grootsflagmanager[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
grootsflagmanager.exe
Size 393KB
Sample261027-nrpyyscw3y
SHA256 cc254ad09d50147a5f87de2134d0aa377fec7bae2a8d558e5620b0ae7c26c221
MD5 f1c9e67cba517b490c3c3562ed6b023e
SHA1 fbb86e9d733ad23a99e10cb00d5eda9ae7e27eda
SHA512 b66cc4de7028829963276fc0102056442f0dae39bd942f36034d6ec35aedb16ced9eac02253d99ebc56dc56c38766e5cf0a423061584dc4233d65f451b04a5a5
SSDEEP 6144:PQ/9uIjZgKBLYwdqVLXB4CFUYALndW7eQrL+DjJRuZYr9OOQQX77L:4TVTdqZxyYz7zLoKZCVQkr
TLSH
T120847D19FBA500F9D1A7D178CD638502EA727C4E4760AEDF23E45A561F236E08E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
grootsflagmanager.exe

File Explorer

grootsflagmanager.exe

.exe 393KB

grootsflagmanager.exe

IMPHASH b27c509e27cb26d20866fd1597d7a565
SHA256 cc254ad09d50147a5f87de2134d0aa377fec7bae2a8d558e5620b0ae7c26c221
MD5 f1c9e67cba517b490c3c3562ed6b023e
SHA1 fbb86e9d733ad23a99e10cb00d5eda9ae7e27eda
SHA512 b66cc4de7028829963276fc0102056442f0dae39bd942f36034d6ec35aedb16ced9eac02253d99ebc56dc56c38766e5cf0a423061584dc4233d65f451b04a5a5
SSDEEP 6144:PQ/9uIjZgKBLYwdqVLXB4CFUYALndW7eQrL+DjJRuZYr9OOQQX77L:4TVTdqZxyYz7zLoKZCVQkr
TLSH
T120847D19FBA500F9D1A7D178CD638502EA727C4E4760AEDF23E45A561F236E08E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LocalFree GetModuleHandleW WideCharToMultiByte MulDiv GetCurrentProcessId GetSystemTime SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile EnumSystemLocalesW MultiByteToWideChar IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect CreateToolhelp32Snapshot FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx HeapAlloc HeapFree HeapReAlloc ExitProcess GetModuleFileNameW GetCommandLineW VirtualQueryEx ReadProcessMemory Module32FirstW CloseHandle Process32FirstW GetTickCount64 Process32NextW GetUserDefaultLCID Sleep WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader OpenProcess WaitForSingleObject WriteProcessMemory FlsFree GetLastError RtlUnwindEx GetStartupInfoW FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetProcAddress GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter WakeAllConditionVariable GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent RtlUnwind

user32

GetParent PostQuitMessage InvalidateRect DrawTextW GetClientRect LoadCursorW LoadIconW UpdateWindow BeginPaint EndPaint EnableWindow GetWindowTextW KillTimer TranslateMessage GetWindowTextLengthW GetMessageW DefWindowProcW PostMessageW GetWindow SetProcessDpiAwarenessContext GetWindowRect DestroyWindow InflateRect SetWindowPos GetDpiForWindow SetWindowLongPtrW FillRect CreateWindowExW SendMessageW SetWindowTextW GetWindowLongPtrW RegisterClassExW ShowWindow DispatchMessageW SetTimer IsDialogMessageW MapWindowPoints DrawFocusRect IsWindowEnabled MoveWindow SetFocus

gdi32

CreateFontW SetTextColor SetBkMode SetBkColor DeleteObject CreateSolidBrush SelectObject

comdlg32

GetOpenFileNameW

shell32

DragAcceptFiles DragFinish CommandLineToArgvW SHGetKnownFolderPath DragQueryFileW

ole32

CoTaskMemFree

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpReceiveResponse WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpOpenRequest

comctl32

ord410 ord413 InitCommonControlsEx ord412

uxtheme

SetWindowTheme

Name

.text

Size

267KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

grootsflagmanager.exe

kernel32

user32

gdi32

comdlg32

shell32

ole32

winhttp

comctl32

uxtheme

generic