renaissance[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
renaissance.exe
Size 7.3MB
Sample261107-ttpzmayz4n
SHA256 48b9dce371b300e3353c8f304c1729758447cdf18b15ba07536be90a8e15c754
MD5 bfcef27f87b4bc1387cffb8fda75d088
SHA1 b325c5ee89e7a227525db4e79c66f85d6270d39b
SHA512 f8641d021eee08580c2f315d8989ad57ec76905291aa8a0b8b4e55d3bf99d496e781f91b025ddd2c9d0a4e1714d115be988b381440df0f3c4e1c04426c61fb78
SSDEEP 196608:+h6WAZVGDmG21unzMuyfhSk8TeUhsjpz:q6cDmfyLyJS9
TLSH
T1F1760106E19786B8DF629B3985559333D6B07CC503B1C3C76B9C4D62ABA79F09ABC700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
renaissance.exe

File Explorer

renaissance.exe

.exe 7.3MB

renaissance.exe

IMPHASH 94d18a1fec4e899d4129a6216062975b
SHA256 48b9dce371b300e3353c8f304c1729758447cdf18b15ba07536be90a8e15c754
MD5 bfcef27f87b4bc1387cffb8fda75d088
SHA1 b325c5ee89e7a227525db4e79c66f85d6270d39b
SHA512 f8641d021eee08580c2f315d8989ad57ec76905291aa8a0b8b4e55d3bf99d496e781f91b025ddd2c9d0a4e1714d115be988b381440df0f3c4e1c04426c61fb78
SSDEEP 196608:+h6WAZVGDmG21unzMuyfhSk8TeUhsjpz:q6cDmfyLyJS9
TLSH
T1F1760106E19786B8DF629B3985559333D6B07CC503B1C3C76B9C4D62ABA79F09ABC700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1134928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea DwmUnregisterThumbnail DwmRegisterThumbnail DwmUpdateThumbnailProperties

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

RegQueryValueExW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegQueryValueExA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpSendRequest WinHttpConnect WinHttpOpen

kernel32

GetFileInformationByHandleEx SleepConditionVariableSRW GetCurrentThreadId LocalFree FormatMessageA GetLocaleInfoEx SetPriorityClass GetCurrentProcess WriteFile SetThreadPriority WaitForSingleObject OpenProcess Sleep GetTempPathA CreateFileA GetCurrentThread LoadLibraryA QueryPerformanceFrequency DeleteFileA CloseHandle GetProcAddress GetCurrentProcessId CreateProcessA QueryPerformanceCounter GetTickCount64 WriteProcessMemory InitializeSListHead VirtualFreeEx MultiByteToWideChar GlobalAlloc GlobalFree WakeAllConditionVariable WideCharToMultiByte GlobalUnlock FreeLibrary GetModuleHandleW VirtualProtectEx GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA FindClose FindFirstFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError AcquireSRWLockExclusive GetSystemTimeAsFileTime GetStartupInfoW GlobalLock SetUnhandledExceptionFilter ReleaseSRWLockExclusive ReadProcessMemory

user32

DestroyWindow SetForegroundWindow EnumDisplayMonitors UnregisterClassW RegisterClassExW ShowWindow IsWindow GetMonitorInfoW EnumDisplayDevicesW EnumDisplaySettingsW DefWindowProcW CreateWindowExW MapWindowPoints SetWindowDisplayAffinity MoveWindow SetLayeredWindowAttributes SetActiveWindow GetSystemMetrics GetKeyState GetMessageExtraInfo MonitorFromWindow CloseClipboard SetWindowLongW TranslateMessage ScreenToClient GetCapture ClientToScreen TrackMouseEvent LoadCursorW SetCapture SetCursor BringWindowToTop PeekMessageW OpenClipboard GetCursorPos SetCursorPos EmptyClipboard ReleaseCapture GetClipboardData SetClipboardData SetWindowPos GetAsyncKeyState IsWindowUnicode GetClientRect DispatchMessageW GetForegroundWindow

gdi32

GetStockObject

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Thrd_id _Thrd_join ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

winmm

timeBeginPeriod

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memset longjmp strrchr memmove memcmp memchr _CxxThrowException memcpy strstr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _beginthreadex abort _errno

api-ms-win-crt-stdio-l1-1-0

setvbuf __p__commode _set_fmode __stdio_common_vsprintf ungetc fsetpos fread _fseeki64 fgetpos fputc fflush fclose _get_stream_buffer_pointers ftell __acrt_iob_func __stdio_common_vsscanf _wfopen fgetc __stdio_common_vfprintf fseek fwrite

api-ms-win-crt-math-l1-1-0

acosf atan2f log roundf logf powf fmodf cosf sinf ceilf pow _dsign sqrtf __setusermatherr

api-ms-win-crt-convert-l1-1-0

atoi strtoll strtod strtoull strtol atof

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

tolower strlen wcslen strncpy strcmp strncmp _wcsicmp strcpy_s

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime _time64