TeleRoute[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
TeleRoute.exe
Size 12.3MB
Sample261029-1q36eace79
SHA256 831b7c40a698e981a56a9a0389c36bf57c01beaad1e2445689d6519f52d80d4b
MD5 ad051d64484d0b61572d57d36459b6f6
SHA1 444aabeaaae39f82cb7d61e194a25715b16784a1
SHA512 01faf51c79f65fd10f46e12add352b8760cd2d85dffc42d48a6941a5f859b4cdbce35e9590c1bea4019203f67a83930c29f81f00f4b0f579c1e2b78a7f62d9de
SSDEEP 98304:PRgcuQfb1D5xAbRn73nhU2g6ngJIZqkIYYAi41CJsb+ntZFP+FA3eMOw5c:9b96nLjngJOBWZpbO
TLSH
T136D67C52B69B95AED15AC470834686736E2134CB0B36B9FF45C482383F6ABF05F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TeleRoute.exe

File Explorer

TeleRoute.exe

.exe 12.3MB

TeleRoute.exe

IMPHASH e647a93a62283cef6a04413a94751c40
SHA256 831b7c40a698e981a56a9a0389c36bf57c01beaad1e2445689d6519f52d80d4b
MD5 ad051d64484d0b61572d57d36459b6f6
SHA1 444aabeaaae39f82cb7d61e194a25715b16784a1
SHA512 01faf51c79f65fd10f46e12add352b8760cd2d85dffc42d48a6941a5f859b4cdbce35e9590c1bea4019203f67a83930c29f81f00f4b0f579c1e2b78a7f62d9de
SSDEEP 98304:PRgcuQfb1D5xAbRn73nhU2g6ngJIZqkIYYAi41CJsb+ntZFP+FA3eMOw5c:9b96nLjngJOBWZpbO
TLSH
T136D67C52B69B95AED15AC470834686736E2134CB0B36B9FF45C482383F6ABF05F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8286544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tele_route.pdb

kernel32

WaitForSingleObject CompareStringOrdinal CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess WaitForMultipleObjects CreateDirectoryW SetFilePointerEx SetThreadStackGuarantee GetCurrentProcessId MoveFileExW FindFirstFileExW ExitProcess GetSystemInfo WaitForSingleObjectEx CreateMutexA ReleaseMutex CreateSymbolicLinkW GetFinalPathNameByHandleW DeleteFileW HeapAlloc WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW FlsFree FlsAlloc GetModuleHandleW GetOverlappedResult FlsSetValue FindClose GetSystemTimePreciseAsFileTime GetTempPathW GetModuleHandleA CancelIo FindNextFileW SetEvent Sleep LoadLibraryA CreateEventW ReadFile SetHandleInformation DuplicateHandle GetCurrentProcess GetStdHandle SetFileCompletionNotificationModes GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort LoadLibraryW FormatMessageW GetCurrentThreadId SwitchToThread GetSystemTimeAsFileTime lstrlenW WideCharToMultiByte GlobalSize CloseHandle CreateThread GlobalFree GlobalUnlock MultiByteToWideChar GetCurrentThread GlobalLock GlobalAlloc RtlLookupFunctionEntry HeapReAlloc HeapFree GetProcessHeap GetModuleHandleExW GetModuleFileNameW SleepEx LoadLibraryExW GetFullPathNameW SetLastError WriteFileEx IsThreadAFiber SetThreadErrorMode FreeLibrary GetProcAddress ReadFileEx GetLastError GetEnvironmentStringsW RtlVirtualUnwind InitializeSListHead FreeEnvironmentStringsW RtlCaptureContext QueryPerformanceCounter AddVectoredExceptionHandler GetCommandLineW QueryPerformanceFrequency GetCurrentDirectoryW GetEnvironmentVariableW SetUnhandledExceptionFilter

bcryptprimitives

ProcessPrng

advapi32

RegDeleteValueW RevertToSelf SystemFunction036 ImpersonateAnonymousToken RegCreateKeyExW RegCloseKey RegSetValueExW

gdi32

DeleteObject SetTextColor DeleteDC CreateSolidBrush CreateBitmap SetBkMode CreateCompatibleDC CreateDIBSection GetDeviceCaps CreateRectRgn CreateCompatibleBitmap SetBitmapBits SelectObject SwapBuffers ChoosePixelFormat SetPixelFormat DescribePixelFormat

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shell32

Shell_NotifyIconW ShellExecuteW SHGetStockIconInfo DragQueryFileW DragFinish Shell_NotifyIconGetRect SHGetKnownFolderPath

combase

CoTaskMemFree

user32

PostMessageW GetWindowTextW GetSystemMenu GetWindowTextLengthW EnableMenuItem ToUnicodeEx TrackMouseEvent SetCapture MonitorFromRect ScreenToClient ReleaseDC ReleaseCapture GetKeyboardLayout MapVirtualKeyExW RegisterWindowMessageA SetTimer KillTimer SetWindowLongW ChangeWindowMessageFilterEx RegisterClassW CreateIcon GetWindowLongW DestroyWindow RedrawWindow GetMonitorInfoW GetKeyboardState MonitorFromPoint PeekMessageW GetClipCursor TranslateMessage GetMenu DispatchMessageW GetWindowLongPtrW SystemParametersInfoA IsProcessDPIAware TrackPopupMenu GetCursorPos DestroyMenu ClipCursor SetMenu DrawTextW ValidateRect GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo GetRawInputData MsgWaitForMultipleObjectsEx FillRect GetMenuItemInfoW ShowWindow GetAsyncKeyState PostQuitMessage CheckMenuItem CreatePopupMenu CreateMenu DestroyIcon DrawMenuBar SetMenuItemInfoW DrawIconEx AdjustWindowRectEx AppendMenuW InsertMenuW VkKeyScanW CreateAcceleratorTableW MessageBoxW DestroyAcceleratorTable EnumDisplayMonitors GetClientRect IsWindowVisible IsIconic ShowCursor GetKeyState SetWindowLongPtrW RegisterRawInputDevices CreateIconFromResourceEx GetActiveWindow GetSystemMetrics SendMessageW SetWindowPos InvalidateRgn LoadCursorW SetWindowDisplayAffinity DestroyCursor SetCursor CreateWindowExW RegisterClassExW DefWindowProcW GetClassInfoExW GetClassNameW GetDC SetForegroundWindow SendInput MapVirtualKeyW GetForegroundWindow SetCursorPos ClientToScreen SetWindowTextW GetWindowRect FlashWindowEx MonitorFromWindow SetWindowPlacement GetWindowPlacement RemoveMenu ChangeDisplaySettingsExW CreateIconIndirect GetTouchInputInfo SetClipboardData CloseClipboard RegisterTouchWindow OpenClipboard IsClipboardFormatAvailable GetClipboardData CloseTouchInputHandle RegisterClipboardFormatW EmptyClipboard

ole32

OleInitialize RegisterDragDrop CoInitializeEx CoUninitialize RevokeDragDrop CoCreateInstance

bcrypt

BCryptGenRandom

ws2_32

getsockopt setsockopt shutdown listen WSAIoctl WSASocketW ioctlsocket connect getsockname WSASendMsg socket getaddrinfo accept WSAStartup freeaddrinfo send WSAGetLastError bind recv WSASend closesocket

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtCreateNamedPipeFile NtOpenFile NtWriteFile NtCreateFile RtlNtStatusToDosError NtReadFile

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass

crypt32

CertFindCertificateInStore CryptMsgGetParam CertGetEnhancedKeyUsage CertOpenStore CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CertVerifyTimeValidity CertGetNameStringW CryptQueryObject CertDuplicateCertificateContext

wintrust

WinVerifyTrust

uxtheme

SetWindowTheme

iphlpapi

GetIpInterfaceEntry SetIpInterfaceEntry ConvertInterfaceLuidToAlias ConvertInterfaceLuidToIndex

rpcrt4

UuidCreate

opengl32

wglGetCurrentContext wglCreateContext wglShareLists wglMakeCurrent wglGetProcAddress wglDeleteContext wglGetCurrentDC

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow ImmAssociateContextEx ImmGetCompositionStringW

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

vcruntime140

__current_exception_context _CxxThrowException memmove memcmp __current_exception memcpy memset __C_specific_handler __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

__setusermatherr sinf cosf trunc cbrtf tanf log cbrt atan2f _hypotf floorf fma ceilf tan _hypot atan2 log2 roundf exp2f acosf truncf sin powf floor ceil log10 fmod pow round expf cos

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _crt_atexit exit _initialize_narrow_environment terminate _configure_narrow_argv _initterm _seh_filter_exe _set_app_type _initterm_e _exit _register_onexit_function __p___argc _initialize_onexit_table strerror __p___argv _register_thread_local_exe_atexit_callback _cexit _c_exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode