setup_rLrrMYAU2rE[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
setup_rLrrMYAU2rE.exe
Size 1.9MB
Sample261104-telnnasycv
SHA256 220bcc3e7666a33ebecfa1d1535c8b95cc7646755480feec8c3a8b5fa46afb5d
MD5 7d002b38e28c01af7f3b5aa22bb209fd
SHA1 d6938418795035aaefc50410a7593e9343524e7a
SHA512 994021d2214c89e99c12137546e390a8fd488d05a8af71653245c5571aa0c6c5b7d90faad2191a108e39abb6575117f867c3e1edb62489f7df8d27913a113409
SSDEEP 49152:1kq+sMBHpOLUv8ah5rc3fB+nDheTQ8dyQ42BwvAV:1kpgZfdBd54GX
TLSH
T102959DAE93B442A8D056D6B8C9826C27E77238255378FBEF97C04D611F267E00B77721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup_rLrrMYAU2rE.exe

File Explorer

setup_rLrrMYAU2rE.exe

.exe 1.9MB

setup_rLrrMYAU2rE.exe

IMPHASH af0751ace720ceab2238177780be54c7
SHA256 220bcc3e7666a33ebecfa1d1535c8b95cc7646755480feec8c3a8b5fa46afb5d
MD5 7d002b38e28c01af7f3b5aa22bb209fd
SHA1 d6938418795035aaefc50410a7593e9343524e7a
SHA512 994021d2214c89e99c12137546e390a8fd488d05a8af71653245c5571aa0c6c5b7d90faad2191a108e39abb6575117f867c3e1edb62489f7df8d27913a113409
SSDEEP 49152:1kq+sMBHpOLUv8ah5rc3fB+nDheTQ8dyQ42BwvAV:1kpgZfdBd54GX
TLSH
T102959DAE93B442A8D056D6B8C9826C27E77238255378FBEF97C04D611F267E00B77721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

749404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

wininet

InternetOpenUrlA InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetOpenA InternetConnectA InternetCloseHandle

shell32

ShellExecuteA SHGetFolderPathA

advapi32

GetTokenInformation RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDestroyKey CryptReleaseContext SetSecurityDescriptorDacl SetKernelObjectSecurity InitializeSecurityDescriptor InitializeAcl OpenProcessToken AllocateAndInitializeSid CheckTokenMembership FreeSid RegSetValueExW GetUserNameA CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus ConvertSidToStringSidA CryptAcquireContextA

user32

SetWindowPos SetCapture ReleaseCapture GetSystemMetrics UpdateWindow SetWindowRgn SetWindowTextA GetClientRect GetWindowRect MessageBoxA GetCursorPos OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo ShowWindow GetCapture IsWindowUnicode GetForegroundWindow SetCursorPos SetCursor ClientToScreen ScreenToClient LoadCursorA UnregisterClassA PostQuitMessage DestroyWindow DefWindowProcA PostMessageA PeekMessageA DispatchMessageA TranslateMessage wsprintfW CreateWindowExA GetKeyState wsprintfA RegisterClassExA

gdi32

CreateRoundRectRgn

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileA

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpConnect WinHttpOpen WinHttpSetTimeouts WinHttpReceiveResponse WinHttpCloseHandle

ole32

CoInitializeEx CoUninitialize

ws2_32

recv accept bind closesocket connect ioctlsocket getsockname getsockopt htonl listen ntohs __WSAFDIsSet select send setsockopt shutdown socket WSAStartup WSAGetLastError getaddrinfo freeaddrinfo inet_ntop

kernel32

IsValidCodePage GetACP GetOEMCP SetFilePointerEx GetFileSizeEx GetConsoleMode GetCommandLineA FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetCommandLineW GetEnvironmentStringsW ReadConsoleW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetConsoleOutputCP GetSystemDirectoryW InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateFileW WakeAllConditionVariable SetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileAttributesW GetFileAttributesExA GetFileSize ReadFile WriteFile GetTempPathA GetVolumeInformationA OutputDebugStringA CloseHandle SetUnhandledExceptionFilter GetLastError SetErrorMode QueryPerformanceCounter SetEvent WaitForSingleObject CreateEventA CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess ResumeThread CreateProcessA OpenProcess GetTickCount GetTickCount64 GetSystemDirectoryA RtlUnwind GetWindowsDirectoryA FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleA LoadLibraryExA LocalFree MoveFileExA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableW CompareFileTime CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetProcessTimes CreateProcessW ReadProcessMemory GetModuleHandleW GetProcAddress QueryFullProcessImageNameW MoveFileExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetThreadContext SetThreadContext VirtualAllocEx VirtualProtectEx WriteProcessMemory GetExitCodeThread DebugSetProcessKillOnExit FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete WaitForSingleObjectEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

943KB

Virtual Size

943KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

428KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

523KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup_rLrrMYAU2rE.exe

d3d11

wininet

shell32

advapi32

user32

gdi32

bcrypt

dwmapi

urlmon

winhttp

ole32

ws2_32

kernel32

imm32

d3dcompiler_47

generic