zenternal[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
zenternal.exe
Size 5.4MB
Sample261101-yv55fsey5j
SHA256 be7af1fcd11c5a73f50c59bcd99d544f0c3abb3d787126700a858d45b0ed3c62
MD5 e4fb2cba3b3e79098d44549131657f20
SHA1 2790bf12a0a40d59cd15f121ec3626927a90ffcc
SHA512 a501fbc17cb94bfdfd7b94277136bdb8958927876d18f68e31a25cbc070920da90ab31c6ad7fa28705a1927de12571fa3c6e6df1e3b5f1074723dffa24e2837a
SSDEEP 49152:mOF4Jym7+BAN3w2MICs9OuczJYahrvEryuj/DBPtinwPh8jh5NaN2IsHhxMbhXvE:e0GNCritwIAxMbp+KA
TLSH
T14146BF43F7ED0599D427E038C773D227E3327814032086EBBBC5AA696F67AE05A76711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zenternal.exe

File Explorer

zenternal.exe

.exe 5.4MB

zenternal.exe

IMPHASH 6c5d1041031a4c0550ff8a92cfb1d8f4
SHA256 be7af1fcd11c5a73f50c59bcd99d544f0c3abb3d787126700a858d45b0ed3c62
MD5 e4fb2cba3b3e79098d44549131657f20
SHA1 2790bf12a0a40d59cd15f121ec3626927a90ffcc
SHA512 a501fbc17cb94bfdfd7b94277136bdb8958927876d18f68e31a25cbc070920da90ab31c6ad7fa28705a1927de12571fa3c6e6df1e3b5f1074723dffa24e2837a
SSDEEP 49152:mOF4Jym7+BAN3w2MICs9OuczJYahrvEryuj/DBPtinwPh8jh5NaN2IsHhxMbhXvE:e0GNCritwIAxMbp+KA
TLSH
T14146BF43F7ED0599D427E038C773D227E3327814032086EBBBC5AA696F67AE05A76711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1298608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rayan\Downloads\Zen\ext_momentum\build\release.pdb

dbghelp

MiniDumpWriteDump

winhttp

WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpSetTimeouts WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryHeaders WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReadData WinHttpSetOption

kernel32

ReleaseSRWLockExclusive GetFileInformationByHandleEx CreateDirectoryW SetConsoleCtrlHandler SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle WriteConsoleA WriteFile GetEnvironmentVariableW CreateMutexW CreateFileW GetCurrentThreadId GetModuleHandleA CreateToolhelp32Snapshot Sleep GetLastError GetFileAttributesExW Process32NextW GetCurrentThread Process32FirstW CloseHandle GetThreadContext GetProcAddress MoveFileExW ExitProcess GetModuleHandleW GetConsoleWindow SetConsoleOutputCP IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter FlushFileBuffers SizeofResource GetFileSizeEx GetTempPathW LockResource LoadResource FindResourceW SetDllDirectoryW GetTickCount64 SetLastError OutputDebugStringA K32GetModuleFileNameExW K32EnumProcessModulesEx LoadLibraryA GetSystemInfo VirtualProtectEx VirtualAllocEx FlushInstructionCache AcquireSRWLockExclusive VirtualQueryEx OpenProcess QueryFullProcessImageNameA SetThreadPriority GetFileAttributesW QueryPerformanceFrequency QueryPerformanceCounter ReadFile MultiByteToWideChar GetFileSize GetModuleFileNameA lstrlenW GetCurrentProcessId GetSystemTimeAsFileTime GetProcessTimes K32EnumProcessModules ReadProcessMemory WideCharToMultiByte QueryFullProcessImageNameW lstrcmpiW GetExitCodeProcess GetLocaleInfoA VerSetConditionMask FreeLibrary GlobalAlloc GlobalFree GlobalLock GlobalUnlock RaiseException VirtualProtect VirtualQuery LoadLibraryExA InitOnceComplete AreFileApisANSI CreateFile2 SetFileInformationByHandle FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW InitOnceBeginInitialize WakeAllConditionVariable InitializeSListHead VirtualFreeEx

user32

MessageBoxA GetWindowThreadProcessId keybd_event DispatchMessageW RegisterClassW PeekMessageW TranslateMessage OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture GetWindowRect DestroyWindow SetWindowPos GetSystemMetrics UnregisterClassW RegisterClassExW SetWindowDisplayAffinity GetForegroundWindow MoveWindow GetAsyncKeyState CreateWindowExW DefWindowProcW GetClassNameA GetWindowTextA EnumWindows SendInput ScreenToClient ShowWindow SetLayeredWindowAttributes SetFocus ClientToScreen GetClientRect FindWindowA SetCursorPos GetCursorPos LoadIconW LoadCursorW SetWindowLongW PostQuitMessage SetForegroundWindow

gdi32

CreateSolidBrush

shell32

SHGetFolderPathA ShellExecuteW SHGetKnownFolderPath

ole32

CoCreateInstance CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??7ios_base@std@@QEBA_NXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Thrd_hardware_concurrency _Cnd_wait _Cnd_signal ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z _Cnd_broadcast ??Bios_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Thrd_join _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ _Thrd_yield ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

winmm

mciSendStringW timeBeginPeriod

urlmon

URLDownloadToCacheFileW URLOpenBlockingStreamA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate wcsrchr strstr strchr memchr memcmp _CxxThrowException memmove memset __current_exception __current_exception_context memcpy

api-ms-win-crt-stdio-l1-1-0

ftell __stdio_common_vswprintf_s __stdio_common_vswprintf fseek _wfopen __stdio_common_vsprintf_s _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fputs __stdio_common_vsprintf fwrite __p__commode __stdio_common_vsnprintf_s _set_fmode __stdio_common_vfprintf puts fgetc __stdio_common_vsscanf fclose fflush __acrt_iob_func fputc freopen fgetpos

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-string-l1-1-0

strncpy_s toupper tolower _wcsicmp strncpy strncmp strlen strcmp wcslen

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _crt_atexit _get_initial_narrow_environment _initterm _initterm_e exit _exit system __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function terminate _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _errno abort _beginthreadex

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

ilogb fminf tanf roundf powf nearbyint _dsign sqrtf asinf round pow lroundf logf fmodf floorf expf cosf _hypotf acosf ceilf sinf atan2f __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtoll strtod atof strtof

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-utility-l1-1-0

qsort