aspnetcore-runtime-10[.]0[.]14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe
Size 10.7MB
Sample261102-g3qlasec82
SHA256 b7ff2dc29209ac243eaea0b7614e26d33136e3d8a1aba97ba211e0e39e209849
MD5 461fab69a26843005cd24abe9078238b
SHA1 9ad4780536ff0a60c05e1507d773fa6318b45ac1
SHA512 90045a7969d70453ac973ec3858105118e974f415c7cbd1a3cd7800b7442b291ea9f5b388a4ab79ab0d118e9fd330c9548a7e028d6d0e84daddec670a16bbb53
SSDEEP 196608:gbUesFcsIJ5xo+wrAZYF1LtUErXQsiWHBCsB4aksPu6JahxA2w5:ZesOJ/4LmETMsBLks26JGeJ
TLSH
T1E9B62331A0A5242BDAF40973F910D230BE2CD7182B1C95AAD5D0ED1D38985FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe

.exe 10.7MB

aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe

IMPHASH dc78060b861de085d3b25326d5393553
SHA256 b7ff2dc29209ac243eaea0b7614e26d33136e3d8a1aba97ba211e0e39e209849
MD5 461fab69a26843005cd24abe9078238b
SHA1 9ad4780536ff0a60c05e1507d773fa6318b45ac1
SHA512 90045a7969d70453ac973ec3858105118e974f415c7cbd1a3cd7800b7442b291ea9f5b388a4ab79ab0d118e9fd330c9548a7e028d6d0e84daddec670a16bbb53
SSDEEP 196608:gbUesFcsIJ5xo+wrAZYF1LtUErXQsiWHBCsB4aksPu6JahxA2w5:ZesOJ/4LmETMsBLks26JGeJ
TLSH
T1E9B62331A0A5242BDAF40973F910D230BE2CD7182B1C95AAD5D0ED1D38985FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

e9:11:27:53:4c:e4:7a:99:25:59:6a:e6:a4:28:1b:2c:d6:63:27:d6:1c:53:99:f8:aa:97:8c:ac:bd:aa:7b:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 23, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:c7:9a:a1:ee:dc:27:e2:f8:b7:00:00:00:00:01:c7

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1b:d0:b2:b8:02:67:f7:72:cf:00:01:00:00:02:1b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

339104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\a\_work\1\s\build\burn\Release\x86\burn.pdb

kernel32

InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseMutex CreateEventW GetCurrentProcess CreateThread GetNativeSystemInfo VerSetConditionMask GetSystemTime GetComputerNameW VerifyVersionInfoW GetDateFormatW CompareStringW GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLangID GetStringTypeW CreateProcessW DuplicateHandle GetExitCodeProcess CompareStringOrdinal ProcessIdToSessionId OpenProcess GetProcessId SetProcessShutdownParameters CreateSemaphoreW LocalFileTimeToFileTime GetExitCodeThread DosDateTimeToFileTime CompareStringA SetThreadExecutionState ReleaseSemaphore CreateMutexW CreateFileMappingW MapViewOfFile UnmapViewOfFile UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryExA TlsGetValue TlsSetValue TlsFree EncodePointer GetStdHandle GetModuleHandleExW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer WriteConsoleW FreeLibrary VirtualQuery VirtualProtect GetSystemInfo RaiseException ExpandEnvironmentStringsW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetModuleFileNameW GetSystemWow64DirectoryW GetSystemDirectoryW GetLocalTime SetLastError GetTempPathW GetVolumePathNameW GetTempFileNameW GetFullPathNameW CopyFileW GlobalFree GlobalAlloc Sleep SetFileTime SetFilePointerEx SetEndOfFile ReadFile SetEnvironmentVariableW GetFileSizeEx LCMapStringW WideCharToMultiByte MultiByteToWideChar lstrlenW FormatMessageW LocalFree MoveFileExW SetFileAttributesW RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW GetCurrentDirectoryW LoadLibraryExW GetProcAddress GetModuleHandleW WaitForMultipleObjects WaitForSingleObject HeapSetInformation GetLastError lstrlenA GetCurrentProcessId GetModuleHandleA MulDiv GetSystemWindowsDirectoryW ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW LoadResource LockResource SizeofResource FindResourceExA VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation WriteFile SetFilePointer CreateFileA ExitProcess CloseHandle TlsAlloc CreateFileW

user32

GetDC ReleaseDC MonitorFromPoint MonitorFromWindow ShowWindow IsDialogMessageW LoadCursorW GetMonitorInfoW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW SetWindowPos CreateWindowExW UnregisterClassW RegisterClassW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW WaitForInputIdle IsWindow PostMessageW LoadBitmapW

gdi32

DeleteObject SelectObject StretchBlt SetStretchBltMode GetObjectW DeleteDC CreateCompatibleDC CreateDCW GetDeviceCaps

advapi32

InitiateSystemShutdownExW CryptAcquireContextW CryptReleaseContext QueryServiceConfigW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken AllocateAndInitializeSid CheckTokenMembership GetTokenInformation AdjustTokenPrivileges IsWellKnownSid LookupPrivilegeValueW RegCreateKeyExW QueryServiceStatus OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW SetEntriesInAclW DecryptFileW InitializeAcl CreateWellKnownSid ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW OpenEventLogW CloseEventLog RegQueryInfoKeyW RegDeleteValueW RegQueryValueExW GetUserNameW RegOpenKeyExW RegCloseKey SetNamedSecurityInfoW RegDeleteKeyW RegEnumKeyExW RegEnumValueW RegSetValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetEntriesInAclA

ole32

CoInitializeEx CoInitialize CoInitializeSecurity CoUninitialize CLSIDFromProgID CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocString VariantClear

shell32

ShellExecuteExW CommandLineToArgvW SHGetFolderPathW

Name

.text

Size

482KB

Virtual Size

481KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

232KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

212B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

aspnetcore-runtime-10.0.14-win-x64_9ad4780536ff0a60c05e1507d773fa6318b45ac1.exe

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shell32

generic