Lyre[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Lyre.exe
Size 10.9MB
Sample261018-w5k6xsf14k
SHA256 c48bbeaf4b295d75a0461bd4f09376130a55a4bb624fa37a3908e158c52ceb0f
MD5 99881611b47af2f26ddb06414e5845a8
SHA1 d3a40de5aa59eb040a4edec72158309aef1cd8b2
SHA512 af6148cb64e015c405f75ba523a289dcecea9e90a317395424449376f5867d7f00d6fadf98860981d8518b5919f2cda9b21ba1c3e28da97538f3bca7bd54b997
SSDEEP 98304:OZ3AvoEjlVdG90ygr2x2KGgNj4Jwk/TQY0w2itptaZFns9W0GqzJHqsIvDv:OSgEjlvG+VrY2a54JtTQiptv9Oqz8sG
TLSH
T156B6CF13F3D646ECD0A6D23CCEA7CA25E772B821077657DF069052295EA73E04E7A312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Lyre.exe

File Explorer

Lyre.exe

.exe 10.9MB

Lyre.exe

IMPHASH 9a1d64fc3d10ddd253062df9587d8448
SHA256 c48bbeaf4b295d75a0461bd4f09376130a55a4bb624fa37a3908e158c52ceb0f
MD5 99881611b47af2f26ddb06414e5845a8
SHA1 d3a40de5aa59eb040a4edec72158309aef1cd8b2
SHA512 af6148cb64e015c405f75ba523a289dcecea9e90a317395424449376f5867d7f00d6fadf98860981d8518b5919f2cda9b21ba1c3e28da97538f3bca7bd54b997
SSDEEP 98304:OZ3AvoEjlVdG90ygr2x2KGgNj4Jwk/TQY0w2itptaZFns9W0GqzJHqsIvDv:OSgEjlvG+VrY2a54JtTQiptv9Oqz8sG
TLSH
T156B6CF13F3D646ECD0A6D23CCEA7CA25E772B821077657DF069052295EA73E04E7A312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8f:80:f9:df:87:93:d7:44:13:79:55:69:e8:fa:a2:d9:4f:76:28:57:2b:47:d5:80:dc:8e:5a:8c:7c:ef:a6:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Lyre.exe

Chains

Oct 18, 2026

CN=Lyre.exe

Subject

CN=Lyre.exe

Serial Number

1d:c4:63:27:ac:ad:ba:b8:48:af:4f:74:0d:99:fe:c7

Issuer

CN=Lyre.exe

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2026 - Oct 10, 2027

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

3437136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

timeEndPeriod PlaySoundW timeBeginPeriod

shell32

CommandLineToArgvW SHFileOperationW SHCreateItemFromParsingName ShellExecuteExW DragFinish DragAcceptFiles DragQueryFileW SHGetKnownFolderPath ShellExecuteW

ole32

CoSetProxyBlanket CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize PropVariantClear

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

advapi32

RegSetKeyValueW RegDeleteKeyValueW RegEnumKeyExW RegEnumValueW RegQueryValueExW OpenProcessToken GetTokenInformation RegCloseKey RegDeleteKeyExW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW StartTraceW ProcessTrace CloseTrace ControlTraceW OpenTraceW EnableTraceEx2 RegGetValueW

user32

SetForegroundWindow FindWindowW MessageBoxA ShowWindow MessageBoxW SetProcessDpiAwarenessContext GetCursorPos GetAncestor UnhookWinEvent SetWinEventHook KillTimer TranslateMessage GetForegroundWindow SetTimer DispatchMessageW WindowFromPoint IsIconic PostMessageW GetMessageW GetWindowThreadProcessId ReleaseDC SystemParametersInfoW GetClientRect PrintWindow GetDC EndPaint BeginPaint InvalidateRect GetDpiForSystem LoadImageW ReleaseCapture UpdateWindow PostQuitMessage GetSystemMetricsForDpi SetCursor SetCapture LoadCursorW ChangeWindowMessageFilterEx RegisterRawInputDevices TrackMouseEvent GetRawInputData SetWindowPlacement GetMonitorInfoW GetActiveWindow GetWindowPlacement RegisterClassExW GetWindowLongPtrW GetSystemMetrics ScreenToClient CreateWindowExW EnumDisplayMonitors SetWindowLongPtrW MonitorFromRect GetDpiForWindow SetWindowPos IsWindowVisible DestroyWindow GetWindowRect GetMessageExtraInfo GetWindowTextW GetAsyncKeyState MapVirtualKeyW SendInput SetWindowTextW MonitorFromPoint GetWindow IsWindow EnumWindows UnregisterHotKey CallNextHookEx RegisterHotKey UnhookWindowsHookEx SetWindowsHookExW PostThreadMessageW SendMessageTimeoutW LoadStringW GetDoubleClickTime FillRect GetIconInfo DestroyIcon ClientToScreen GetDesktopWindow MonitorFromWindow EnumDisplaySettingsW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData PeekMessageW MsgWaitForMultipleObjectsEx UpdateLayeredWindow DefWindowProcW GetKeyState

dxva2

GetMonitorBrightness GetPhysicalMonitorsFromHMONITOR DestroyPhysicalMonitors SetMonitorBrightness GetNumberOfPhysicalMonitorsFromHMONITOR

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho GetAdaptersAddresses

ws2_32

send __WSAFDIsSet ntohl recv htonl select inet_pton getaddrinfo WSACleanup socket connect getsockopt inet_ntop htons freeaddrinfo ioctlsocket WSAGetLastError closesocket WSAStartup

userenv

RefreshPolicyEx

comdlg32

ChooseColorW

winhttp

WinHttpSetOption WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpCrackUrl WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect

bcrypt

BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptHash BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyKey BCryptImportKeyPair BCryptVerifySignature

crypt32

CryptProtectData CryptUnprotectData CertGetCertificateContextProperty CertFindCertificateInStore CryptMsgGetParam CertCloseStore CryptQueryObject CertFreeCertificateContext CryptMsgClose CertGetNameStringW

wintrust

WinVerifyTrust

cabinet

ord43 ord45 ord40

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mfplat

MFTEnumEx MFCreateDXGIDeviceManager MFCreateMediaType MFCreateAttributes MFShutdown MFCreateMemoryBuffer MFCreateSample MFStartup MFCreateDXGISurfaceBuffer

mfreadwrite

MFCreateSinkWriterFromURL MFCreateSourceReaderFromURL

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize RoUninitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString WindowsCreateStringReference

d2d1

ord1 ord2

dwrite

DWriteCreateFactory

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmExtendFrameIntoClientArea

gdi32

AddFontResourceW GetDeviceGammaRamp CreateDCW SetDeviceGammaRamp GetStockObject GetDIBits GetObjectW CreateDIBSection CreateCompatibleDC GdiFlush DeleteDC DeleteObject SelectObject

mfplay

MFPCreateMediaPlayer

kernel32

FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeConditionVariable CreateThread GetExitCodeThread WaitForSingleObjectEx AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFileTime SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileW GetStringTypeW FormatMessageA GetEnvironmentStringsW TerminateJobObject ResumeThread FreeEnvironmentStringsW CreatePipe CreateJobObjectW AssignProcessToJobObject SetHandleInformation SetInformationJobObject DeleteFileW FindClose ExitThread FreeLibraryAndExitThread ExitProcess GetNativeSystemInfo GetStdHandle RemoveDirectoryW FindNextFileW FindFirstFileExW SetFilePointerEx SetWaitableTimerEx GetEnvironmentVariableA PeekNamedPipe ReadFile MoveFileExW GetUserGeoID GetGeoInfoW QueryFullProcessImageNameW FindResourceW LoadResource LockResource SizeofResource GetSystemTime SystemTimeToFileTime GetPriorityClass Process32FirstW K32GetProcessMemoryInfo Process32NextW GetFileType HeapFree CreateToolhelp32Snapshot K32EmptyWorkingSet GetSystemTimeAsFileTime GetComputerNameW GetVolumeInformationW CreateWaitableTimerExW QueryPerformanceFrequency WaitForMultipleObjects CreateWaitableTimerW SetWaitableTimer GetThreadGroupAffinity SetThreadPriorityBoost GetSystemCpuSetInformation SetThreadGroupAffinity ResetEvent GetThreadPriority GetThreadIdealProcessorEx SetProcessInformation SetThreadIdealProcessorEx GetExitCodeProcess CreateProcessW GetSystemDirectoryW TerminateProcess OpenProcess OpenFileMappingW HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW WaitForSingleObject SetPriorityClass GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode OpenThread GetThreadTimes CheckRemoteDebuggerPresent IsDebuggerPresent VirtualQuery MapViewOfFile CreateFileMappingW GetThreadContext LoadLibraryW UnmapViewOfFile GetFileSizeEx GetTempPathW GetFileAttributesW GlobalUnlock GlobalLock GlobalFree GlobalAlloc CompareStringOrdinal SetEvent CreateEventW SetThreadPriority GetCurrentThread SetThreadInformation QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar SetUnhandledExceptionFilter LoadLibraryExW ReadConsoleW RtlUnwind GetProcessTimes SetDllDirectoryW GetModuleHandleW GetCurrentProcessId GetTimeZoneInformation HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetLocaleInfoEx LocalFree GetProcAddress CreateDirectoryW GetModuleFileNameA SetDefaultDllDirectories GetCommandLineW GetCurrentProcess WriteFile GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CreateMutexW CreateFileW GetCurrentThreadId Sleep GetTickCount64 GetLastError AttachConsole CloseHandle GetSystemInfo HeapSetInformation GetLocalTime

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

916KB

Virtual Size

915KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

349KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Lyre.exe

PE Signature issue

winmm

shell32

ole32

oleaut32

advapi32

user32

dxva2

iphlpapi

ws2_32

userenv

comdlg32

winhttp

bcrypt

crypt32

wintrust

cabinet

d3d11

dxgi

mfplat

mfreadwrite

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

d2d1

dwrite

dwmapi

gdi32

mfplay

kernel32

generic