PhaseLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PhaseLauncher.exe
Size 1.9MB
Sample261102-vrkskavyc1
SHA256 251563d5fc9c2eb51f30af5e6e52842b487dda86a0c1fc7b42a5f6e489a6020e
MD5 7aae2eb3ebcedfd9a76a8a354e2f368e
SHA1 03a4c34c870981cf614ec880592f238c3e857580
SHA512 ea79d09fb3bfa6c1e85339c477bef7cb25d1dd7f05b514f57efa5f2ee3a34fbccfb17dc0371c81853e2fe7f6763a601c0003128b7dc3c7ba14175788d5437ab6
SSDEEP 49152:xhVrr+ifd6nP0hxgqSLvDIBkZmK98cIJBqSNLuj/as:rJ0s490kD98f9Ki
TLSH
T1EA95E037F69801ACD1B6C1BACB578913FB72344903316ADB13909A662F1B5E94F7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PhaseLauncher.exe

File Explorer

PhaseLauncher.exe

.exe 1.9MB

PhaseLauncher.exe

IMPHASH 6cb40723739818c62ad8f2cfe05488ac
SHA256 251563d5fc9c2eb51f30af5e6e52842b487dda86a0c1fc7b42a5f6e489a6020e
MD5 7aae2eb3ebcedfd9a76a8a354e2f368e
SHA1 03a4c34c870981cf614ec880592f238c3e857580
SHA512 ea79d09fb3bfa6c1e85339c477bef7cb25d1dd7f05b514f57efa5f2ee3a34fbccfb17dc0371c81853e2fe7f6763a601c0003128b7dc3c7ba14175788d5437ab6
SSDEEP 49152:xhVrr+ifd6nP0hxgqSLvDIBkZmK98cIJBqSNLuj/as:rJ0s490kD98f9Ki
TLSH
T1EA95E037F69801ACD1B6C1BACB578913FB72344903316ADB13909A662F1B5E94F7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

538320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

gdiplus

GdipDisposeImage GdipGetImageGraphicsContext GdipSaveImageToFile GdiplusStartup GdipCloneImage GdiplusShutdown GdipLoadImageFromStream GdipFillRectangle GdipDrawImageRectI GdipCreateBitmapFromScan0 GdipCreateFont GdipSetInterpolationMode GdipSetClipPath GdipAddPathEllipseI GdipRestoreGraphics GdipDrawArcI GdipDrawEllipseI GdipSetClipRectI GdipSaveGraphics GdipScaleWorldTransform GdipDeleteGraphics GdipCreateFromHDC GdipDrawLineI GdipFillRectangleI GdipGraphicsClear GdipSetTextRenderingHint GdipSetSmoothingMode GdipDrawRectangle GdipFillEllipse GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDrawPath GdipDeletePen GdipCreatePen1 GdipFillPath GdipClosePathFigure GdipAddPathArc GdipDeletePath GdipCreatePath GdipDrawString GdipSetStringFormatTrimming GdipDeleteStringFormat GdipCreateStringFormat GdipCloneBrush GdipAlloc GdipFree GdipDeleteBrush GdipCreateSolidFill GdipDeleteFont GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif

shlwapi

ord12

winhttp

WinHttpSetOption WinHttpCrackUrl WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpConnect WinHttpSetTimeouts WinHttpOpen

bcrypt

BCryptSetProperty BCryptEncrypt BCryptDecrypt BCryptGetProperty BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptHash BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptGenRandom BCryptGenerateSymmetricKey

advapi32

RegGetValueA AdjustTokenPrivileges LookupPrivilegeValueW GetCurrentHwProfileA OpenProcessToken

crypt32

CryptUnprotectData CryptProtectData CryptImportPublicKeyInfoEx2 CryptDecodeObjectEx CryptStringToBinaryA

comctl32

ord410 InitCommonControlsEx ord412 ord413

kernel32

FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode GetStdHandle GetCurrentThreadId GetEnvironmentVariableW GetExitCodeThread CreateRemoteThread GetProcAddress VirtualFreeEx VirtualAllocEx SetLastError GetCurrentProcess GetExitCodeProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetPackageFamilyName FlushFileBuffers WriteFile GetLastError GetVolumeInformationA GetWindowsDirectoryA LocalFree RemoveDirectoryW TerminateProcess Sleep WaitForSingleObject OpenEventW QueryFullProcessImageNameW OpenProcess CreateFileW GetFileAttributesW ReplaceFileW CreateFile2 AreFileApisANSI SetEvent WaitForMultipleObjects GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetDynamicTimeZoneInformation GetModuleFileNameW MultiByteToWideChar GetPrivateProfileStringW WritePrivateProfileStringW WideCharToMultiByte GetModuleHandleW GetTickCount64 FindResourceW LoadResource SizeofResource LockResource DeleteFileW CloseHandle MoveFileExW GetCurrentProcessId CopyFileW CreateProcessW CreateEventW WriteProcessMemory

user32

GetMessageW GetSystemMetrics RegisterClassExW LoadIconW LoadCursorW GetDpiForSystem PostQuitMessage IsIconic SystemParametersInfoW DefWindowProcW DestroyWindow EnableWindow ShowWindow SendMessageW GetFocus DialogBoxIndirectParamW SetTimer IsWindow KillTimer EndDialog PtInRect IsWindowEnabled DispatchMessageW IsDialogMessageW EndPaint GetClientRect BeginPaint SetFocus GetDpiForWindow SetWindowLongPtrW GetWindowLongPtrW CreateWindowExW SetWindowTextW MonitorFromRect GetMonitorInfoW GetParent GetDlgItem SetWindowPos RemovePropW InvalidateRect TrackMouseEvent SetPropW GetPropW GetWindowTextW SetWindowRgn GetWindowRect SetProcessDpiAwarenessContext GetCursorPos TranslateMessage GetDlgCtrlID ScreenToClient

gdi32

CreateSolidBrush SetTextColor SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap CreateRoundRectRgn BitBlt CreateFontW SetBkColor

shell32

ShellExecuteW SHGetKnownFolderPath

ole32

CoTaskMemFree

msvcp140

?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??Bios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?uncaught_exceptions@std@@YAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Xtime_get_ticks ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z _Query_perf_frequency _Query_perf_counter ?_Xbad_function_call@std@@YAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrToBool@@YA_NPEBX@Z _Cnd_register_at_thread_exit ?_Xout_of_range@std@@YAXPEBD@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ??0task_continuation_context@Concurrency@@AEAA@XZ ?__ExceptionPtrRethrow@@YAXPEBX@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1facet@locale@std@@MEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$numpunct@D@std@@2V0locale@2@A _Thrd_join _Thrd_id _Cnd_signal ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?__ExceptionPtrDestroy@@YAXPEAX@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Cnd_broadcast _Cnd_wait ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __std_exception_copy __current_exception_context __current_exception __C_specific_handler memset memmove memcpy memcmp _CxxThrowException _purecall __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free calloc

api-ms-win-crt-stdio-l1-1-0

fgetc _set_fmode _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vfprintf fclose fwrite fputc ungetc fflush setvbuf fsetpos fgetpos _fseeki64 _wfsopen _fwrite_nolock fread __p__commode __stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

_wcsicmp _wcsnicmp wcslen isdigit strlen

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32 _lock_file _wmkdir _unlock_file

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _exit _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _c_exit _errno terminate _register_thread_local_exe_atexit_callback _set_app_type exit abort

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtoll

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

cosf _dsign ceilf __setusermatherr sinf

api-ms-win-crt-time-l1-1-0

strftime _localtime64_s _gmtime64_s