c2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
c2.exe
Size 2.7MB
Sample261017-llws7sdv2s
SHA256 98ae77c7ca91a9c2faa07c040daf62b27af36f312c7ff0eee6c4525455a1c9a0
MD5 ecac9bf808934e10ad77ec369d8ffdc1
SHA1 a6a5bc535f30e73eae5c895a269154e85d0e6df5
SHA512 e103284130e8dd65cefb344b1ed6cdf5a69efa322266dc4699fc2057d842d887c43f5b27f4bb865da071afa9be99d41cad20a773349941868034aa7fdcd1e192
SSDEEP 24576:t3BUEmcjav0YCvP0HoIQXak1U1xZYGIXhSoHcYCwn+Ec0xMkl81sU3Ao1YonUFDT:JBUEJanCDIoa71nYjp5QYonUFDOZO
TLSH
T122D5D64369DB0CE9CED667BC61C75335A778FD72CA291F2BAA04D2212D536C4AD1EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2.exe

File Explorer

c2.exe

.exe 2.7MB

c2.exe

IMPHASH f1a6ca5fe5f860df655e00c2f3dd3942
SHA256 98ae77c7ca91a9c2faa07c040daf62b27af36f312c7ff0eee6c4525455a1c9a0
MD5 ecac9bf808934e10ad77ec369d8ffdc1
SHA1 a6a5bc535f30e73eae5c895a269154e85d0e6df5
SHA512 e103284130e8dd65cefb344b1ed6cdf5a69efa322266dc4699fc2057d842d887c43f5b27f4bb865da071afa9be99d41cad20a773349941868034aa7fdcd1e192
SSDEEP 24576:t3BUEmcjav0YCvP0HoIQXak1U1xZYGIXhSoHcYCwn+Ec0xMkl81sU3Ao1YonUFDT:JBUEJanCDIoa71nYjp5QYonUFDOZO
TLSH
T122D5D64369DB0CE9CED667BC61C75335A778FD72CA291F2BAA04D2212D536C4AD1EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkColor SetBkMode SetBrushOrgEx SetStretchBltMode SetTextColor StretchDIBits

gdiplus

GdipAlloc GdipBitmapLockBits GdipBitmapUnlockBits GdipCloneImage GdipCreateBitmapFromStream GdipDisposeImage GdipFree GdipGetImageHeight GdipGetImageWidth GdiplusShutdown GdiplusStartup

kernel32

CloseHandle CreateEventA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageA FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _fileno _get_osfhandle _lseeki64 _read _setmode _wfopen _write fclose fflush fopen fputc fputs fputwc fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CreateStreamOnHGlobal

user32

BeginPaint CallWindowProcW CreateWindowExW DefWindowProcW DispatchMessageW DrawTextW EndPaint FillRect GetClientRect GetMessageW GetWindowTextLengthW GetWindowTextW InvalidateRect KillTimer LoadCursorW MoveWindow PostMessageW PostQuitMessage RegisterClassExW SendMessageW SetFocus SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow TranslateMessage

ws2_32

WSACleanup WSAStartup accept bind closesocket htonl htons inet_ntop listen ntohl ntohs recv send setsockopt socket

Name

.text

Size

841KB

Virtual Size

841KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

512B

Virtual Size

219B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/123

Size

512B

Virtual Size

249B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c2.exe

gdi32

gdiplus

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

user32

ws2_32

generic