Taisho[.]cc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Taisho.cc.exe
Size 18.6MB
Sample261002-wcb3jsvv8j
SHA256 dc87f9edf98d6ce0fef1790856b768cf15b2220d65f3fb03febc5a60b1a043f9
MD5 aa95b7710d270a0ae6e8a93fa80de5cf
SHA1 d945a444347dea199602b05eafbc200383af4c60
SHA512 a7951049c21a96ab11e4c8557140036d6030d4ae36989288986d37d7d227c4c8aae9eedabe548ae22717c1f2c39cd4baff19e12dcea8dd397cde02252b0ce982
SSDEEP 393216:EbOEdJ7iZuJXbrhnMzdB81oI2kSWprQucNx/vIzsY6rX5IWqCe71wl0gW0:qMzdB8aI2kSWprvqBIoHxqCsuVW
TLSH
T1DC17AD43F342C980C8164A358D56DBE587327C29AF1617973184BF1FBEB32C26E7A691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Taisho.cc.exe

File Explorer

Taisho.cc.exe

.exe 18.6MB

Taisho.cc.exe

IMPHASH ff8afd26e16bb80891c128deb5a7eb8b
SHA256 dc87f9edf98d6ce0fef1790856b768cf15b2220d65f3fb03febc5a60b1a043f9
MD5 aa95b7710d270a0ae6e8a93fa80de5cf
SHA1 d945a444347dea199602b05eafbc200383af4c60
SHA512 a7951049c21a96ab11e4c8557140036d6030d4ae36989288986d37d7d227c4c8aae9eedabe548ae22717c1f2c39cd4baff19e12dcea8dd397cde02252b0ce982
SSDEEP 393216:EbOEdJ7iZuJXbrhnMzdB81oI2kSWprQucNx/vIzsY6rX5IWqCe71wl0gW0:qMzdB8aI2kSWprvqBIoHxqCsuVW
TLSH
T1DC17AD43F342C980C8164A358D56DBE587327C29AF1617973184BF1FBEB32C26E7A691
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2189376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\taish\Downloads\source\Build\Artifacts\Taisho.cc.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

kernel32

ExitProcess GetComputerNameA GetTickCount64 VirtualAllocEx GetLastError SetLastError FlushInstructionCache GetSystemInfo VirtualQueryEx VirtualFreeEx GetModuleHandleW K32EnumProcessModules K32GetModuleBaseNameW LoadLibraryExA FormatMessageA GetProcessTimes GetSystemTimes K32GetProcessMemoryInfo QueryFullProcessImageNameW GetCurrentProcessId GetTickCount CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime WakeAllConditionVariable InitOnceComplete InitOnceBeginInitialize GetLocaleInfoEx GetFileInformationByHandleEx AreFileApisANSI GetThreadContext SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW SleepConditionVariableSRW LocalFree InitializeCriticalSection GetCurrentThreadId Process32NextW Process32FirstW VirtualProtect TerminateProcess GetCurrentProcess GetStdHandle ReadProcessMemory Sleep GetLocaleInfoA CheckRemoteDebuggerPresent CreateFileW VerifyVersionInfoW WaitForMultipleObjects PeekNamedPipe GetFileType GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW FormatMessageW SleepEx LoadLibraryW GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive IsDebuggerPresent Module32NextW Module32FirstW VirtualProtectEx Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot OpenProcess GetProcessId GetExitCodeProcess GetConsoleWindow SetConsoleTitleA SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCtrlHandler AllocConsole SetUnhandledExceptionFilter SetThreadPriority GetCurrentThread CreateThread WaitForSingleObject CloseHandle WriteProcessMemory TlsAlloc SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetProcAddress LoadLibraryA GetConsoleMode VirtualAlloc GetModuleFileNameA GetLocalTime TlsSetValue TlsGetValue CreateFile2

user32

GetKeyboardLayout EmptyClipboard SetLayeredWindowAttributes DestroyWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage LoadIconA GetWindowTextA SetWindowLongA SetForegroundWindow TrackMouseEvent MessageBoxA SetWindowPos ShowWindow SendInput GetWindowThreadProcessId EnumWindows FindWindowA IsWindowVisible IsWindow MapVirtualKeyA GetKeyNameTextA GetAsyncKeyState GetClassNameA GetWindowRect GetClipboardData SetClipboardData CloseClipboard OpenClipboard EndPaint BeginPaint UpdateWindow GetSystemMetrics BringWindowToTop SetProcessDPIAware GetSystemMenu GetMessageExtraInfo DeleteMenu LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect SetWindowDisplayAffinity GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState

gdi32

GetStockObject

advapi32

SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA

shell32

ShellExecuteW

winhttp

WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpReadData WinHttpSendRequest WinHttpReceiveResponse WinHttpSetOption WinHttpOpenRequest

msvcp140

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$numpunct@D@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ _Xtime_get_ticks ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ _Thrd_yield ?_Xinvalid_argument@std@@YAXPEBD@Z ??7ios_base@std@@QEBA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_counter ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ _Query_perf_frequency ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ _Thrd_detach _Mtx_lock _Mtx_unlock ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??Bios_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ

msvcp140_atomic_wait

__std_atomic_wait_direct __std_atomic_notify_all_direct

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

winmm

timeBeginPeriod

bcrypt

BCryptGenRandom BCryptHash BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptStringToBinaryA CryptBinaryToStringA CertOpenStore CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject

ws2_32

send recv listen WSAIoctl htons htonl setsockopt socket getsockname closesocket recvfrom getsockopt WSACloseEvent WSACreateEvent freeaddrinfo ioctlsocket gethostname select WSAEnumNetworkEvents bind WSAEventSelect getaddrinfo getpeername WSAGetLastError accept sendto connect inet_pton ntohs WSASetLastError inet_ntop __WSAFDIsSet

vcruntime140

__current_exception wcschr memmove __intrinsic_setjmp __current_exception_context strrchr longjmp __std_exception_copy __std_exception_destroy _CxxThrowException memcpy memset __C_specific_handler __std_terminate strstr memchr memcmp strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

log tan log10 logf pow powf _dsign _ldsign _fdsign fmod exp ldexp asin atan2f frexp acos sinf tanf atan2 sin _fdclass roundf acosf _fdopen cos lroundf lround __setusermatherr expf fmodf

api-ms-win-crt-heap-l1-1-0

free realloc calloc _set_new_mode malloc _callnewh

api-ms-win-crt-string-l1-1-0

isdigit wcslen strncpy _strdup wcsncpy wcsncmp wcspbrk strcspn strcoll iscntrl isgraph ispunct islower isupper isalpha strncmp strcpy_s tolower strncpy_s strcmp strcpy strpbrk isxdigit strspn toupper isalnum _stricmp towlower _wcsicmp isspace _strlwr_s strlen

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-stdio-l1-1-0

_close _write _read ungetc setvbuf _fseeki64 fsetpos _fileno __p__commode clearerr fgetpos fgetc _get_stream_buffer_pointers _lseeki64 _wopen freopen_s __acrt_iob_func __stdio_common_vsprintf_s __stdio_common_vfprintf tmpnam feof ferror fputs fputc _wfopen fclose fopen freopen getc fgets tmpfile _popen _pclose _ftelli64 fflush fread fseek _set_fmode __stdio_common_vsscanf __stdio_common_vsprintf fwrite ftell

api-ms-win-crt-convert-l1-1-0

strtoull strtoll wcstombs atoi strtoul strtod atof strtol

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _invoke_watson _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _exit __p___argv __p___argc __sys_errlist _cexit _c_exit _register_thread_local_exe_atexit_callback exit _beginthreadex _errno terminate _initialize_onexit_table _register_onexit_function _crt_atexit strerror system abort __sys_nerr

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale setlocale

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlock_file _lock_file rename _unlink _fstat64 remove

api-ms-win-crt-time-l1-1-0

clock strftime _difftime64 _gmtime64 _localtime64 _mktime64 _time64

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

652KB

Virtual Size

681KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14.4MB

Virtual Size

14.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Taisho.cc.exe

d3d11

dwmapi

kernel32

user32

gdi32

advapi32

shell32

winhttp

msvcp140

msvcp140_atomic_wait

imm32

d3dcompiler_47

winmm

bcrypt

crypt32

ws2_32

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic