exitGrind[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
exitGrind.exe
Size 1.1MB
Sample261024-psk7tseh89
SHA256 fe39d97403e2f0c6fe08c64af8ff13b90b5b764f078c08f98148da5a9c6e5db8
MD5 7fbbf5e4d9fb53c7a54630766f4b7308
SHA1 514ae0ecab9da0b8263f2284ad0bfcdf6150c3e6
SHA512 85302b4e2f62a781c4219a7898fd871ade1b19d13166a1b9f1ee342a653cf3a358fd8e5d997249555c4735e48af680066672407faf04af4a1e6cd8133045ee1c
SSDEEP 24576:4GphMuzBMCx3Kta4ATJAH1mfpugR/md1bV5aanWZA2UiHUTKX:vZzO43KtaISugRed1bVkaW+niHk
TLSH
T1F6358E5937EC03D8DA7AE072EB12C717EEB3784A1674B64B0DA14A763F23630061E756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
exitGrind.exe

File Explorer

exitGrind.exe

.exe 1.1MB

exitGrind.exe

IMPHASH c9f6e6f29bae5f65d2fdd6476d86d72f
SHA256 fe39d97403e2f0c6fe08c64af8ff13b90b5b764f078c08f98148da5a9c6e5db8
MD5 7fbbf5e4d9fb53c7a54630766f4b7308
SHA1 514ae0ecab9da0b8263f2284ad0bfcdf6150c3e6
SHA512 85302b4e2f62a781c4219a7898fd871ade1b19d13166a1b9f1ee342a653cf3a358fd8e5d997249555c4735e48af680066672407faf04af4a1e6cd8133045ee1c
SSDEEP 24576:4GphMuzBMCx3Kta4ATJAH1mfpugR/md1bV5aanWZA2UiHUTKX:vZzO43KtaISugRed1bVkaW+niHk
TLSH
T1F6358E5937EC03D8DA7AE072EB12C717EEB3784A1674B64B0DA14A763F23630061E756
MD5 SHA1 SHA512 SSDEEP TLSH

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

182740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

__WSAFDIsSet recv send setsockopt ntohs recvfrom select WSAStartup htons accept listen bind closesocket connect WSACleanup ioctlsocket sendto WSAGetLastError inet_addr gethostbyname gethostname socket

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_Create InitCommonControlsEx ImageList_ReplaceIcon

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetConnectW InternetQueryDataAvailable

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

UnloadUserProfile DestroyEnvironmentBlock CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose GetLongPathNameW DeleteFileW FindNextFileW MoveFileW CopyFileW DuplicateHandle RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetStdHandle GetProcessHeap TerminateThread LoadLibraryExW FindResourceExW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW GetShortPathNameW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW SetPriorityClass LoadLibraryW VirtualAlloc GetCurrentProcess GetCurrentThread CloseHandle GetLastError GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW RaiseException InitializeCriticalSectionAndSpinCount EncodePointer DecodePointer ExitProcess GetModuleHandleExW ExitThread HeapAlloc WaitForSingleObject CreatePipe CreateThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW RtlPcToFileHeader HeapSize RtlUnwindEx IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointer GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc WriteConsoleW SetEndOfFile CreateDirectoryW SetEnvironmentVariableA

user32

IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed GetWindowLongW MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongPtrW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics SetWindowLongPtrW DrawMenuBar GetActiveWindow CharNextW wsprintfW RedrawWindow DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture LockWindowUpdate DispatchMessageW TranslateMessage PeekMessageW UnregisterHotKey CharLowerBuffW MonitorFromRect LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem IsCharAlphaW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic BlockInput SystemParametersInfoW keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible InvalidateRect GetWindowLongPtrW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop GetKeyboardLayoutNameW ClientToScreen RegisterHotKey GetCursorInfo SetWindowPos CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable InsertMenuItemW OpenClipboard CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon FindWindowW GetMessageW EnableWindow

gdi32

SetPixel DeleteObject GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath StrokePath GetDeviceCaps CloseFigure LineTo AngleArc CreateCompatibleBitmap CreateCompatibleDC MoveToEx Ellipse PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor SelectObject CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject CreateDCW GetPixel DeleteDC GetDIBits StretchBlt EndPath

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

GetAclInformation RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW GetUserNameW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid InitiateSystemShutdownExW LogonUserW AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation GetSecurityDescriptorDacl SetSecurityDescriptorDacl AddAce GetAce

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket

oleaut32

SysStringLen VariantChangeType DispCallFunc CreateStdDispatch CreateDispTypeInfo UnRegisterTypeLi RegisterTypeLi LoadTypeLibEx VariantCopyInd SysReAllocString VariantTimeToSystemTime SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptorEx VariantInit VariantClear VariantCopy SysAllocString VarR8FromDec SafeArrayGetVartype OleLoadPicture QueryPathOfRegTypeLi SysFreeString SafeArrayCreateVector