Monolith[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Monolith.exe
Size 844KB
Sample261027-yz4gesed77
SHA256 da118836314910f9cd660d7cb0bc719d06ebba3a8f8e4c443b094f0735e09136
MD5 47bfe2875cd603d2f7c5510c12e1dfd1
SHA1 36e828142423306287a6d9100a4fb17bfb5925bf
SHA512 c9b98e1833200270a41cefdd163b5f62f4d141c2d3adc5b41539d74ea8b4f4a4e0a9fab76f482be2753bc4512ad5aa338d50f5c3f60a91494f1bbad372cfd6ee
SSDEEP 24576:0+P4zZUxYgYsl4pBuuOx36nAjuLOk1nqMJbUs:rwtUxrqTfOx36nAuLOkNNtUs
TLSH
T18B05BF41F3E683EDE12AF035A195732BEA753869032146CB73C4085DAFD57E05FBAA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Monolith.exe

File Explorer

Monolith.exe

.exe 844KB

Monolith.exe

IMPHASH 4f9459bd9b684e2e6b04f34d42482f90
SHA256 da118836314910f9cd660d7cb0bc719d06ebba3a8f8e4c443b094f0735e09136
MD5 47bfe2875cd603d2f7c5510c12e1dfd1
SHA1 36e828142423306287a6d9100a4fb17bfb5925bf
SHA512 c9b98e1833200270a41cefdd163b5f62f4d141c2d3adc5b41539d74ea8b4f4a4e0a9fab76f482be2753bc4512ad5aa338d50f5c3f60a91494f1bbad372cfd6ee
SSDEEP 24576:0+P4zZUxYgYsl4pBuuOx36nAjuLOk1nqMJbUs:rwtUxrqTfOx36nAuLOkNNtUs
TLSH
T18B05BF41F3E683EDE12AF035A195732BEA753869032146CB73C4085DAFD57E05FBAA12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\breac\Downloads\abmfp8\Monolith\x64\Release\Monolith.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GetConsoleMode Process32NextW Process32FirstW CloseHandle Module32FirstW ReadProcessMemory Module32NextW WriteProcessMemory GetModuleHandleA GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary GetModuleHandleW OpenProcess GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetCurrentProcessId SetUnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId Sleep SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateToolhelp32Snapshot SetConsoleMode GetStdHandle GlobalAlloc GetSystemTimeAsFileTime InitializeSListHead IsProcessorFeaturePresent QueryPerformanceCounter

user32

MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow SetWindowPos ShowWindow SetWindowLongA SetWindowDisplayAffinity MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage IsWindowUnicode PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC GetCapture ScreenToClient FindWindowW TrackMouseEvent GetKeyboardLayout SetCapture SetCursor ReleaseCapture GetSystemMetrics GetClientRect ClientToScreen GetCursorPos mouse_event GetForegroundWindow GetAsyncKeyState ReleaseDC SetCursorPos

gdi32

GetDeviceCaps

msvcp140

_Mtx_unlock _Mtx_lock ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

d3dcompiler_47

D3DCompile

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __C_specific_handler __current_exception __current_exception_context memcpy memcmp memchr strstr __std_terminate _CxxThrowException __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-string-l1-1-0

strcmp strcpy_s _wcsicmp strncpy strlen strncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit _beginthreadex __p___argc __p___argv _c_exit _initterm _set_app_type _seh_filter_exe terminate _cexit _configure_narrow_argv _register_thread_local_exe_atexit_callback _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func __p__commode __stdio_common_vsprintf_s ftell

api-ms-win-crt-math-l1-1-0

ceilf atan2f acosf powf fmodf cosf logf roundf sinf sqrtf __setusermatherr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-locale-l1-1-0

_configthreadlocale