test_bot[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
test_bot.exe
Size 462KB
Sample261022-yl2qnsbd75
SHA256 b880db3d79a5fd544c4dde01d04b784eec0cfadc3ed6cdc697a7382baf51e624
MD5 f8da1bc3e4ae2a68fbb6dfca4c90c1d2
SHA1 d4049f45242cf45eecbf7243db8359c5a9e38826
SHA512 30a91106ba94f80f4adde48ce809839cbfcb616cdb411b737ed91f1e0692f7c9f42c349e5cefafc0c608a34d0978265919b8348e1ae335e773130e35e24ead9d
SSDEEP 6144:i4RWRnim+kYu1n6703Spq/jALDmwXIgIvu2wZ8RUmIv2PLkk8HsJP5L5V+0N2:5WRnimLJhnjALDLIvuPZRv24D0w
TLSH
T113A42933D3A286B8C097C174DE8696B2B575FC484134B2AF2745CF123F16B609F6EA94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
test_bot.exe

File Explorer

test_bot.exe

.exe 462KB

test_bot.exe

IMPHASH 6c6bb23a649da52388a7d2c55f750219
SHA256 b880db3d79a5fd544c4dde01d04b784eec0cfadc3ed6cdc697a7382baf51e624
MD5 f8da1bc3e4ae2a68fbb6dfca4c90c1d2
SHA1 d4049f45242cf45eecbf7243db8359c5a9e38826
SHA512 30a91106ba94f80f4adde48ce809839cbfcb616cdb411b737ed91f1e0692f7c9f42c349e5cefafc0c608a34d0978265919b8348e1ae335e773130e35e24ead9d
SSDEEP 6144:i4RWRnim+kYu1n6703Spq/jALDmwXIgIvu2wZ8RUmIv2PLkk8HsJP5L5V+0N2:5WRnimLJhnjALDLIvuPZRv24D0w
TLSH
T113A42933D3A286B8C097C174DE8696B2B575FC484134B2AF2745CF123F16B609F6EA94
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges GetTokenInformation GetUserNameA LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteTreeA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCA CreateDIBSection DeleteDC DeleteObject GdiFlush GetDIBits GetDeviceCaps GetObjectA GetStockObject SelectObject SetBrushOrgEx SetStretchBltMode StretchBlt

gdiplus

GdipAlloc GdipCloneBitmapArea GdipCloneImage GdipCreateBitmapFromScan0 GdipDisposeImage GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipLoadImageFromFile GdipSaveImageToFile GdipSaveImageToStream GdiplusShutdown GdiplusStartup

kernel32

AddVectoredExceptionHandler CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateFileW CreateMutexA CreatePipe CreateProcessA CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FreeLibrary GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetDriveTypeA GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFileTime GetLastError GetLocalTime GetLogicalDriveStringsA GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetVolumeInformationA GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MoveFileW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringA PeekNamedPipe Process32FirstW Process32NextW QueryFullProcessImageNameA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEvent SetFilePointer SetFileTime SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

api-ms-win-crt-convert-l1-1-0

_wtoi atoi mbrtowc mbsrtowcs strtol strtoll strtoul strtoull wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _register_thread_local_exe_atexit_callback _set_errno _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _fileno _fileno _get_osfhandle _read _setmode _wfopen fclose fflush fputc fread fseek ftell fwrite getc setvbuf ungetc

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _wcsicmp isdigit isspace isxdigit mbrlen memset strcmp strcpy strlen strncmp strncpy strnlen tolower towlower wcscmp wcslen wcsnlen

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

rand rand_s srand

ole32

CoCreateInstance CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize CreateStreamOnHGlobal PropVariantClear

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

IsUserAnAdmin SHAppBarMessage SHCreateDirectoryExA SHCreateDirectoryExW SHGetFileInfoA SHGetFolderPathA ShellExecuteA ShellExecuteExA ShellExecuteW

user32

ChildWindowFromPoint CloseClipboard DestroyIcon DestroyWindow DrawIconEx EmptyClipboard EnumDisplayMonitors EnumWindows ExitWindowsEx FillRect GetClassNameA GetClipboardData GetCursorInfo GetDC GetDesktopWindow GetForegroundWindow GetMonitorInfoA GetParent GetSystemMetrics GetWindowLongA GetWindowRect GetWindowTextA GetWindowThreadProcessId IntersectRect IsHungAppWindow IsIconic IsWindow IsWindowVisible IsZoomed MoveWindow OpenClipboard PostMessageA PostMessageW PtInRect ReleaseDC ScreenToClient SendInput SendMessageA SendMessageTimeoutA SetClipboardData SetForegroundWindow SystemParametersInfoW keybd_event mouse_event

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

winmm

PlaySoundW mciSendStringW timeBeginPeriod

Name

.text

Size

353KB

Virtual Size

353KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

836B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

test_bot.exe

advapi32

avicap32

gdi32

gdiplus

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

oleaut32

shell32

user32

winhttp

winmm

generic