takeover[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
takeover.exe
Size 280.9MB
Sample261107-rmybbadx2l
SHA256 f37e11e61db2c8d630d5b9d61c77f332dd90bac49453e4d72c1974b37344ccd4
MD5 81d908a7d9a4d36996b91c48aa42c15d
SHA1 faa11c22491f7b57c39dd7a5b4e90ca06825ba15
SHA512 92ba7319761a5db3bcf2d60acf91adfc87364e4a6f8919d13c798abbbf790abe120b1462ffaf436d7a486a110e009acad3223b5684612a07b68bffb065c40314
SSDEEP 6291456:upC6m0QDRxbAliq5yNjp5zaJCi/Byg5e5BAjpeN94SS3F4Fi0B0lSOutxZ9im:upXJQDfbW7y/kJCG5e5GjpE41a8lKt3J
TLSH
T174E83312FAD696BCC09BC470875656665A3134CF0F316AFF41E096383F6ABF05A38B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
takeover.exe

File Explorer

takeover.exe

.exe 280.9MB

takeover.exe

IMPHASH 5dd5f63d167ef97d956e6663a8343151
SHA256 f37e11e61db2c8d630d5b9d61c77f332dd90bac49453e4d72c1974b37344ccd4
MD5 81d908a7d9a4d36996b91c48aa42c15d
SHA1 faa11c22491f7b57c39dd7a5b4e90ca06825ba15
SHA512 92ba7319761a5db3bcf2d60acf91adfc87364e4a6f8919d13c798abbbf790abe120b1462ffaf436d7a486a110e009acad3223b5684612a07b68bffb065c40314
SSDEEP 6291456:upC6m0QDRxbAliq5yNjp5zaJCi/Byg5e5BAjpeN94SS3F4Fi0B0lSOutxZ9im:upXJQDfbW7y/kJCG5e5GjpE41a8lKt3J
TLSH
T174E83312FAD696BCC09BC470875656665A3134CF0F316AFF41E096383F6ABF05A38B19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10245936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

takeover.pdb

user32

MapVirtualKeyW GetWindowPlacement GetKeyboardLayoutNameW GetDoubleClickTime GetSystemMetrics KillTimer SetCapture TrackMouseEvent ReleaseCapture IsZoomed GetSystemMetricsForDpi GetDpiForWindow SetCursor IsWindowEnabled TranslateMessage OpenClipboard EmptyClipboard MonitorFromWindow SystemParametersInfoW CloseClipboard CountClipboardFormats GetKeyState GetClipboardData MessageBoxW GetClientRect IsClipboardFormatAvailable ScreenToClient SetForegroundWindow SendInput SetFocus SetActiveWindow ShowWindowAsync IsIconic DispatchMessageW GetMessageW GetCursorPos PostMessageW GetActiveWindow IsWindowVisible ToUnicode MonitorFromPoint EnumClipboardFormats DestroyWindow GetClipboardFormatNameW LoadImageW SendMessageW PostQuitMessage DefWindowProcW CreateWindowExW RegisterClassW SetClipboardData SetWindowPos SetWindowLongPtrW GetWindowRect GetWindowLongPtrW RegisterClipboardFormatW SetWindowTextW SetTimer RedrawWindow ShowWindow GetMonitorInfoW EnumDisplayMonitors SendMessageTimeoutW SetWindowPlacement ValidateRect

kernel32

ReleaseMutex GetFinalPathNameByHandleW GetUserDefaultLocaleName AddVectoredExceptionHandler QueryPerformanceFrequency LoadLibraryExA CreateProcessW GetWindowsDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle GlobalSize GlobalLock GlobalUnlock RtlVirtualUnwind RtlLookupFunctionEntry GlobalAlloc RtlCaptureContext GetSystemInfo UnmapViewOfFile CreateFileMappingW MapViewOfFile GetEnvironmentVariableW DuplicateHandle CopyFileExW CreateEventA WaitForSingleObjectEx GetCurrentThread GetModuleHandleA WriteConsoleW GetConsoleMode GetConsoleOutputCP ReadFileEx VirtualQuery SetThreadStackGuarantee SwitchToFiber IsThreadAFiber ConvertThreadToFiber CreateFiber DeleteFiber ConvertFiberToThread CreateWaitableTimerExW SetWaitableTimer FindFirstFileExW ExitProcess GetTempPathW SetLastError GetCurrentProcess GetProcAddress SwitchToThread CreateDirectoryW LoadLibraryA CreateMutexA GetFileAttributesW SetUnhandledExceptionFilter FreeLibrary GetSystemDirectoryW GetCurrentProcessId GetProcessHeap GetModuleHandleExW HeapAlloc HeapFree GetLastError FormatMessageW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime Sleep SetEvent GetModuleHandleW CreateFileW SetFilePointerEx FindNextFileW WaitForSingleObject FindClose GetModuleFileNameW CreateThread HeapReAlloc SetFileTime SetFileInformationByHandle MoveFileExW GetFullPathNameW SleepEx WriteFileEx CompareStringOrdinal WaitForMultipleObjectsEx SetThreadPriority QueryPerformanceCounter GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW VirtualProtect CloseHandle WideCharToMultiByte MultiByteToWideChar GetCurrentDirectoryW lstrlenW GetCommandLineW InitializeSListHead GetStdHandle

ole32

RevokeDragDrop OleInitialize OleUninitialize CoCreateFreeThreadedMarshaler PropVariantClear CoCreateInstance CoInitializeEx CoUninitialize ReleaseStgMedium RegisterDragDrop

combase

CoTaskMemFree CoIncrementMTAUsage

dwmapi

DwmGetColorizationColor DwmGetCompositionTimingInfo DwmSetWindowAttribute DwmFlush

shell32

IsUserAnAdmin SHGetDesktopFolder SHOpenFolderAndSelectItems ShellExecuteW SHCreateItemFromParsingName SHAppBarMessage DragQueryFileW

oleaut32

SysFreeString GetErrorInfo SysStringLen SysAllocStringLen SetErrorInfo

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

advapi32

CredReadW CredFree RegOpenKeyExW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegCloseKey RegCreateKeyTransactedW RegOpenKeyTransactedW CredDeleteW CredWriteW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

comctl32

TaskDialogIndirect

gdi32

CreateSolidBrush

icuuc

u_strlen

dcomp

DCompositionCreateDevice

ntdll

NtOpenFile NtCreateNamedPipeFile RtlGetVersion RtlNtStatusToDosError NtWriteFile NtReadFile

imm32

ImmSetCompositionWindow ImmGetVirtualKey ImmGetContext ImmSetCandidateWindow ImmReleaseContext ImmGetCompositionStringW

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

dwrite

DWriteCreateFactory

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

vcruntime140

__current_exception_context __current_exception __C_specific_handler _CxxThrowException memset memcmp memcpy memmove __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

roundf fmod __setusermatherr fmodf round ceilf exp logf log2f acosf acos tan atan2 trunc fmaf log2 atan2f cos sin ceil floor powf tanf pow sinf fma cosf truncf floorf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _exit __p___argv _seh_filter_exe _set_app_type _cexit _c_exit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment __p___argc _initterm _register_thread_local_exe_atexit_callback terminate _initterm_e exit _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Name

.text

Size

10.1MB

Virtual Size

10.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

269.8MB

Virtual Size

269.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

261KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

319KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

424KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

takeover.exe

user32

kernel32

ole32

combase

dwmapi

shell32

oleaut32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

bcryptprimitives

advapi32

api-ms-win-core-synch-l1-2-0

comctl32

gdi32

icuuc

dcomp

ntdll

imm32

d3d11

dxgi

dwrite

api-ms-win-shcore-scaling-l1-1-1

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic