svc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
svc.exe
Size 3.1MB
Sample261003-yz4gesfc93
SHA256 ff1a30cebc507977f916aa47cd3cfbcb134867361737f0f79f56349475af8c1a
MD5 eb52993ec722f87de245d21ab5db5e60
SHA1 24446efb00e3dce54eb34aa91744fb01c6f952a6
SHA512 4cbe6b98daa9dad0b81dbbf2e6f62092d17a3c2bda3aaa3ca7265a41e135f5e981a6962b7147bda0c1597e0006d58ff1133e810c84006da82c5df2975db90276
SSDEEP 49152:4nDrUGujNsi/q/TJ8WfBFFijF5mHYc66NAAE8xIU6is:ddsigKWfBFW49AA2+s
TLSH
T113E59D43F28582ECE48FC17C87578732AA32B4990930B6EF16D55B383E6AE554F0D729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
svc.exe

File Explorer

svc.exe

.exe 3.1MB

svc.exe

IMPHASH fe15e614ab306a62ac05659af0c6d3c5
SHA256 ff1a30cebc507977f916aa47cd3cfbcb134867361737f0f79f56349475af8c1a
MD5 eb52993ec722f87de245d21ab5db5e60
SHA1 24446efb00e3dce54eb34aa91744fb01c6f952a6
SHA512 4cbe6b98daa9dad0b81dbbf2e6f62092d17a3c2bda3aaa3ca7265a41e135f5e981a6962b7147bda0c1597e0006d58ff1133e810c84006da82c5df2975db90276
SSDEEP 49152:4nDrUGujNsi/q/TJ8WfBFFijF5mHYc66NAAE8xIU6is:ddsigKWfBFW49AA2+s
TLSH
T113E59D43F28582ECE48FC17C87578732AA32B4990930B6EF16D55B383E6AE554F0D729
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CancelIo CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleExW GetOverlappedResult GetProcessHeap GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList IsThreadAFiber LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW CloseHandle GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA LocalFree DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

CryptAcquireContextW CryptDestroyKey CryptImportKey CryptReleaseContext SystemFunction036

crypt32

CertAddCertificateContextToStore CertAddEncodedCTLToStore CertAddEncodedCertificateToStore CertCloseStore CertCreateCTLEntryFromCertificateContextProperties CertCreateCertificateContext CertDeleteCertificateFromStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertOpenStore CertSetCertificateContextProperty CertVerifyCertificateChainPolicy CertVerifyTimeValidity CryptAcquireCertificatePrivateKey CryptBinaryToStringA CryptDecodeObjectEx CryptEncodeObjectEx CryptHashCertificate CryptMsgEncodeAndSignCTL CryptStringToBinaryA PFXExportCertStore PFXImportCertStore

ncrypt

NCryptFreeObject

secur32

AcceptSecurityContext AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm abort atexit calloc exit fflush fprintf free malloc memcmp memcpy memmove memset setvbuf signal strlen strncmp vfprintf

ntdll

NtCreateFile NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

userenv

GetUserProfileDirectoryW

ws2_32

GetHostNameW WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

svc.exe

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

crypt32

ncrypt

secur32

bcrypt

msvcrt

ntdll

userenv

ws2_32

generic