CatLock[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CatLock.exe
Size 806KB
Sample261001-k4htmaga64
SHA256 8de98e0d9697198a8319bfc8205ad192222a9140db41db3f099a365fcb4a72c0
MD5 17841d1265e7279b56da02f14a1ce154
SHA1 686e9a3c15de767243ecb0834638034324cdcb2f
SHA512 e2b70b11b2676f026daa5f29a11f9c6d766a1de4c9cc36823e7976bfac8f42b154ad48e79084cf87aceb7334c1451f931d6b0ad07ceeb89fd3526f9d47c446d7
SSDEEP 12288:f5cYMZzzKHyzO88Rda7WCuT++E6fdQFnSHCo7PAys:qLzWHyiNUuCo7PAys
TLSH
T15A05C68336DB0CEADED32B7864EB633AA735FE708B6A4B678504D1311C131D16D2AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CatLock.exe

File Explorer

CatLock.exe

.exe 806KB

CatLock.exe

IMPHASH 556222b7617f648f223616a72148be27
SHA256 8de98e0d9697198a8319bfc8205ad192222a9140db41db3f099a365fcb4a72c0
MD5 17841d1265e7279b56da02f14a1ce154
SHA1 686e9a3c15de767243ecb0834638034324cdcb2f
SHA512 e2b70b11b2676f026daa5f29a11f9c6d766a1de4c9cc36823e7976bfac8f42b154ad48e79084cf87aceb7334c1451f931d6b0ad07ceeb89fd3526f9d47c446d7
SSDEEP 12288:f5cYMZzzKHyzO88Rda7WCuT++E6fdQFnSHCo7PAys:qLzWHyiNUuCo7PAys
TLSH
T15A05C68336DB0CEADED32B7864EB633AA735FE708B6A4B678504D1311C131D16D2AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

CreateFontW CreatePen CreateSolidBrush DeleteObject Ellipse GetStockObject LineTo MoveToEx Rectangle SelectObject SetBkMode SetTextColor

kernel32

Beep CloseHandle CreateEventA CreateMutexW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FormatMessageA GetCurrentProcess GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LocalFree OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetPriorityClass SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

mbrtowc strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vswprintf_s _read _write fflush fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

memset strcmp strlen strncmp strnlen wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

rand_s

user32

BeginPaint CallNextHookEx CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawTextW EndPaint FillRect FrameRect GetAsyncKeyState GetClientRect GetForegroundWindow GetMessageW GetSystemMetrics InflateRect InvalidateRect IsWindow KillTimer LoadCursorA MessageBoxW PostQuitMessage RegisterClassW SetFocus SetForegroundWindow SetTimer SetWindowPos SetWindowsHookExW ShowWindow TranslateMessage UnhookWindowsHookEx UpdateWindow

Name

.text

Size

177KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

913B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CatLock.exe

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

generic