maytero emu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
maytero emu.exe
Size 5.7MB
Sample261029-xpzvtasvbs
SHA256 e4dbe8521ef8a770f00c4813698bafbd106bce8a8fde40f2556ee87383a082de
MD5 9c07fe314e0f5378a7fb96be0f1ce72d
SHA1 c0d0de6e852868df0c98db89665bdc914a5e723f
SHA512 5fc13f740cbbedf1d44ac5e07d3298677f006fff40b5e0abb78133719670b7c8558ff692fd300404a2f82d4719f829f19e4548a101fc8d8cbb1476c69b291f0f
SSDEEP 49152:a9O1PUjrFCGha6Z0xdb0RChAzLlfrFgV6VBexIVcILT0HLbo8D1D7GoCkrUXFG12:aSU3FtxCzwR3rWV4exIx0uDFX5hH+JW
TLSH
T193566C03F6A641EDC16AC074871AA233FB72B85907217AEB56D08A353F62FD05B7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
maytero emu.exe

File Explorer

maytero emu.exe

.exe 5.7MB

maytero emu.exe

IMPHASH cd9b87a2abb6a41c5bd7ff642a2caa69
SHA256 e4dbe8521ef8a770f00c4813698bafbd106bce8a8fde40f2556ee87383a082de
MD5 9c07fe314e0f5378a7fb96be0f1ce72d
SHA1 c0d0de6e852868df0c98db89665bdc914a5e723f
SHA512 5fc13f740cbbedf1d44ac5e07d3298677f006fff40b5e0abb78133719670b7c8558ff692fd300404a2f82d4719f829f19e4548a101fc8d8cbb1476c69b291f0f
SSDEEP 49152:a9O1PUjrFCGha6Z0xdb0RChAzLlfrFgV6VBexIVcILT0HLbo8D1D7GoCkrUXFG12:aSU3FtxCzwR3rWV4exIx0uDFX5hH+JW
TLSH
T193566C03F6A641EDC16AC074871AA233FB72B85907217AEB56D08A353F62FD05B7E714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4129496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stealer.pdb

kernel32

GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetLogicalDrives GetACP GetOEMCP GetUserDefaultLCID IsValidCodePage IsProcessorFeaturePresent SwitchToThread AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetQueuedCompletionStatusEx SetLastError GetFinalPathNameByHandleW ReadFile GetOverlappedResult PostQueuedCompletionStatus CreateIoCompletionPort SetFileCompletionNotificationModes WriteFile CancelIoEx Sleep GetModuleHandleA GetSystemInfo CreateFileW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetModuleHandleW FormatMessageW GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW FlsFree IsThreadAFiber QueryPerformanceFrequency HeapAlloc GetEnvironmentVariableW SleepEx ReadFileEx WriteFileEx SetHandleInformation SetFileInformationByHandle GetFullPathNameW FindFirstFileExW FindClose SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CreateEventW CancelIo CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW GetFileAttributesW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess DeleteFileW CopyFileExW MoveFileExW CreateWaitableTimerExW SetWaitableTimer FindNextFileW GlobalMemoryStatusEx GlobalLock GlobalUnlock CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileA DeviceIoControl SetFilePointerEx GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc GetSystemTimePreciseAsFileTime CreateThread GetProcessHeap GetLastError GetProcAddress LoadLibraryW CloseHandle HeapFree FlsSetValue LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsGetValue GetTimeZoneInformation GetCommandLineA FreeLibraryAndExitThread ExitThread RtlPcToFileHeader LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SetFilePointer UnlockFileEx CreateMutexW LockFile AreFileApisANSI GetDiskFreeSpaceW SetEndOfFile MapViewOfFile CreateFileMappingW GetTempPathA SystemTimeToFileTime HeapDestroy HeapCompact FlushViewOfFile OutputDebugStringW HeapSize HeapValidate UnmapViewOfFile OutputDebugStringA HeapCreate RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetFullPathNameA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW DeleteFileA UnlockFile LocalFree LockFileEx GetFileSize FreeLibrary GetSystemTime FlushFileBuffers FormatMessageA

user32

GetCursorPos MessageBoxW CloseClipboard GetClipboardData OpenClipboard ReleaseDC GetDesktopWindow GetDC GetSystemMetrics GetForegroundWindow

advapi32

GetUserNameW RegOpenKeyExW RegCloseKey RegQueryValueExW SystemFunction036

gdi32

GetDeviceCaps BitBlt GetDIBits DeleteDC DeleteObject CreateCompatibleDC SelectObject CreateCompatibleBitmap

ole32

CoCreateGuid

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

getpeername closesocket getsockopt WSAGetLastError getsockname bind setsockopt WSAStartup recv WSASocketW getaddrinfo freeaddrinfo send shutdown ioctlsocket connect WSAIoctl WSASend

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtCancelIoFileEx

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

maytero emu.exe

kernel32

user32

advapi32

gdi32

ole32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcryptprimitives

bcrypt

generic