RoxenLegit[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RoxenLegit.exe
Size 789KB
Sample261028-1wsxmat13p
SHA256 fd6498427f48886b62a3a1de62b7e7cf1cac9dc89745f5616878b1fabf6e6750
MD5 a1640b167704c3c7de1d0965bc343a9d
SHA1 3fedf5e4928d4a473935bda6466030eb62cb5f8a
SHA512 a3afc1358a3e0c29c4e3218805d8df82632c1649df2fa09e8000d01356ef3952a6540572c16ffeaa956e410d9fdad93cc681f3192105a730135a94e46472a2d0
SSDEEP 6144:xEOQr8FXAEBmGlvvF2cd8uEpECpr23PePL7/HJi5AR8L/hTa320SABAdxj+gYSGK:Z9vBzE7A/ePPP0y2G28Znk
TLSH
T115059D19FAA514F9E167D538CD735502EA327C4E07A09ACB23A04A961F37BE09F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RoxenLegit.exe

File Explorer

RoxenLegit.exe

.exe 789KB

RoxenLegit.exe

IMPHASH 71c90bcea767cc3901e94c6d98bb7141
SHA256 fd6498427f48886b62a3a1de62b7e7cf1cac9dc89745f5616878b1fabf6e6750
MD5 a1640b167704c3c7de1d0965bc343a9d
SHA1 3fedf5e4928d4a473935bda6466030eb62cb5f8a
SHA512 a3afc1358a3e0c29c4e3218805d8df82632c1649df2fa09e8000d01356ef3952a6540572c16ffeaa956e410d9fdad93cc681f3192105a730135a94e46472a2d0
SSDEEP 6144:xEOQr8FXAEBmGlvvF2cd8uEpECpr23PePL7/HJi5AR8L/hTa320SABAdxj+gYSGK:Z9vBzE7A/ePPP0y2G28Znk
TLSH
T115059D19FAA514F9E167D538CD735502EA327C4E07A09ACB23A04A961F37BE09F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

797696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CreateMutexA SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile GetComputerNameA LoadLibraryExW GetTempFileNameA FreeLibrary GetProcAddress Beep LoadResource CloseHandle DeleteFileA LockResource GetLastError GetTempPathA Sleep MultiByteToWideChar GetProcessHeap VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread GetModuleHandleA ReleaseMutex FindResourceA SizeofResource ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WideCharToMultiByte QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RtlUnwind

user32

EndPaint BeginPaint GetCursorPos InvalidateRect UpdateWindow PostQuitMessage KillTimer GetClientRect LoadCursorW FindWindowW TranslateMessage SetFocus GetForegroundWindow MessageBoxA GetWindowTextA SetTimer DispatchMessageW ShowWindow RegisterClassExW GetSystemMetrics SendMessageW ScreenToClient CreateWindowExW FillRect GetWindowThreadProcessId GetMessageW DefWindowProcW SetWindowPos

gdi32

BitBlt CreateCompatibleBitmap CreateFontA SelectObject GetTextExtentPoint32A CreateCompatibleDC GetStockObject CreateRoundRectRgn DeleteDC SetTextColor TextOutA SetBkMode LineTo CreatePen Rectangle MoveToEx SetBkColor DeleteObject CreateSolidBrush FillRgn

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey

crypt32

CryptBinaryToStringA CryptStringToBinaryA

advapi32

GetUserNameA

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoUninitialize CoSetProxyBlanket

oleaut32

SysFreeString SysAllocString VariantClear

dbghelp

ImageDirectoryEntryToData

Name

.text

Size

246KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

393KB

Virtual Size

393KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

RoxenLegit.exe

kernel32

user32

gdi32

winhttp

bcrypt

crypt32

advapi32

ole32

oleaut32

dbghelp

generic