twezsq[.]com | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
twezsq.com
Size 39.8MB
Sample261011-devnkavsht
SHA256 d5574d1781117f2623467fa20c0f45d2ed037b466671ce0191ecf7ae1b902073
MD5 a1ef852b219cc7d45a67df3ebfb4e705
SHA1 5740a7b7ccb09c7ea79aa07a0cdafd0cb16cac6d
SHA512 0697cdb69fc6d6ebabb5b20e943e93056fbf89ad88b58e544108c5f413274857c9656341691184039eb025ff0fa3a0a93d23dc782afdafde8855501891f57eba
SSDEEP 786432:QMDL1DLeoatk6ZNF4/zlUZP+ks+WRvTZ5WCMpVky46r1ZEAVSZcpwQ:QsLR7atR4/aRqV5dgT46r1ZEAQZHQ
TLSH
T1C997239978D4A1ECCB02C531E78A2AFDE1EA789A4DB9941F7FC604013931C96CDE5C36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
twezsq.com

File Explorer

twezsq.com

.exe 39.8MB

twezsq.com

IMPHASH c7fb700ad4fc0c0b4a615e5abaede4ee
SHA256 d5574d1781117f2623467fa20c0f45d2ed037b466671ce0191ecf7ae1b902073
MD5 a1ef852b219cc7d45a67df3ebfb4e705
SHA1 5740a7b7ccb09c7ea79aa07a0cdafd0cb16cac6d
SHA512 0697cdb69fc6d6ebabb5b20e943e93056fbf89ad88b58e544108c5f413274857c9656341691184039eb025ff0fa3a0a93d23dc782afdafde8855501891f57eba
SSDEEP 786432:QMDL1DLeoatk6ZNF4/zlUZP+ks+WRvTZ5WCMpVky46r1ZEAVSZcpwQ:QsLR7atR4/aRqV5dgT46r1ZEAQZHQ
TLSH
T1C997239978D4A1ECCB02C531E78A2AFDE1EA789A4DB9941F7FC604013931C96CDE5C36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45231472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetReadFile

crypt32

CertOpenStore

advapi32

RegQueryInfoKeyW

user32

FindWindowExW

bcrypt

BCryptGenRandom

kernel32

AreFileApisANSI

gdi32

GetObjectW

shell32

ShellExecuteA

ole32

CoTaskMemFree

oleaut32

SysFreeString

msvcp140

?id@?$ctype@_W@std@@2V0locale@2@A

ntdll

NtResumeProcess

netapi32

NetApiBufferFree

sfc

SRSetRestorePointW

gdiplus

GdipSaveImageToStream

vcruntime140

memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-stdio-l1-1-0

fflush

api-ms-win-crt-runtime-l1-1-0

__p___argv

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-conio-l1-1-0

_getch

ws2_32

setsockopt

wintrust

WinVerifyTrust

tbs

Tbsi_GetDeviceInfo

setupapi

SetupDiGetDeviceInstanceIdW

cfgmgr32

CM_Set_DevNode_PropertyW

Name

.text

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

911KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eac0

Size

Virtual Size

31.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.eac1

Size

1024B

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eac2

Size

39.8MB

Virtual Size

39.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

twezsq.com

wininet

crypt32

advapi32

user32

bcrypt

kernel32

gdi32

shell32

ole32

oleaut32

msvcp140

ntdll

netapi32

sfc

gdiplus

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

ws2_32

wintrust

tbs

setupapi

cfgmgr32

generic