Root[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Root.exe
Size 18.4MB
Sample261023-sp5c3ss16m
SHA256 a87078a8178a7aa06a4cb2e342806aa9487ab68ad1ecae11062dd8f1a3a1328c
MD5 463faeca64719cd11001af9d0a625c9f
SHA1 d8bdf31c9099c1def47a04a1b8d6db6e0c10f71f
SHA512 a78264c1e0acf05724d7dd4dfb7d75ef1aedb27ffb5828429443c455a8613c482415fb05c020c748a6ccd591a34ddef9207fdfe0b07ba8187acc7a2326d1707a
SSDEEP 393216:pz/janyFyyWRCRaRNEgqPnuui8a4rXwPiBhgRntHm:RGIyyW7RNEgqPLBmG
TLSH
T15217016678C844FDC9398C34D253556281BBB53B07B93EE318C929175D2BC885E3EE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Root.exe

File Explorer

Root.exe

.exe 18.4MB

Root.exe

IMPHASH 27feb2c0769c97a89e9781d16eac2043
SHA256 a87078a8178a7aa06a4cb2e342806aa9487ab68ad1ecae11062dd8f1a3a1328c
MD5 463faeca64719cd11001af9d0a625c9f
SHA1 d8bdf31c9099c1def47a04a1b8d6db6e0c10f71f
SHA512 a78264c1e0acf05724d7dd4dfb7d75ef1aedb27ffb5828429443c455a8613c482415fb05c020c748a6ccd591a34ddef9207fdfe0b07ba8187acc7a2326d1707a
SSDEEP 393216:pz/janyFyyWRCRaRNEgqPnuui8a4rXwPiBhgRntHm:RGIyyW7RNEgqPLBmG
TLSH
T15217016678C844FDC9398C34D253556281BBB53B07B93EE318C929175D2BC885E3EE3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7947169

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

shell32

ShellExecuteW CommandLineToArgvW ShellExecuteA SHGetFolderPathW SHParseDisplayName SHOpenFolderAndSelectItems

shlwapi

ord12

advapi32

GetSidSubAuthority RegQueryValueExW EventUnregister EventWriteTransfer EventSetInformation EventRegister GetSidSubAuthorityCount ConvertSidToStringSidW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle OpenSCManagerA OpenServiceA QueryServiceStatus RegCloseKey RegEnumKeyExA RegEnumKeyExW RegEnumValueA RegEnumValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegGetValueA OpenProcessToken GetTokenInformation RegGetValueW GetServiceDisplayNameW

winhttp

WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpQueryOption WinHttpSetOption WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSetTimeouts

wevtapi

EvtOpenChannelConfig EvtRender EvtClose EvtNext EvtGetChannelConfigProperty EvtCreateRenderContext EvtQuery

ole32

CoUninitialize CoCreateGuid StringFromGUID2 CoTaskMemFree CoInitializeEx CoTaskMemAlloc

bcrypt

BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCreateHash BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptCloseAlgorithmProvider BCryptHash BCryptImportKeyPair

kernel32

FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetTimeZoneInformation HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc GetEnvironmentVariableW GetLastError GetCurrentProcessId GetTickCount64 LoadResource LockResource SizeofResource FindResourceW MulDiv MultiByteToWideChar CloseHandle GetProcessTimes OpenProcess ReadProcessMemory IsWow64Process GetModuleHandleA GetProcAddress SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW K32GetProcessMemoryInfo CompareFileTime GetDriveTypeW GetFileInformationByHandle GetFileType GetFinalPathNameByHandleW QueryDosDeviceW ReadFile DuplicateHandle SetLastError WaitForSingleObject Sleep GetCurrentProcess GetProcessId GetSystemInfo VirtualQueryEx GetModuleHandleW LocalFree GetLogicalDriveStringsW K32GetMappedFileNameW CreateFileW GetFileAttributesW GetLogicalDrives GetVolumeInformationW DeviceIoControl GetWindowsDirectoryW OpenFileById K32GetMappedFileNameA FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileW FindNextChangeNotification GetEnvironmentStringsW GetTempPathW CheckRemoteDebuggerPresent WaitNamedPipeW GetConsoleOutputCP SuspendThread ResumeThread GetProcessIdOfThread GetThreadContext GetProcessMitigationPolicy GetThreadTimes GetACP LoadLibraryW QueryFullProcessImageNameW Thread32First Thread32Next GetEnvironmentVariableA FileTimeToLocalFileTime GetFileAttributesA GetFileAttributesExW GetFileSizeEx FreeLibrary QueryFullProcessImageNameA K32EnumDeviceDrivers K32GetDeviceDriverBaseNameA K32GetDeviceDriverFileNameA GetSystemDirectoryA GetWindowsDirectoryA GetLogicalDriveStringsA QueryDosDeviceA K32GetModuleFileNameExW K32GetModuleInformation GetCommandLineW GetModuleFileNameW GetFileInformationByHandleEx GetThreadId SetFilePointerEx GetSystemDirectoryW LoadLibraryExW K32QueryWorkingSetEx ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW RemoveDirectoryW WriteFile GetExitCodeProcess CreateProcessW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LocalAlloc SetEvent RtlUnwind SetProcessMitigationPolicy VirtualQuery LoadLibraryExA RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread WaitForSingleObjectEx GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns AreFileApisANSI CreateFile2 GetFullPathNameW FindFirstFileExW GetConsoleMode ReadConsoleW HeapReAlloc SetStdHandle GetOEMCP OpenThread GetCommandLineA InitOnceComplete InitOnceBeginInitialize GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimeAsFileTime IsValidCodePage GetSystemTimePreciseAsFileTime QueryPerformanceFrequency FreeEnvironmentStringsW SetEnvironmentVariableW SetEndOfFile HeapSize WriteConsoleW FindNextFileW CreateEventW QueryPerformanceCounter RtlPcToFileHeader RaiseException

user32

TranslateMessage MessageBoxW GetMessageW DispatchMessageW SendMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW PeekMessageW EnumDisplayDevicesA GetWindowTextA GetWindowDisplayAffinity GetWindowThreadProcessId EnumWindows GetWindowTextW IsWindowVisible SetProcessDpiAwarenessContext GetDpiForSystem GetDpiForWindow SystemParametersInfoW LoadIconW LoadCursorW SetWindowLongPtrW GetWindowLongPtrW GetClientRect SetWindowTextW SetWindowRgn UpdateWindow EnableWindow KillTimer SetTimer ReleaseCapture SetWindowPos MoveWindow ShowWindow DestroyWindow IsWindow

gdi32

SetBkColor GetStockObject DeleteObject CreateSolidBrush CreateRoundRectRgn CreateFontW SetTextColor

wintrust

WinVerifyTrust CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext CryptCATAdminAcquireContext2 CryptCATAdminEnumCatalogFromHash CryptCATAdminCalcHashFromFileHandle2 CryptCATCatalogInfoFromContext WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

xmllite

CreateXmlReader

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

454KB

Virtual Size

453KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.%S<

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.|'+

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.-8^

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Root.exe

dwmapi

shell32

shlwapi

advapi32

winhttp

wevtapi

ole32

bcrypt

kernel32

user32

gdi32

wintrust

crypt32

xmllite

generic