lowshit[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lowshit.exe
Size 13.7MB
Sample261102-e9xl3szzas
SHA256 70f513a76fe392c392aee653fac4ae9850d2ffc9c7784fc6c9feaf836f496893
MD5 61b409655a3ee1825f45db305dec77d7
SHA1 75bf572b892962a649fb574da80fe94f442adec1
SHA512 a8f216aeec440c6adce19de15241bf3fe5d2c1a0b3215ab9076d0737f66fc128d6d616e7c404fcc5227355a90fc07a79a43fe22edaf1ceaa130dbd5e662e0144
SSDEEP 196608:gP54m5yMmhTK5X6zA9tPw0RsW0Qp9y5IiBO5HK2SJ899GtDhk+GoEiU24KEi:g54QHma6ErIgAI3u09mD7GoEioW
TLSH
T15AE612E568D051ECC496C730D34A5FFDF0E9B88A0D79682FBFC609416932E86C8E5936
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lowshit.exe

File Explorer

lowshit.exe

.exe 13.7MB

lowshit.exe

IMPHASH 8e7939f4b581979f76e5a5f2433975ca
SHA256 70f513a76fe392c392aee653fac4ae9850d2ffc9c7784fc6c9feaf836f496893
MD5 61b409655a3ee1825f45db305dec77d7
SHA1 75bf572b892962a649fb574da80fe94f442adec1
SHA512 a8f216aeec440c6adce19de15241bf3fe5d2c1a0b3215ab9076d0737f66fc128d6d616e7c404fcc5227355a90fc07a79a43fe22edaf1ceaa130dbd5e662e0144
SSDEEP 196608:gP54m5yMmhTK5X6zA9tPw0RsW0Qp9y5IiBO5HK2SJ899GtDhk+GoEiU24KEi:g54QHma6ErIgAI3u09mD7GoEioW
TLSH
T15AE612E568D051ECC496C730D34A5FFDF0E9B88A0D79682FBFC609416932E86C8E5936
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18638540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

d3dcompiler_47

D3DCompile

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges RegCloseKey SetNamedSecurityInfoA AllocateAndInitializeSid RegCreateKeyExA GetTokenInformation FreeSid OpenProcessToken RegSetValueExA SetEntriesInAclA

user32

ShowCursor SetForegroundWindow UpdateWindow EnumDisplaySettingsW GetDesktopWindow PostQuitMessage SetWindowDisplayAffinity ClipCursor TranslateMessage BringWindowToTop SetFocus SetLayeredWindowAttributes AttachThreadInput PeekMessageW MessageBoxA GetAsyncKeyState SetProcessDPIAware GetClientRect CloseClipboard GetMonitorInfoW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard DispatchMessageW EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW GetWindowRect DestroyWindow SetWindowPos MonitorFromWindow SetActiveWindow SetWindowLongPtrW CreateWindowExW GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow ClientToScreen

shell32

ShellExecuteW ShellExecuteExW SHGetKnownFolderPath

kernel32

GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc OutputDebugStringW GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead ResetEvent InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo ReadFile SetConsoleCtrlHandler GetProcessHeap WriteProcessMemory GetCurrentProcess WriteFile TerminateProcess WaitForSingleObject OpenProcess CreateToolhelp32Snapshot CreateEventW GetTickCount64 CopyFileA Process32NextW CreateFileA SetEvent DeleteFileA Process32FirstW CloseHandle CreateThread Module32FirstW VirtualProtectEx SetCurrentDirectoryW SetFilePointerEx LocalFree ExitProcess ReadProcessMemory GetCurrentProcessId Module32NextW CreateProcessA GetTickCount FlushFileBuffers SizeofResource GetFileSizeEx LockResource LoadResource FindResourceW VirtualQuery MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW GetLastError QueryPerformanceFrequency QueryPerformanceCounter GetFileAttributesExA GetTempPathA GetFileAttributesA GetSystemDirectoryA GetFileSize Sleep GetModuleFileNameA GetCurrentThreadId WaitForSingleObjectEx GetModuleHandleW OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA IsDBCSLeadByte RtlUnwind FreeLibrary GetStringTypeW LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime CreateFileW HeapSize SetEndOfFile MoveFileA GetProcAddress InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetExitCodeThread RtlPcToFileHeader RaiseException IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize FlsAlloc FlsGetValue FlsSetValue FlsFree

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree

dbghelp

SymSetOptions SymInitialize SymGetTypeInfo SymGetTypeFromName SymCleanup SymLoadModuleEx

urlmon

URLDownloadToFileA

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

Name

.text

Size

Virtual Size

931KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

538KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.T[f

Size

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.*<+

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.,((

Size

13.7MB

Virtual Size

13.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

lowshit.exe

d3d11

dcomp

d3dcompiler_47

advapi32

user32

shell32

kernel32

ole32

dbghelp

urlmon

imm32

generic