stage2_dump[.]bin | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
stage2_dump.bin
Size 26.1MB
Sample261013-2wp2eacw9w
SHA256 9cf4022651a33e265f07f8ff6d8ff49b10d4ce7fe5762fc63aad9356a4dbf352
MD5 13f381e916a57b3abe40b4e52a6fccf5
SHA1 f46b7a71527ce9a0de7ce07ed04f259ddb69cb32
SHA512 96a45b1512d88edfccc35592d2bd55a3c8e42f4f0a128d0d4b496acc07e4f13c64476ba54a57ea52cd0ac1e9ed90599af1acd6b8f9a0b9fb1c430038ebd7848b
SSDEEP 393216:Km+XgoccK5BmMYUBhvAE/MuxUxg7XfQ8A9XoCR42PamJspsAb:KNXg3dBBAKMu+x+XfQ5t6vmu6
TLSH
T1935722D668E581ACC892C630E28A6FFDF0DDB4494DB9982FBFC709012531D56CCB6936
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
stage2_dump.bin

File Explorer

stage2_dump.bin

.dll 26.1MB

stage2_dump.bin

IMPHASH 1a78dde7a42cd14f1a59696a222708c3
SHA256 9cf4022651a33e265f07f8ff6d8ff49b10d4ce7fe5762fc63aad9356a4dbf352
MD5 13f381e916a57b3abe40b4e52a6fccf5
SHA1 f46b7a71527ce9a0de7ce07ed04f259ddb69cb32
SHA512 96a45b1512d88edfccc35592d2bd55a3c8e42f4f0a128d0d4b496acc07e4f13c64476ba54a57ea52cd0ac1e9ed90599af1acd6b8f9a0b9fb1c430038ebd7848b
SSDEEP 393216:Km+XgoccK5BmMYUBhvAE/MuxUxg7XfQ8A9XoCR42PamJspsAb:KNXg3dBBAKMu+x+XfQ5t6vmu6
TLSH
T1935722D668E581ACC892C630E28A6FFDF0DDB4494DB9982FBFC709012531D56CCB6936
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30393368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ws2_32

send WSASetLastError setsockopt WSAGetLastError ioctlsocket freeaddrinfo htons getsockopt recv connect getsockname __WSAFDIsSet WSAIoctl closesocket select shutdown inet_pton getaddrinfo WSAStartup socket

iphlpapi

FreeMibTable SendARP GetIpForwardTable2 ResolveIpNetEntry2 GetAdaptersAddresses

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpSendRequest WinHttpQueryOption WinHttpSetOption WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpReadData

kernel32

LCMapStringW CompareStringW ReadFile FindFirstFileW VirtualFree FindNextFileW GetCurrentProcess WriteFile VirtualAlloc RemoveDirectoryW GetEnvironmentVariableW FindClose CreateFileW DuplicateHandle GetModuleHandleA OpenProcess SetFileAttributesW DeleteFileW CloseHandle GetProcAddress GetFileSize GetCurrentProcessId QueryUnbiasedInterruptTime CompareFileTime GetFileSizeEx GetConsoleScreenBufferInfo SetLastError SetConsoleTextAttribute EnterCriticalSection GetStdHandle SetCurrentConsoleFontEx DeviceIoControl TerminateProcess GetFinalPathNameByHandleW GetDriveTypeA LoadLibraryExA GetModuleFileNameW WaitForMultipleObjects Thread32Next LeaveCriticalSection InitializeCriticalSection GetTempPathW Thread32First WaitForSingleObject CreateToolhelp32Snapshot CreateEventW GetExitCodeThread Sleep GetConsoleMode GetFileInformationByHandle GetModuleHandleExA GetTickCount64 GetLastError GetFileAttributesExW Process32NextW FillConsoleOutputCharacterW CreateFileA SetEvent DisableThreadLibraryCalls ReadConsoleOutputW Process32FirstW GetNativeSystemInfo LoadLibraryW Module32FirstW FillConsoleOutputAttribute GetWindowsDirectoryW WriteConsoleW SetFilePointerEx DeleteCriticalSection ReadProcessMemory GetModuleHandleW FreeLibrary WideCharToMultiByte Module32NextW GetSystemTimeAsFileTime GetDiskFreeSpaceExA SetConsoleCursorPosition VirtualQuery OpenThread InitOnceExecuteOnce LoadLibraryA LoadLibraryExW FindFirstStreamW FindNextStreamW RemoveVectoredExceptionHandler AddVectoredExceptionHandler RtlDeleteFunctionTable QueryPerformanceCounter GetSystemFirmwareTable HeapFree HeapAlloc GetProcessHeap GetFirmwareEnvironmentVariableW lstrcmpiA GetCurrentThreadId CreateTimerQueueTimer VirtualProtect CreateMutexW LocalAlloc ReleaseMutex GetSystemDirectoryW ResumeThread UnmapViewOfFile GetSystemInfo LocalFree GetThreadId FlushInstructionCache RtlUnwind EnumSystemFirmwareTables CreateFileMappingW MapViewOfFile GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetModuleHandleExW ExitProcess ReadConsoleInputW FlushFileBuffers GetConsoleOutputCP TerminateThread SetConsoleMode GetExitCodeProcess CreateProcessW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetConsoleCP InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter SetStdHandle HeapSize HeapReAlloc CreateThread DeleteTimerQueueTimer SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

wsprintfW MessageBoxA wsprintfA EnumWindows GetClassNameA IsWindow SetWindowPos GetWindowThreadProcessId

advapi32

LookupPrivilegeValueW ControlService ChangeServiceConfigA OpenSCManagerA CloseServiceHandle RegCloseKey GetSecurityDescriptorControl GetKernelObjectSecurity ConvertStringSecurityDescriptorToSecurityDescriptorW SetKernelObjectSecurity EqualSid IsValidSid GetTokenInformation RegQueryValueExW OpenServiceA AdjustTokenPrivileges OpenProcessToken RegQueryValueExA RegOpenKeyExA RegCreateKeyA EnumServicesStatusA RegDeleteTreeA ControlTraceA

shell32

ord680

shlwapi

PathFileExistsW StrStrIA StrStrIW

secur32

AcquireCredentialsHandleW FreeContextBuffer DeleteSecurityContext FreeCredentialsHandle InitializeSecurityContextW EncryptMessage QueryContextAttributesW DecryptMessage ApplyControlToken

crypt32

CertGetCertificateChain CertFreeCertificateContext CryptHashCertificate2 CertFreeCertificateChain CertGetNameStringW

bcrypt

BCryptGenRandom BCryptFinishHash BCryptDestroyHash BCryptHash BCryptHashData BCryptCreateHash

dxgi

CreateDXGIFactory

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiOpenDevRegKey CM_Get_DevNode_Status SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiGetDeviceInstanceIdW

Name

.text

Size

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.M;c

Size

Virtual Size

17.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.7{h

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lCw

Size

26.1MB

Virtual Size

26.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

stage2_dump.bin

ws2_32

iphlpapi

winhttp

kernel32

user32

advapi32

shell32

shlwapi

secur32

crypt32

bcrypt

dxgi

setupapi

generic