taker[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
taker.exe
Size 147KB
Sample261030-rtp9aacy6x
SHA256 c3d315a8f46b2dc29a5cb12a5fbe6fa4340cf13fa720bf9d7f54470f7a29b182
MD5 a271872ad7995de96628f3a2fc216774
SHA1 14998fc0da6d0c26509adb0a062468956964e8a6
SHA512 2f8b2fe35b7ac0ca161d040701541f2fa0411d2acb1f4bbf3eaf7b83d966bdde4edca3763c4974c92092edddb5559d15628e6faf2e3547d9ab63f7431dc6015f
SSDEEP 1536:k48GmEIcBVheKGbY6OUIVcLamYcbUIppCokSu30hH+70YQqI/i0:k48GXheKnOamY4pgos0V+709Z1
TLSH
T148E33A03DA95C0F6C46BE175CEDBA23AE172B44556B67A4BBB84CF232F50B34671C209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
taker.exe

File Explorer

taker.exe

.exe 147KB

taker.exe

IMPHASH 63d719263b2f8e42220d67538bb03c9e
SHA256 c3d315a8f46b2dc29a5cb12a5fbe6fa4340cf13fa720bf9d7f54470f7a29b182
MD5 a271872ad7995de96628f3a2fc216774
SHA1 14998fc0da6d0c26509adb0a062468956964e8a6
SHA512 2f8b2fe35b7ac0ca161d040701541f2fa0411d2acb1f4bbf3eaf7b83d966bdde4edca3763c4974c92092edddb5559d15628e6faf2e3547d9ab63f7431dc6015f
SSDEEP 1536:k48GmEIcBVheKGbY6OUIVcLamYcbUIppCokSu30hH+70YQqI/i0:k48GXheKnOamY4pgos0V+709Z1
TLSH
T148E33A03DA95C0F6C46BE175CEDBA23AE172B44556B67A4BBB84CF232F50B34671C209
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges DuplicateTokenEx GetTokenInformation GetUserNameA ImpersonateLoggedOnUser LookupPrivilegeValueA OpenProcessToken RegCloseKey RegDeleteValueA RegOpenKeyExA RegQueryValueExA RevertToSelf

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject SetStretchBltMode StretchBlt

gdiplus

GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToStream GdiplusShutdown GdiplusStartup

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateFileA CreateMutexA CreatePipe CreateProcessA CreateToolhelp32Snapshot DeleteFileA DuplicateHandle ExitProcess FindClose FindFirstFileA FindNextFileA GetCommandLineA GetComputerNameA GetCurrentProcess GetCurrentProcessId GetDiskFreeSpaceExA GetEnvironmentVariableA GetFileAttributesA GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetLastError GetLogicalDrives GetModuleFileNameA GetModuleHandleA GetNativeSystemInfo GetProcAddress GetProcessHeap GetTempPathA GetTickCount64 GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc LoadLibraryA LocalFree OpenProcess Process32First Process32Next ReadFile RemoveDirectoryA SetFilePointerEx SetHandleInformation Sleep TerminateProcess VirtualAlloc VirtualFree VirtualProtect WaitForSingleObject WriteFile

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

user32

CloseDesktop EnumDisplayDevicesA GetDC GetDesktopWindow GetSystemMetrics GetTopWindow GetWindow GetWindowDC GetWindowThreadProcessId OpenInputDesktop PostMessageA ReleaseDC SetThreadDesktop