Potassium[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Potassium.exe
Size 27.0MB
Sample261024-3cstmaxwgw
SHA256 c16fc7327138a291d9a2667dbd4b76ea007faf795f8b08aab31a7f1c3d6e3ce7
MD5 81774287f7669a607c9951dc0db7a134
SHA1 1d4323b770074068d7cfca2e62d8c63985edff43
SHA512 657a2bf80046a0306fdd773d40471f073b811f6d691a21712c8255fe2fec2ea6291c39280dae863889e85e15c2a821bbe995fe76c5e91928073a51611143daa1
SSDEEP 393216:KDcUZnw+6kxMdwMCfxu6wDwd1KfTB/r8z:wcU6+aq4x0dIbB
TLSH
T11C574A217A5A996CC05BC474C38B4A735A7130CB0B35B9FF449492792F7EAF86F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Potassium.exe

File Explorer

Potassium.exe

.exe 27.0MB

Potassium.exe

IMPHASH 6823d3b70db015aa853c87e1f70f1e78
SHA256 c16fc7327138a291d9a2667dbd4b76ea007faf795f8b08aab31a7f1c3d6e3ce7
MD5 81774287f7669a607c9951dc0db7a134
SHA1 1d4323b770074068d7cfca2e62d8c63985edff43
SHA512 657a2bf80046a0306fdd773d40471f073b811f6d691a21712c8255fe2fec2ea6291c39280dae863889e85e15c2a821bbe995fe76c5e91928073a51611143daa1
SSDEEP 393216:KDcUZnw+6kxMdwMCfxu6wDwd1KfTB/r8z:wcU6+aq4x0dIbB
TLSH
T11C574A217A5A996CC05BC474C38B4A735A7130CB0B35B9FF449492792F7EAF86F38258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15055264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Potassium.pdb

bcryptprimitives

ProcessPrng

advapi32

RegOpenKeyExW RegQueryValueExW RegGetValueW RegCloseKey SystemFunction036 EventSetInformation EventWriteTransfer EventUnregister EventRegister

ntdll

RtlGetVersion NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtOpenFile NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile NtReadFile

kernel32

LoadLibraryExA FormatMessageW LoadLibraryW HeapAlloc lstrlenW SetNamedPipeHandleState GetFullPathNameW CreateFileW GetCurrentThreadStackLimits FormatMessageA LoadLibraryA GetModuleFileNameA FreeLibrary VirtualProtect SetHandleInformation GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW LCIDToLocaleName GetUserDefaultUILanguage GetSystemTimeAsFileTime RtlPcToFileHeader GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx RaiseException FlsAlloc FlsGetValue FlsSetValue GetFileInformationByHandle GetConsoleMode FlsFree HeapFree GetCurrentThreadId OpenMutexW CreateMutexW SetInformationJobObject CreateJobObjectW GetProcessTimes TerminateProcess Process32NextW Process32FirstW QueryPerformanceCounter QueryPerformanceFrequency RtlVirtualUnwind GetEnvironmentVariableW HeapReAlloc LoadLibraryExW WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle SetFileTime DuplicateHandle CreateToolhelp32Snapshot WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineW QueryFullProcessImageNameW OpenProcess AssignProcessToJobObject EncodePointer CopyFileExW MoveFileExW CreateDirectoryW GetFinalPathNameByHandleW DeviceIoControl GetFileInformationByHandleEx RtlUnwind SwitchToThread CreateEventW DeleteFileW FindFirstFileExW FindClose SetEnvironmentVariableW InitializeSListHead GetTempPathW ExitProcess SetUnhandledExceptionFilter CancelIo RtlUnwindEx GetModuleHandleW MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateThread WaitForMultipleObjects ReadFileEx SleepEx FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx GetSystemTimePreciseAsFileTime GetSystemInfo GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry FindNextFileW GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle InitializeCriticalSectionEx GetCurrentProcess SetFileCompletionNotificationModes DeleteCriticalSection

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

AdjustWindowRect RedrawWindow RegisterClassExW ClientToScreen GetClientRect GetWindowLongW ScreenToClient CreateWindowExW GetCursorPos TranslateAcceleratorW DefWindowProcW DestroyWindow MonitorFromWindow DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SetMenuItemInfoW AppendMenuW InsertMenuW SendMessageW PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable DrawIconEx PostThreadMessageW DrawMenuBar SetMenu GetMenuItemInfoW CreateIcon GetAsyncKeyState GetKeyboardState MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx GetKeyState GetMenu IsWindowVisible GetRawInputData EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW MonitorFromRect SendInput SetForegroundWindow LoadImageW DestroyIcon GetWindowTextLengthW SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor PostMessageW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx PeekMessageW DispatchMessageW RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC IsProcessDPIAware GetDC EnableWindow IsWindowEnabled GetMessageW GetWindowRect SetWindowLongPtrW GetParent FindWindowExW SetWindowRgn GetSystemMetrics IsIconic EnumChildWindows DispatchMessageA GetWindowLongPtrW TranslateMessage VkKeyScanW GetMessageA GetForegroundWindow SetWindowPos TrackPopupMenu RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos SetWindowDisplayAffinity LoadCursorW InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

ole32

CoCreateInstance RegisterDragDrop CoInitialize CoTaskMemFree CoUninitialize OleInitialize CoTaskMemAlloc CoInitializeEx CoCreateFreeThreadedMarshaler RevokeDragDrop

gdi32

SetBkMode CreateSolidBrush SetTextColor CombineRgn CreateDIBSection CreateRectRgn DeleteObject DeleteDC CreateCompatibleDC SelectObject BitBlt GetDeviceCaps

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

shlwapi

SHCreateMemStream

shell32

SHAppBarMessage ShellExecuteW DragFinish ILCreateFromPathW DragQueryFileW ILFree SHGetKnownFolderPath ShellExecuteExW SHOpenFolderAndSelectItems

oleaut32

GetErrorInfo SysFreeString SetErrorInfo SysStringLen

ws2_32

closesocket getsockname getsockopt getpeername accept recv WSASend send setsockopt ioctlsocket WSAIoctl WSASocketW bind listen shutdown freeaddrinfo WSAGetLastError getaddrinfo WSACleanup connect WSAStartup

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

_dsign log2 round ldexp cosh sqrtf fmod pow roundf modf floor trunc acos tanh floorf sqrt log asin atan ceilf atan2 log10 ceil tan _dclass __setusermatherr sin frexp exp sinh cos

api-ms-win-crt-string-l1-1-0

isupper _wcsicmp wcslen wcscmp strspn strncmp islower isdigit strcpy_s tolower iscntrl strcmp strpbrk strcoll strncpy strncat strcspn isalpha toupper isxdigit isgraph isspace isprint strlen isalnum ispunct

api-ms-win-crt-heap-l1-1-0

calloc realloc _aligned_malloc _aligned_free _set_new_mode malloc free _callnewh

api-ms-win-crt-stdio-l1-1-0

fputs __p__commode fflush fgets fseek ftell _set_fmode __stdio_common_vfscanf tmpfile setvbuf tmpnam fwrite _popen clearerr __stdio_common_vfprintf ungetc getc freopen fread __stdio_common_vsprintf_s fopen ferror feof fclose __acrt_iob_func __stdio_common_vsprintf _pclose

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _errno _set_app_type _wassert system _invoke_watson _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm abort terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initterm_e exit strerror _exit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc

api-ms-win-crt-locale-l1-1-0

setlocale _configthreadlocale localeconv

api-ms-win-crt-convert-l1-1-0

atoi wcstol strtod strtoull _ultow_s strtoul strtoll _wtoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

strftime _mktime64 _localtime64 _gmtime64 _time64 clock _difftime64 _localtime64_s _gmtime64_s

api-ms-win-crt-filesystem-l1-1-0

rename remove

api-ms-win-crt-utility-l1-1-0

rand srand

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?__ExceptionPtrRethrow@@YAXPEBX@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ _Query_perf_counter _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ _Mtx_lock ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Mtx_unlock ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exception@std@@YA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ