Saryx[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Saryx.exe
Size 3.5MB
Sample261027-2yd2xsxtfy
SHA256 6f820e0d851ac8a02d0ce732e97d03d9fd39e239b2da5be177cc75b544285e9c
MD5 3b20d2de1fa36db3d43102708259eccd
SHA1 f3634ec422779c5af4fea55d3244743fad5daad4
SHA512 c523ab53229c6511e12fcd20e82cabd00e9899128cab8fe70d3c17d5465780a5274aae184bee4314e653008348b058f939c1cfa89d84dbe1fa3bee08a87e2f9a
SSDEEP 98304:oq+BNxNQIUUj0gWStTEdS1KgQqHqYVWiIwRBLG1:r+obgVwSogBqsIS0
TLSH
T1AEF51252B2A540F8D87BD1798BA6A61FFA71384807205ADB23D045583FB77E11BBF702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Saryx.exe

File Explorer

Saryx.exe

.exe 3.5MB

Saryx.exe

IMPHASH 07e7d13ef120540e1c82bd62016d0cad
SHA256 6f820e0d851ac8a02d0ce732e97d03d9fd39e239b2da5be177cc75b544285e9c
MD5 3b20d2de1fa36db3d43102708259eccd
SHA1 f3634ec422779c5af4fea55d3244743fad5daad4
SHA512 c523ab53229c6511e12fcd20e82cabd00e9899128cab8fe70d3c17d5465780a5274aae184bee4314e653008348b058f939c1cfa89d84dbe1fa3bee08a87e2f9a
SSDEEP 98304:oq+BNxNQIUUj0gWStTEdS1KgQqHqYVWiIwRBLG1:r+obgVwSogBqsIS0
TLSH
T1AEF51252B2A540F8D87BD1798BA6A61FFA71384807205ADB23D045583FB77E11BBF702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

646048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

kernel32

Process32First FindFirstFileA SetConsoleTitleA GetCurrentProcess WriteFile DeviceIoControl TerminateProcess Module32Next FindNextFileA SetThreadPriority FindClose Module32First CreateFileW OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetTickCount64 GetLastError MoveFileExA CreateFileA GetCurrentThread LockResource DeleteFileA Process32Next CloseHandle CreateThread LoadResource FindResourceW GetLocalTime GetCurrentProcessId GetModuleHandleW GetTickCount IsDebuggerPresent VirtualQueryEx CheckRemoteDebuggerPresent QueryPerformanceFrequency GetModuleFileNameA VirtualAlloc GetCurrentThreadId GetTempPathW AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime InitializeSListHead LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindFirstFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx GetLocaleInfoA GetModuleHandleA SizeofResource QueryPerformanceCounter GetProcAddress VirtualFree GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar OutputDebugStringA ReleaseSRWLockExclusive IsProcessorFeaturePresent IsDBCSLeadByte SetUnhandledExceptionFilter UnhandledExceptionFilter FlushFileBuffers

user32

GetCursorPos OpenClipboard CloseClipboard SetCapture GetWindowThreadProcessId UnregisterHotKey DispatchMessageA DestroyWindow SetActiveWindow PostMessageA GetSystemMetrics ShowWindow IsWindow GetAsyncKeyState SetWindowDisplayAffinity MessageBoxA RegisterHotKey DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus TranslateMessage SendMessageA mouse_event PeekMessageA GetWindowLongPtrA UnregisterClassA SetClipboardData SetCursorPos ReleaseCapture IsWindowUnicode PostQuitMessage SetWindowLongPtrA GetClipboardData EmptyClipboard GetForegroundWindow GetKeyboardLayout FindWindowA PtInRect RegisterClassExA UpdateWindow SetForegroundWindow TrackMouseEvent ClientToScreen GetClientRect GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState SetCursor DefWindowProcW

advapi32

RegCreateKeyW RegDeleteTreeW RegSetKeyValueW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyW RegCloseKey

shell32

ShellExecuteW

ole32

CoUninitialize CoInitializeEx CoCreateInstance

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

msvcp140

?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ

d3d11

D3D11CreateDeviceAndSwapChain

xinput9_1_0

XInputGetState

dinput8

DirectInput8Create

ntdll

RtlAdjustPrivilege NtUnloadDriver NtLoadDriver RtlVirtualUnwind RtlLookupFunctionEntry RtlInitUnicodeString RtlCaptureContext NtQuerySystemInformation

winmm

timeEndPeriod timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memcmp memchr memcpy memset __C_specific_handler memmove __current_exception_context wcsstr __std_exception_copy __std_exception_destroy strchr strstr __std_terminate __current_exception

api-ms-win-crt-stdio-l1-1-0

fclose __acrt_iob_func fflush _get_stream_buffer_pointers fseek __p__commode _fseeki64 fsetpos ungetc __stdio_common_vfprintf setvbuf fgetpos fopen_s fwrite _set_fmode fgetc __stdio_common_vsprintf_s _wfopen __stdio_common_vsprintf ftell fread fputc __stdio_common_vsscanf

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-string-l1-1-0

strncmp strcmp strncpy_s strcpy_s strncpy _stricmp

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-convert-l1-1-0

strtol atof

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _register_onexit_function _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e exit _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv abort _invoke_watson terminate

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _wremove

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

cosf pow powf sinf ceilf _fdclass logf log fmodf atan2f acosf expf sqrtf __setusermatherr tanf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale