collar[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
collar.exe
Size 142.6MB
Sample261023-c69fcszs8l
SHA256 6ad127dd0e61ca3c4cf033e66a67587b71e3ad7b58ebf7afc545e19d1ee8e733
MD5 0a2b5306a325179f00f8a881d73b2a63
SHA1 60838c68c8cfc2eeb06bb03e43841ee06eeacdca
SHA512 4607bc4abd0586b4ab81384491944f9ba86dddc144b3047708f9667a1c11008b1ed63a9ec1d7f8103bb650dd16356feae9ad75133c6c40a69684d683b35d2dd4
SSDEEP 1572864:yzANKK8GhmBHdktY9/m2+79K/XzDjvJq:yzAoK8Ggx++T
TLSH
T1CE68BF4BF1A790ACD41BC5B4436AA732FA34785D43245AFB22D856343E76BC06B3AF44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
collar.exe

File Explorer

collar.exe

.exe 142.6MB

collar.exe

IMPHASH 750e11317f1b981ab5d08652aa7b2568
SHA256 6ad127dd0e61ca3c4cf033e66a67587b71e3ad7b58ebf7afc545e19d1ee8e733
MD5 0a2b5306a325179f00f8a881d73b2a63
SHA1 60838c68c8cfc2eeb06bb03e43841ee06eeacdca
SHA512 4607bc4abd0586b4ab81384491944f9ba86dddc144b3047708f9667a1c11008b1ed63a9ec1d7f8103bb650dd16356feae9ad75133c6c40a69684d683b35d2dd4
SSDEEP 1572864:yzANKK8GhmBHdktY9/m2+79K/XzDjvJq:yzAoK8Ggx++T
TLSH
T1CE68BF4BF1A790ACD41BC5B4436AA732FA34785D43245AFB22D856343E76BC06B3AF44
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1699648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

collar.pdb

advapi32

RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceW CreateServiceW StartServiceCtrlDispatcherW CloseServiceHandle DeleteService OpenServiceW ControlService OpenSCManagerW RegOpenKeyExW RegCloseKey RegCreateKeyExW DuplicateTokenEx CreateProcessAsUserW RegQueryValueExW RegSetValueExW RegDeleteValueW OpenProcessToken GetTokenInformation SystemFunction036 RegDeleteKeyExW

kernel32

WaitForSingleObjectEx GetCurrentProcessId ReleaseMutex SetFileAttributesW GetStdHandle GetConsoleMode GetSystemTimePreciseAsFileTime GetConsoleOutputCP WriteConsoleW GetFullPathNameW TerminateProcess OpenProcess GetCurrentThread SwitchToThread GetCurrentProcess WTSGetActiveConsoleSessionId SetThreadStackGuarantee WaitForSingleObject GetSystemInfo SetLastError FreeLibrary GetSystemTimeAsFileTime FindClose GetCurrentThreadId CloseHandle GetLastError FindFirstFileExW GetExitCodeProcess WaitForMultipleObjects DuplicateHandle GetFileAttributesW GetWindowsDirectoryW GetSystemDirectoryW Sleep SetWaitableTimer SleepEx DeleteFileW SetHandleInformation GetTempPathW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime CopyFileExW CreateEventW CreateWaitableTimerExW QueryPerformanceCounter QueryPerformanceFrequency ReadFileEx WriteFileEx GetModuleFileNameW GetModuleHandleA FormatMessageW CreateFileW CreateDirectoryW GetEnvironmentVariableW HeapAlloc MultiByteToWideChar WideCharToMultiByte RtlVirtualUnwind GetOverlappedResult lstrlenW SetUnhandledExceptionFilter LoadLibraryA RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW AddVectoredExceptionHandler LoadLibraryW GetCommandLineW Process32NextW Process32FirstW CreateToolhelp32Snapshot HeapReAlloc GetModuleHandleW CreateThread HeapFree GetProcessHeap CancelIo ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal CreateProcessW LoadLibraryExA RaiseException VirtualProtect VirtualQuery InitializeSListHead CreateMutexA GetProcAddress

user32

SetForegroundWindow SetWindowLongPtrW PostThreadMessageW CallNextHookEx CreateWindowExW GetSystemMetrics LoadCursorW DefWindowProcW CallWindowProcW MessageBoxW SendMessageTimeoutW SetWindowsHookExW ShowWindow SetWindowTextW PostQuitMessage GetAsyncKeyState EnumDisplayMonitors GetSysColorBrush RegisterClassW SetFocus GetWindowTextW SetWindowPos UnhookWindowsHookEx DispatchMessageW GetMessageW TranslateMessage

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

wtsapi32

WTSQueryUserToken

ntdll

NtWriteFile NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError NtReadFile

oleaut32

SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

ws2_32

getsockname closesocket WSAStartup WSACleanup WSASocketW getsockopt setsockopt WSADuplicateSocketW listen WSARecv select ioctlsocket connect accept getpeername freeaddrinfo getaddrinfo send WSASend bind recv WSAGetLastError

gdi32

CreateSolidBrush

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shell32

ShellExecuteW

vcruntime140

__CxxFrameHandler3 memcpy memcmp memmove memset _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-runtime-l1-1-0

__p___argc _exit _register_thread_local_exe_atexit_callback exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argv _initialize_onexit_table _register_onexit_function _crt_atexit _set_app_type _seh_filter_exe _c_exit terminate _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode