celerity[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
celerity.exe
Size 2.4MB
Sample261002-x3a4lsxbld
SHA256 696d482924c33bc0c40d1bedf78b44c33b2bcd7ca1c12dc71f940718330220ed
MD5 09f1a4b6ce1015cfa6f0827fe1b0adaa
SHA1 a3eaedb52a2021ac00483b4faffb051f9b2e7497
SHA512 4b80fbc3d343b002d65760ee85b6019efc8b92c3c545a72bff446aa7ba7fec92c791b7c636ec09479f42f7f11890e6755b1b35d587b49ad629affd44dd6d1ec0
SSDEEP 49152:6o8CeJmL01MWA+OanXPN9NGy7xJBJRy15t+a:eha0PPNi1S
TLSH
T147C5B047B3D94459D023B4788B42D61BE332B4250F61828B7FC50A9E5FBF6B08B7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
celerity.exe

File Explorer

celerity.exe

.exe 2.4MB

celerity.exe

IMPHASH 694a09d0bf9805f3bf55d41de8e6cc6a
SHA256 696d482924c33bc0c40d1bedf78b44c33b2bcd7ca1c12dc71f940718330220ed
MD5 09f1a4b6ce1015cfa6f0827fe1b0adaa
SHA1 a3eaedb52a2021ac00483b4faffb051f9b2e7497
SHA512 4b80fbc3d343b002d65760ee85b6019efc8b92c3c545a72bff446aa7ba7fec92c791b7c636ec09479f42f7f11890e6755b1b35d587b49ad629affd44dd6d1ec0
SSDEEP 49152:6o8CeJmL01MWA+OanXPN9NGy7xJBJRy15t+a:eha0PPNi1S
TLSH
T147C5B047B3D94459D023B4788B42D61BE332B4250F61828B7FC50A9E5FBF6B08B7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Module32FirstW GetProcAddress VirtualAllocEx GetModuleHandleW CreateRemoteThread Module32NextW VirtualFreeEx QueryPerformanceCounter CloseHandle GetCurrentThreadId GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive WriteProcessMemory Process32FirstW QueryPerformanceFrequency Process32NextW Sleep CreateToolhelp32Snapshot CreateThread OpenProcess CreateFileW WaitForSingleObject GetTempPathW WriteFile GetSystemTimeAsFileTime InitializeSListHead

user32

CreateWindowExW SendMessageW DestroyWindow MessageBoxW SetWindowPos ReleaseDC ReleaseCapture PostQuitMessage DefWindowProcW GetMessageW GetWindowRect GetDC KillTimer UpdateLayeredWindow GetSystemMetrics RegisterClassExW LoadCursorW TranslateMessage ShowWindow DispatchMessageW SetTimer

gdi32

CreateDIBSection CreateCompatibleDC DeleteDC AddFontMemResourceEx SelectObject DeleteObject

advapi32

GetUserNameW

shell32

ShellExecuteW

ole32

CoUninitialize CoInitialize CoCreateInstance

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

shlwapi

PathCombineW

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

d2d1

ord1

dwrite

DWriteCreateFactory

winmm

timeBeginPeriod timeEndPeriod

vcruntime140

__current_exception __std_exception_destroy memcpy __std_exception_copy memset __C_specific_handler _CxxThrowException __current_exception_context

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vswprintf_s

api-ms-win-crt-math-l1-1-0

ceilf floorf lroundf __setusermatherr expf fabs

api-ms-win-crt-string-l1-1-0

strlen _wcsicmp wcscpy_s wcslen

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _cexit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale