updater[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
updater.exe
Size 13.1MB
Sample261107-ydewyafv2m
SHA256 05c543ca62f66d05616e2446b2560c0d6e5c3c632c27c4f28cbfa08a228c4c99
MD5 b89d945bf9caec92c8ad2430c743cf69
SHA1 67b37b9540b11a18908f29c8fc4734f625072fd7
SHA512 11321b0ca478948976aa19cfe200e9db5b50b83355530a7bb8bf117c5d7d44ffc3c14020c2c52dd2fcd345aa8c027459fe5ecc77923acfca55d0b943a59d5501
SSDEEP 393216:X+FSlqU04EBEc/yWUwVnz/PgDx/mIvRUjUgue81:X+FSlKXZhDPgDx/Fpvj
TLSH
T175D6BE8FB3A141F8D007EBB0951736F7A0E9BF991C1166A72344F1687938BEC47B6690
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
updater.exe

File Explorer

updater.exe

.exe 13.1MB

updater.exe

IMPHASH a4d7a788b9bbd6bb8d78d8567af39c98
SHA256 05c543ca62f66d05616e2446b2560c0d6e5c3c632c27c4f28cbfa08a228c4c99
MD5 b89d945bf9caec92c8ad2430c743cf69
SHA1 67b37b9540b11a18908f29c8fc4734f625072fd7
SHA512 11321b0ca478948976aa19cfe200e9db5b50b83355530a7bb8bf117c5d7d44ffc3c14020c2c52dd2fcd345aa8c027459fe5ecc77923acfca55d0b943a59d5501
SSDEEP 393216:X+FSlqU04EBEc/yWUwVnz/PgDx/mIvRUjUgue81:X+FSlKXZhDPgDx/Fpvj
TLSH
T175D6BE8FB3A141F8D007EBB0951736F7A0E9BF991C1166A72344F1687938BEC47B6690
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8654074

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptDestroyKey BCryptFinishHash BCryptGenRandom BCryptHash BCryptHashData BCryptOpenAlgorithmProvider BCryptVerifySignature

comctl32

DefSubclassProc GetWindowSubclass InitCommonControlsEx RemoveWindowSubclass SetWindowSubclass

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringA CertOpenStore CryptDecodeObjectEx CryptImportPublicKeyInfoEx2 CryptProtectData CryptQueryObject CryptStringToBinaryA CryptUnprotectData PFXImportCertStore

dwmapi

DwmSetWindowAttribute

dwrite

DWriteCreateFactory

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontW CreateSolidBrush DeleteDC DeleteObject GetObjectW GetStockObject GetTextColor GetTextExtentPoint32W GetTextMetricsW IntersectClipRect RestoreDC SaveDC SelectObject SetBkColor SetBkMode SetDCBrushColor SetTextColor SetViewportOrgEx

gdiplus

GdipAddPathArc GdipAlloc GdipCloneBrush GdipClosePathFigure GdipCreateFromHDC GdipCreatePath GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDrawArc GdipDrawEllipse GdipDrawLines GdipDrawPath GdipFillPath GdipFree GdipSetPenEndCap GdipSetPenLineJoin GdipSetPenStartCap GdipSetSmoothingMode GdiplusShutdown GdiplusStartup

iphlpapi

if_nametoindex

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringOrdinal CopyFileW CreateEventA CreateEventW CreateFileA CreateFileW CreateHardLinkW CreateMutexW CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FileTimeToSystemTime FindFirstFileA FlushFileBuffers FormatMessageA FreeLibrary GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableA GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessTimes GetStartupInfoW GetSystemFirmwareTable GetSystemInfo GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx IsProcessorFeaturePresent K32GetProcessMemoryInfo LeaveCriticalSection LoadLibraryExW LocalFree MoveFileExA MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetDefaultDllDirectories SetEvent SetFileInformationByHandle SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableCS SleepEx SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeConditionVariable WideCharToMultiByte WriteFile __C_specific_handler lstrlenW

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs mbstowcs_s strtol strtoll strtoul strtoull wcrtomb wcstombs_s

api-ms-win-crt-environment-l1-1-0

__p__wenviron _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _fstat64 _fstat64 _fullpath _mkdir _stat64 _unlink _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen _fdopen floor lroundf

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _assert _beginthreadex _cexit _configure_wide_argv _crt_atexit _endthreadex _errno _exit _get_errno _set_app_type _initialize_wide_environment _initterm _initterm_e _register_thread_local_exe_atexit_callback _set_errno _set_invalid_parameter_handler abort exit signal strerror strerror_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf_s _chsize_s _close _fileno _fileno _fseeki64 _fseeki64 _fsopen _ftelli64 _get_osfhandle _lseeki64 _read _setmode _sopen_s _wfopen _wopen _write fclose feof ferror fflush fgets fopen fputc fputs fread freopen_s fseek ftell fwrite getc getwc putc putwc setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_strdup _strdup _wcsicmp iswctype memset strcmp strcoll strcspn strlen strncmp strncpy_s strnlen strpbrk strspn strxfrm tolower toupper towlower towupper wcscat wcscmp wcscoll wcscpy wcscpy_s wcslen wcsncmp wcsncpy_s wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 _wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

bsearch qsort rand_s

ncrypt

NCryptCreatePersistedKey NCryptDeleteKey NCryptExportKey NCryptFinalizeKey NCryptFreeObject NCryptOpenKey NCryptOpenStorageProvider NCryptSetProperty NCryptSignHash

ole32

CoTaskMemFree OleInitialize OleUninitialize

secur32

InitSecurityInterfaceA

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW

user32

AdjustWindowRectExForDpi BeginPaint CharLowerBuffW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawTextW EnableWindow EndPaint FillRect GetClientRect GetDC GetDlgCtrlID GetDpiForSystem GetDpiForWindow GetFocus GetMessageW GetParent GetSystemMetrics GetWindowLongPtrW GetWindowTextLengthW GetWindowTextW InflateRect InvalidateRect IsChild IsDialogMessageW IsIconic IsWindow IsWindowEnabled IsWindowVisible KillTimer LoadCursorW MessageBoxA MessageBoxW MoveWindow PostQuitMessage PtInRect RedrawWindow RegisterClassExW ReleaseDC SendMessageW SetCursor SetFocus SetForegroundWindow SetProcessDpiAwarenessContext SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UpdateWindow

uxtheme

SetWindowTheme

ws2_32

FreeAddrInfoExW GetAddrInfoExW WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAPoll WSAResetEvent WSASetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket ntohs recv select send setsockopt socket

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

190KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ZJLQO

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ovsbw

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.oE22P

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

updater.exe

advapi32

bcrypt

comctl32

crypt32

dwmapi

dwrite

gdi32

gdiplus

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ncrypt

ole32

secur32

shell32

user32

uxtheme

ws2_32

generic