payload[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
payload.exe
Size 34.8MB
Sample261107-rpgrcacw4x
SHA256 682f9176fa3ecd5819f17fbf274ae119b696d570537b74ba0931d7c12cbeaaff
MD5 fc2f3c6727133e035c421aec50922037
SHA1 5085a969cdf267a95c07bd9ffd600f2f71007a76
SHA512 15c9d18e1cd020eb497a19bd61eb9f1b635bada3c95af034fd0ad75dac36982a510c83813a551099eb95255114953bbd7e15f6ca5acfb702d968df8e207b10f5
SSDEEP 786432:jLSbBNR+2kxWhn1urEGG+DpezLrHy/kFo0Z4:KbzTk4n1zucrS/Wt4
TLSH
T1CD871256E2FD00E8D57AC0B8CA575517E7B234591330A7EB56A48A692F33FE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
payload.exe

File Explorer

payload.exe

.exe 34.8MB

payload.exe

IMPHASH 25f4444e0f8d2a8ae40cbacacc252543
SHA256 682f9176fa3ecd5819f17fbf274ae119b696d570537b74ba0931d7c12cbeaaff
MD5 fc2f3c6727133e035c421aec50922037
SHA1 5085a969cdf267a95c07bd9ffd600f2f71007a76
SHA512 15c9d18e1cd020eb497a19bd61eb9f1b635bada3c95af034fd0ad75dac36982a510c83813a551099eb95255114953bbd7e15f6ca5acfb702d968df8e207b10f5
SSDEEP 786432:jLSbBNR+2kxWhn1urEGG+DpezLrHy/kFo0Z4:KbzTk4n1zucrS/Wt4
TLSH
T1CD871256E2FD00E8D57AC0B8CA575517E7B234591330A7EB56A48A692F33FE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6044272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

RaiseException FreeLibrary SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler MultiByteToWideChar GetTickCount FlushInstructionCache QueryPerformanceFrequency QueryPerformanceCounter RtlLookupFunctionEntry LocateXStateFeature RtlDeleteFunctionTable InterlockedPushEntrySList InterlockedFlushSList InitializeSListHead GetTickCount64 DuplicateHandle QueueUserAPC WaitForSingleObjectEx SetThreadPriority GetThreadPriority GetCurrentThreadId TlsAlloc GetCurrentThread GetCurrentProcessId CreateThread GetModuleHandleW WaitForMultipleObjectsEx SignalObjectAndWait RtlCaptureContext SetThreadStackGuarantee VirtualQuery WriteFile GetStdHandle GetConsoleOutputCP MapViewOfFileEx UnmapViewOfFile GetStringTypeExW InterlockedPopEntrySList ExitProcess Sleep CreateMemoryResourceNotification VirtualAlloc VirtualFree VirtualProtect SleepEx SwitchToThread SuspendThread ResumeThread InitializeContext SetXStateFeaturesMask RtlRestoreContext CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer ReadFile GetFileSize GetEnvironmentVariableW SetEnvironmentVariableW CreateEventW SetEvent ResetEvent GetThreadContext SetThreadContext GetEnabledXStateFeatures CopyContext WerRegisterRuntimeExceptionModule RtlInstallFunctionTableCallback GetSystemDefaultLCID GetUserDefaultLCID RtlUnwind HeapAlloc HeapFree GetProcessHeap HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW FormatMessageW CreateSemaphoreExW ReleaseSemaphore GetACP LCMapStringEx LocalFree VerSetConditionMask VerifyVersionInfoW QueryThreadCycleTime GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity GetProcessGroupAffinity GetCurrentProcessorNumberEx GetProcessAffinityMask QueryInformationJobObject CloseHandle GetSystemTimeAsFileTime GetModuleFileNameW CreateProcessW GetCPInfo LoadLibraryExW CreateFileW GetFileAttributesExW GetFullPathNameW LoadLibraryExA OutputDebugStringA OpenEventW ReleaseMutex ExitThread CreateMutexW HeapReAlloc CreateNamedPipeA WaitForMultipleObjects DisconnectNamedPipe CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetFilePointer MapViewOfFile GetActiveProcessorGroupCount GetSystemTime SetConsoleCtrlHandler GetLocaleInfoEx GetUserDefaultLocaleName RtlAddFunctionTable LoadLibraryW CreateDirectoryW RemoveDirectoryW CreateActCtxW ActivateActCtx FindResourceW GetWindowsDirectoryW GetFileSizeEx FindFirstFileExW FindNextFileW GetTempPathW FindClose LoadLibraryA GetCurrentDirectoryW IsWow64Process EncodePointer DecodePointer CreateFileMappingA TlsSetValue TlsGetValue GetSystemInfo GetCurrentProcess OutputDebugStringW IsDebuggerPresent LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte GetCommandLineW GetProcAddress GetModuleHandleExW SetThreadErrorMode FlushProcessWriteBuffers SetLastError DebugBreak WaitForSingleObject GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlVirtualUnwind IsProcessorFeaturePresent RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsFree RtlPcToFileHeader TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx GetLastError CreateFileMappingW

advapi32

ReportEventW AdjustTokenPrivileges RegGetValueW SetKernelObjectSecurity GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken DeregisterEventSource RegisterEventSourceW RegQueryValueExW RegOpenKeyExW RegCloseKey EventRegister SetThreadToken RevertToSelf OpenThreadToken EventWriteTransfer EventWrite LookupPrivilegeValueW

ole32

CoCreateFreeThreadedMarshaler CreateStreamOnHGlobal CoRevokeInitializeSpy CoGetContextToken CoGetObjectContext CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CLSIDFromProgID CoReleaseMarshalData CoTaskMemFree CoTaskMemAlloc CoCreateGuid CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoGetClassObject

oleaut32

CreateErrorInfo SysFreeString GetErrorInfo SetErrorInfo SysStringLen SysAllocString SysAllocStringLen SafeArrayGetDim SafeArrayGetLBound SafeArrayDestroy QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType VariantChangeTypeEx VariantClear VariantInit VarCyFromDec SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement LoadRegTypeLi

user32

LoadStringW MessageBoxW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

strncat_s wcsncat_s _wcsicmp wcsnlen wcscat_s towupper iswascii _strdup strncpy strnlen wcstok_s isdigit isupper isalpha towlower _wcsdup iswspace isspace islower strtok_s strcmp strcspn __strncnt _wcsnicmp strlen wcscpy_s toupper wcsncpy_s strcpy_s strcat_s strncpy_s _strnicmp tolower wcsncmp iswupper strncmp _stricmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fflush __acrt_iob_func __stdio_common_vfprintf __stdio_common_vswprintf __stdio_common_vfwprintf fputws fputwc _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc fgetpos fgets fgetc fputc _wfsopen _wfopen __p__commode _set_fmode __stdio_common_vsnprintf_s setvbuf _setmode _dup _fileno ftell fseek fputs __stdio_common_vsnwprintf_s __stdio_common_vsprintf_s fwrite _flushall fopen fclose

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit _invoke_watson __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _beginthreadex terminate _controlfp_s _wcserror_s _invalid_parameter_noinfo _errno exit abort

api-ms-win-crt-convert-l1-1-0

_atoi64 _ltow_s _wtoi strtoul _wcstoui64 atol _itow_s strtoull wcstoul

api-ms-win-crt-heap-l1-1-0

free _set_new_mode calloc malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

asinhf atanhf cbrtf acoshf cosh cbrt coshf exp expf acosh atanh floor floorf fma fmaf cosf _fdopen cos ceilf _copysignf _isnanf trunc truncf ilogb ilogbf tanhf ceil fmod fmodf atanf frexp atan2f atan2 log log10 log10f atan asinf log2 log2f logf pow powf sin sinf asin sinh sinhf sqrt sqrtf tan tanf tanh acosf _copysign asinh _isnan _finite modf modff _dclass _ldclass acos __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_unlock_locales setlocale __pctype_func ___lc_locale_name_func _lock_locales ___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _unlock_file _wremove _lock_file

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

221B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

payload.exe

kernel32

advapi32

ole32

oleaut32

user32

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic