a9c42ebeb77fea2ce0e12
SSDEEP 196608:yypcOkyIBA+fBR1FWEOzp7lSn00KJNTTH1/Q+K3QCJG5nU4NEDC07M9:yypcH3Ai14EW7lS3KfTmFACJGBU4nP
TLSH
T1574729257A5A996CD05BC074838B8A734A7130CB1B35B9FB549492382F7EBF42F38758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Potassium.exe

File Explorer

Potassium.exe

.exe 23.9MB

Potassium.exe

IMPHASH 0a4c4ab481a59f774f0142feb249460d
SHA256 d4a06aed70cfddaf747e6d2564bed581d4686d854d4771b199ef1ec6c7b3dfbd
MD5 2bfb8df7baeb371440bf440257597b44
SHA1 880241dae0058f349a8ad3c187e5c363f7dd94fc
SHA512 a0bb1296ec97c33d396bb30881291b8a9e4048b2fb84fa770c06454c17e5825c2a5dbfa9141c538316a3c182b20854652cdad390245a9c42ebeb77fea2ce0e12
SSDEEP 196608:yypcOkyIBA+fBR1FWEOzp7lSn00KJNTTH1/Q+K3QCJG5nU4NEDC07M9:yypcH3Ai14EW7lS3KfTmFACJGBU4nP
TLSH
T1574729257A5A996CD05BC074838B8A734A7130CB1B35B9FB549492382F7EBF42F38758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14762112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Potassium.pdb

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegOpenKeyExW RegGetValueW RegQueryValueExW SystemFunction036 EventSetInformation EventWriteTransfer EventUnregister EventRegister

ntdll

RtlGetVersion NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtOpenFile NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile NtReadFile

kernel32

SetNamedPipeHandleState LoadLibraryW LoadLibraryExA FormatMessageW HeapAlloc lstrlenW GetFullPathNameW CreateFileW GetCurrentThreadStackLimits FormatMessageA LoadLibraryA GetModuleFileNameA FreeLibrary VirtualProtect SetHandleInformation SetFileCompletionNotificationModes OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW LCIDToLocaleName GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx GetUserDefaultUILanguage GetSystemTimeAsFileTime RtlPcToFileHeader GetFileInformationByHandle GetConsoleMode RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer HeapFree GetCurrentThreadId CreateMutexW RtlUnwind InitializeSListHead QueryPerformanceCounter QueryPerformanceFrequency RtlVirtualUnwind GetEnvironmentVariableW HeapReAlloc GetCurrentProcess WideCharToMultiByte LoadLibraryExW GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle SetFileTime DuplicateHandle GetProcessTimes WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineW TerminateProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot CopyFileExW MoveFileExW CreateDirectoryW GetFinalPathNameByHandleW DeviceIoControl GetFileInformationByHandleEx QueryFullProcessImageNameW SwitchToThread CreateEventW DeleteFileW FindFirstFileExW FindClose SetEnvironmentVariableW OpenProcess GetTempPathW ExitProcess SetUnhandledExceptionFilter CancelIo RtlUnwindEx MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateThread WaitForMultipleObjects ReadFileEx SleepEx FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx GetSystemTimePreciseAsFileTime GetSystemInfo GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry FindNextFileW GetModuleHandleW GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle InitializeCriticalSectionEx WaitForSingleObjectEx GetFileAttributesW DeleteCriticalSection

user32

RedrawWindow RegisterClassExW CreateWindowExW ClientToScreen GetClientRect GetWindowLongW ScreenToClient SetWindowPos GetCursorPos AdjustWindowRect DefWindowProcW TranslateAcceleratorW MonitorFromWindow DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu DrawIconEx CheckMenuItem GetMenuItemInfoW RemoveMenu CreatePopupMenu CreateMenu SetMenu DestroyWindow SetMenuItemInfoW AppendMenuW InsertMenuW TrackPopupMenu PostThreadMessageW CreateAcceleratorTableW DestroyAcceleratorTable VkKeyScanW CreateIcon GetAsyncKeyState GetKeyboardState MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx GetKeyState GetMenu IsWindowVisible GetRawInputData SetWindowTextW GetWindowTextW GetWindowTextLengthW SendInput MonitorFromRect SendMessageW EnumDisplayMonitors MonitorFromPoint DestroyIcon SetForegroundWindow SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor PostMessageW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx PeekMessageW DispatchMessageW RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC IsProcessDPIAware GetDC EnableWindow IsWindowEnabled GetMessageW GetWindowRect SetWindowLongPtrW GetParent FindWindowExW SetWindowRgn LoadImageW IsIconic EnumChildWindows DispatchMessageA GetSystemMetrics TranslateMessage PostQuitMessage GetMessageA GetForegroundWindow GetWindowLongPtrW DrawMenuBar RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos SetWindowDisplayAffinity LoadCursorW InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

ole32

CoCreateInstance RegisterDragDrop CoInitialize CoTaskMemFree CoUninitialize OleInitialize CoTaskMemAlloc CoInitializeEx CoCreateFreeThreadedMarshaler RevokeDragDrop

gdi32

SetTextColor CreateSolidBrush SetBkMode CombineRgn SelectObject CreateRectRgn DeleteObject BitBlt GetDeviceCaps DeleteDC CreateCompatibleDC CreateDIBSection

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

shlwapi

SHCreateMemStream

shell32

SHAppBarMessage ShellExecuteW DragFinish ILCreateFromPathW DragQueryFileW ILFree SHGetKnownFolderPath ShellExecuteExW SHOpenFolderAndSelectItems

oleaut32

GetErrorInfo SysFreeString SetErrorInfo SysStringLen

ws2_32

closesocket getsockname getsockopt getpeername accept recv WSASend send setsockopt ioctlsocket WSAIoctl WSASocketW bind listen shutdown freeaddrinfo WSAGetLastError getaddrinfo WSACleanup connect WSAStartup

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

strspn strncmp strlen _wcsicmp wcslen wcscmp strcpy_s strcmp toupper tolower strpbrk strcoll strncpy strncat strcspn iscntrl isgraph isalpha isprint isupper isalnum islower isdigit isxdigit isspace ispunct

api-ms-win-crt-math-l1-1-0

_dsign atan _dclass floorf ceil cos cosh log2 tanh sqrtf roundf tan pow exp sin trunc sqrt sinh fmod asin ceilf floor log acos ldexp __setusermatherr modf frexp round log10 atan2

api-ms-win-crt-heap-l1-1-0

_callnewh realloc _aligned_malloc free malloc _aligned_free _set_new_mode calloc

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf _pclose fwrite __p__commode fseek tmpfile __stdio_common_vfscanf fgets ftell __acrt_iob_func fflush clearerr fputs __stdio_common_vsprintf fclose feof ferror fopen tmpnam fread __stdio_common_vfprintf freopen getc _set_fmode __stdio_common_vsprintf_s _popen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _configure_narrow_argv _invoke_watson _initialize_narrow_environment exit strerror abort terminate _crt_atexit _get_initial_narrow_environment _initialize_onexit_table _errno _initterm _set_app_type system _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _initterm_e _exit _wassert _register_onexit_function

api-ms-win-crt-locale-l1-1-0

setlocale localeconv _configthreadlocale

api-ms-win-crt-convert-l1-1-0

strtoul _wtoi wcstol _ultow_s strtod strtoll strtoull atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_mktime64 _localtime64 _gmtime64 _gmtime64_s _difftime64 strftime _time64 _localtime64_s clock

api-ms-win-crt-filesystem-l1-1-0

remove rename

api-ms-win-crt-utility-l1-1-0

rand srand

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?__ExceptionPtrDestroy@@YAXPEAX@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z _Query_perf_counter ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ _Query_perf_frequency _Mtx_lock ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exception@std@@YA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ