Lyre (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Lyre (1).exe
Size 11.6MB
Sample261107-1wp6qsfx2v
SHA256 477c8a4536cd11934570e1ac6621dafbdddac84c1701f0dca5b9252c3565fd3b
MD5 c93618b7ffce15397eb520741d071c68
SHA1 d91aa654707fab88f873276730c995082622f744
SHA512 9a7b46e931517454882e183781a6fe6f650c322f8b51c4f98ddf2bb0f4ea683dcf0c377153514e3ae6bd3339c97fe500e4dfcc2f5af4dab013b23aba4f39e543
SSDEEP 196608:+/VyH5MSi/r0L+VrY2a5OJtTQiptv9Oqz8s0:mGe0q5Yl5OJtTdptVJA
TLSH
T180C6CF17B7C642ECD0BAD23DCBA6DA15E732B825077657DF0691123A4EA73E04E79302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Lyre (1).exe

File Explorer

Lyre (1).exe

.exe 11.6MB

Lyre (1).exe

IMPHASH cfe0d2b7d7d05ea9fd7c256aa2381a9e
SHA256 477c8a4536cd11934570e1ac6621dafbdddac84c1701f0dca5b9252c3565fd3b
MD5 c93618b7ffce15397eb520741d071c68
SHA1 d91aa654707fab88f873276730c995082622f744
SHA512 9a7b46e931517454882e183781a6fe6f650c322f8b51c4f98ddf2bb0f4ea683dcf0c377153514e3ae6bd3339c97fe500e4dfcc2f5af4dab013b23aba4f39e543
SSDEEP 196608:+/VyH5MSi/r0L+VrY2a5OJtTQiptv9Oqz8s0:mGe0q5Yl5OJtTdptVJA
TLSH
T180C6CF17B7C642ECD0BAD23DCBA6DA15E732B825077657DF0691123A4EA73E04E79302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

78:86:d2:fe:bd:80:e0:6f:16:80:18:5d:74:d8:af:25:da:9f:d6:eb:44:07:4b:0b:7c:6e:34:92:c1:76:d6:88

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Lyre.exe

Chains

Oct 25, 2026

CN=Lyre.exe

Subject

CN=Lyre.exe

Serial Number

2d:51:d3:39:96:52:12:89:4b:ab:2a:ab:87:9d:3c:00

Issuer

CN=Lyre.exe

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 8, 2026 - Oct 8, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3967040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

timeBeginPeriod timeEndPeriod PlaySoundW

shell32

DragFinish SHFileOperationW ShellExecuteW DragAcceptFiles DragQueryFileW SHGetKnownFolderPath SHCreateItemFromParsingName ShellExecuteExW CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx CoTaskMemFree PropVariantClear CoCreateInstance CLSIDFromString StringFromGUID2 CoSetProxyBlanket

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

advapi32

RegSetKeyValueW RegDeleteKeyValueW RegEnumKeyExW RegEnumValueW RegQueryValueExW RegDeleteKeyExW StartTraceW ProcessTrace CloseTrace CreateWellKnownSid OpenProcessToken CheckTokenMembership ControlTraceW GetLengthSid LookupAccountSidW OpenTraceW EnableTraceEx2 GetTokenInformation RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegGetValueW

user32

GetWindowTextW GetAsyncKeyState MapVirtualKeyW SendInput IsIconic EnumWindows ChangeDisplaySettingsExW MonitorFromPoint EqualRect IsWindow GetWindow QueryDisplayConfig GetDisplayConfigBufferSizes EnumDisplayDevicesW DisplayConfigGetDeviceInfo UnregisterHotKey CallNextHookEx RegisterHotKey UnhookWindowsHookEx SetWindowsHookExW PostThreadMessageW SendMessageTimeoutW LoadStringW GetDoubleClickTime FillRect ClientToScreen GetDesktopWindow MonitorFromWindow EnumDisplaySettingsW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData PeekMessageW MsgWaitForMultipleObjectsEx UpdateLayeredWindow DefWindowProcW GetKeyState GetMessageExtraInfo GetWindowRect EnumDisplaySettingsExW IsWindowVisible SetWindowPos GetDpiForWindow MonitorFromRect SetWindowLongPtrW EnumDisplayMonitors CreateWindowExW ScreenToClient GetWindowLongPtrW RegisterClassExW GetWindowPlacement GetActiveWindow GetMonitorInfoW SetWindowPlacement GetRawInputData TrackMouseEvent RegisterRawInputDevices ChangeWindowMessageFilterEx LoadCursorW SetCapture SetCursor GetSystemMetricsForDpi PostQuitMessage UpdateWindow ReleaseCapture LoadImageW GetDpiForSystem InvalidateRect BeginPaint EndPaint GetDC PrintWindow GetClientRect SystemParametersInfoW ReleaseDC GetWindowThreadProcessId SetForegroundWindow GetMessageW PostMessageW GetSystemMetrics SetWindowTextW WindowFromPoint DispatchMessageW SetTimer GetForegroundWindow TranslateMessage KillTimer SetWinEventHook UnhookWinEvent GetAncestor GetCursorPos SetProcessDpiAwarenessContext MessageBoxW ShowWindow MessageBoxA FindWindowW DestroyWindow

dxva2

DestroyPhysicalMonitors SetMonitorBrightness GetMonitorBrightness GetNumberOfPhysicalMonitorsFromHMONITOR GetPhysicalMonitorsFromHMONITOR

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho GetAdaptersAddresses

ws2_32

getaddrinfo inet_pton select closesocket WSAStartup socket ioctlsocket freeaddrinfo htons __WSAFDIsSet ntohl recv WSAGetLastError connect htonl WSACleanup getsockopt inet_ntop send

userenv

RefreshPolicyEx

comdlg32

ChooseColorW

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptHash BCryptCloseAlgorithmProvider BCryptImportKeyPair BCryptGenRandom BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptHashData BCryptCreateHash BCryptFinishHash BCryptDestroyKey BCryptDestroyHash

crypt32

CertFindCertificateInStore CertGetCertificateContextProperty CryptUnprotectData CryptProtectData CertCloseStore CryptQueryObject CertFreeCertificateContext CryptMsgGetParam CryptMsgClose CertGetNameStringW

wintrust

WinVerifyTrust

cabinet

ord45 ord43 ord40

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mfplat

MFCreateDXGISurfaceBuffer MFTEnumEx MFCreateMediaType MFCreateAttributes MFCreateDXGIDeviceManager MFShutdown MFCreateMemoryBuffer MFCreateSample MFStartup

mfreadwrite

MFCreateSinkWriterFromURL MFCreateSourceReaderFromURL

api-ms-win-core-winrt-l1-1-0

RoInitialize RoGetActivationFactory RoUninitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsCreateString WindowsCreateStringReference

netapi32

NetApiBufferFree NetUserGetLocalGroups NetLocalGroupAddMembers

pdh

PdhGetFormattedCounterArrayW PdhAddEnglishCounterW PdhCloseQuery PdhOpenQueryW PdhCollectQueryData

d2d1

ord2 ord1

dwrite

DWriteCreateFactory

dwmapi

DwmGetWindowAttribute DwmExtendFrameIntoClientArea DwmSetWindowAttribute

gdi32

AddFontResourceW GetObjectW GetDIBits GetDeviceGammaRamp SelectObject SetDeviceGammaRamp GdiFlush DeleteDC DeleteObject GetStockObject CreateDCW CreateDIBSection CreateCompatibleDC

mfplay

MFPCreateMediaPlayer

kernel32

GetFileInformationByHandle FindFirstFileW GetStringTypeW GetLocaleInfoEx FormatMessageA GetEnvironmentStringsW TerminateJobObject ResumeThread FreeEnvironmentStringsW CreatePipe CreateJobObjectW AssignProcessToJobObject SetHandleInformation SetInformationJobObject RemoveDirectoryW GlobalMemoryStatusEx GetSystemTimes GetFileSizeEx SetWaitableTimerEx GetEnvironmentVariableA PeekNamedPipe GetDiskFreeSpaceExW MoveFileExW GetUserGeoID GetGeoInfoW QueryFullProcessImageNameW FindResourceW LoadResource LockResource SizeofResource GetSystemTime SystemTimeToFileTime GetPriorityClass Process32FirstW K32GetProcessMemoryInfo Process32NextW CreateToolhelp32Snapshot K32EmptyWorkingSet GetComputerNameW GetVolumeInformationW CreateWaitableTimerExW QueryPerformanceFrequency WaitForMultipleObjects GetFinalPathNameByHandleW SetWaitableTimer GetThreadGroupAffinity SetThreadPriorityBoost GetSystemCpuSetInformation SetThreadGroupAffinity ResetEvent GetThreadPriority GetThreadIdealProcessorEx SetProcessInformation SetThreadIdealProcessorEx SetUnhandledExceptionFilter SetThreadStackGuarantee GetLocalTime DeleteFileW FileTimeToSystemTime RaiseFailFastException GetCurrentThreadId FindClose GetModuleHandleExW WriteFile FindNextFileW FindFirstFileExW CompareFileTime GetModuleFileNameA GetExitCodeProcess FreeLibrary CreateProcessW GetSystemDirectoryW TerminateProcess lstrcmpiW MapViewOfFile CreateFileMappingW AreFileApisANSI OpenProcess UnmapViewOfFile OpenFileMappingW WaitForSingleObject SetPriorityClass OpenThread GetThreadTimes IsValidCodePage HeapReAlloc GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP GetFullPathNameW SetFileInformationByHandle CreateWaitableTimerW SetFileTime FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetFileType GetStdHandle SetConsoleCtrlHandler CheckRemoteDebuggerPresent IsDebuggerPresent VirtualQuery SetFilePointerEx GetThreadContext LoadLibraryW GetFileAttributesExW CreateFileW ReadFile GetTempPathW LoadLibraryExW GlobalUnlock GlobalLock GlobalFree GlobalAlloc ExitProcess FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError CopyFileW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetACP RtlUnwindEx InitializeSListHead GetOEMCP GetCommandLineA SetEnvironmentVariableW RtlUnwind GetProcessHeap SetStdHandle GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind CompareStringOrdinal SetEvent CreateEventW SetThreadPriority SetProcessWorkingSetSize HeapCompact GetProcessHeaps GetCurrentThread SetThreadInformation CreateDirectoryW QueryPerformanceCounter GetSystemTimeAsFileTime WideCharToMultiByte RtlLookupFunctionEntry RtlCaptureContext GetCPInfo MultiByteToWideChar GetProcessTimes SetDllDirectoryW GetModuleHandleW LocalFree HeapSize WriteConsoleW LCMapStringEx DecodePointer EncodePointer GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockShared AcquireSRWLockShared WakeConditionVariable RtlPcToFileHeader RaiseException EnterCriticalSection SetEndOfFile LeaveCriticalSection InitializeCriticalSectionEx GetCurrentProcessId GetProcAddress HeapSetInformation SetDefaultDllDirectories GetCommandLineW GetCurrentProcess GetModuleFileNameW GetEnvironmentVariableW CreateMutexW Sleep GetTickCount64 GetLastError AttachConsole CloseHandle GetSystemInfo DeleteCriticalSection

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

391KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Lyre (1).exe

PE Signature issue

winmm

shell32

ole32

oleaut32

advapi32

user32

dxva2

iphlpapi

ws2_32

userenv

comdlg32

winhttp

bcrypt

crypt32

wintrust

cabinet

d3d11

dxgi

mfplat

mfreadwrite

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

netapi32

pdh

d2d1

dwrite

dwmapi

gdi32

mfplay

kernel32

generic