Lyre[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Lyre.exe
Size 2.1MB
Sample261003-prrm8aydme
SHA256 0c76e4c633b01ca41b286cc9491802624259fccbb3e70f08828dab365a68f0e5
MD5 fccaa469e5f928131f5b1b603d198798
SHA1 18e3fb9190c7a1846a559fb370a901bb6d3b27ba
SHA512 95a95c09adf0e81a51977f1521c5f84b0cbb8acf36e6cabc6e6fed96b99144b0e4238bdf9debf08b298a48d6a0d7970cbf03a743a65e95a4bb162feb6b8f7174
SSDEEP 24576:5JmgybBePfbdEbq3EFLtYk2h0dg8lyIMl1KEoson7cUIT5B+mUgpEaNv+:Cg0B4sfSk2h0dgzKEogL2
TLSH
T1C9A57C17A3D901F8E0FAD278CE56981AEB7274590771A7DF06D0416A0FAB6E04F7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Lyre.exe

File Explorer

Lyre.exe

.exe 2.1MB

Lyre.exe

IMPHASH 00cfb3ca2bb75508d65e6e0ce6de9cd3
SHA256 0c76e4c633b01ca41b286cc9491802624259fccbb3e70f08828dab365a68f0e5
MD5 fccaa469e5f928131f5b1b603d198798
SHA1 18e3fb9190c7a1846a559fb370a901bb6d3b27ba
SHA512 95a95c09adf0e81a51977f1521c5f84b0cbb8acf36e6cabc6e6fed96b99144b0e4238bdf9debf08b298a48d6a0d7970cbf03a743a65e95a4bb162feb6b8f7174
SSDEEP 24576:5JmgybBePfbdEbq3EFLtYk2h0dg8lyIMl1KEoson7cUIT5B+mUgpEaNv+:Cg0B4sfSk2h0dgzKEogL2
TLSH
T1C9A57C17A3D901F8E0FAD278CE56981AEB7274590771A7DF06D0416A0FAB6E04F7E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1208464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

timeBeginPeriod timeEndPeriod PlaySoundW

shell32

SHGetKnownFolderPath ShellExecuteExW CommandLineToArgvW ShellExecuteW SHCreateItemFromParsingName

ole32

CoSetProxyBlanket CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

advapi32

RegEnumKeyExW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegSetKeyValueW RegDeleteKeyValueW RegCloseKey RegGetValueW GetTokenInformation OpenProcessToken RegQueryValueExW RegEnumValueW RegDeleteKeyExW

user32

UpdateWindow SystemParametersInfoW ReleaseCapture GetClientRect GetSystemMetricsForDpi SetCursor SetCapture LoadCursorW TrackMouseEvent SetWindowPlacement GetMonitorInfoW GetActiveWindow GetWindowPlacement RegisterClassExW GetWindowLongPtrW GetSystemMetrics PostQuitMessage GetKeyState IsIconic SetForegroundWindow FindWindowW MessageBoxA ShowWindow SetProcessDpiAwarenessContext GetCursorPos GetAncestor KillTimer TranslateMessage SetTimer DispatchMessageW WindowFromPoint MessageBoxW PostMessageW GetMessageW EndPaint BeginPaint InvalidateRect GetDpiForSystem ScreenToClient MapVirtualKeyW SendInput UnregisterHotKey CallNextHookEx PeekMessageW RegisterHotKey UnhookWindowsHookEx SetWindowsHookExW PostThreadMessageW SendMessageTimeoutW LoadStringW GetClipboardData OpenClipboard CloseClipboard EmptyClipboard SetClipboardData DefWindowProcW CreateWindowExW GetMessageExtraInfo DestroyWindow SetWindowPos GetDpiForWindow MonitorFromRect SetWindowLongPtrW EnumDisplayMonitors LoadImageW

dxva2

SetMonitorBrightness GetMonitorBrightness GetNumberOfPhysicalMonitorsFromHMONITOR GetPhysicalMonitorsFromHMONITOR DestroyPhysicalMonitors

iphlpapi

GetAdaptersAddresses

ws2_32

WSACleanup inet_ntop ntohl __WSAFDIsSet closesocket WSAGetLastError ioctlsocket htons htonl recv connect socket send WSAStartup select

userenv

RefreshPolicyEx

comdlg32

ChooseColorW

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptCreateHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider BCryptDestroyHash

crypt32

CryptUnprotectData CryptProtectData

d2d1

ord1

dwrite

DWriteCreateFactory

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

gdi32

AddFontResourceW DeleteDC GetDeviceGammaRamp CreateDCW SetDeviceGammaRamp

kernel32

GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW HeapReAlloc GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc ExitProcess WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc GetTimeZoneInformation SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentProcessId IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind IsValidCodePage RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeConditionVariable InitializeCriticalSectionAndSpinCount GetConsoleMode GetFileInformationByHandleEx MoveFileExW CopyFileW AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetACP GetOEMCP FindFirstFileW CreateFileW CreateDirectoryW GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocaleInfoEx FormatMessageA DeleteFileW FindClose GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetTempPathW RemoveDirectoryW SetEnvironmentVariableW SetStdHandle FindNextFileW FindFirstFileExW QueryFullProcessImageNameW GetProcessHeap HeapSize WriteConsoleW SetEndOfFile RtlLookupFunctionEntry GetThreadTimes GetCommandLineW CreateMutexW GetLastError AttachConsole CloseHandle LocalFree SetUnhandledExceptionFilter GetModuleFileNameW WideCharToMultiByte MultiByteToWideChar GetModuleHandleW QueryPerformanceCounter CompareStringOrdinal GlobalAlloc GlobalFree GlobalLock GlobalUnlock Sleep RtlUnwind OpenThread TerminateProcess WaitForSingleObject GetSystemDirectoryW CreateProcessW GetExitCodeProcess SetThreadIdealProcessorEx SetThreadInformation SetPriorityClass GetCurrentProcess SetProcessInformation GetThreadIdealProcessorEx SetThreadPriority GetCurrentThreadId CreateEventW SetEvent GetCurrentThread GetThreadPriority ResetEvent GetSystemCpuSetInformation GetPriorityClass GetProcAddress FreeLibrary LoadLibraryExW GetVolumeInformationW GetComputerNameW GetSystemTimeAsFileTime K32EmptyWorkingSet OpenProcess CreateToolhelp32Snapshot Process32NextW K32GetProcessMemoryInfo QueryPerformanceFrequency Process32FirstW GetTickCount64 GetLocalTime SystemTimeToFileTime GetSystemTime SizeofResource LockResource LoadResource FindResourceW GetEnvironmentVariableW WaitForMultipleObjects SetWaitableTimerEx CreateWaitableTimerExW

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

394KB

Virtual Size

393KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

111KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Lyre.exe

winmm

shell32

ole32

oleaut32

advapi32

user32

dxva2

iphlpapi

ws2_32

userenv

comdlg32

winhttp

bcrypt

crypt32

d2d1

dwrite

dwmapi

gdi32

kernel32

generic