chaser[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
chaser.exe
Size 31.1MB
Sample261110-qs53nstycx
SHA256 8bdaa4e0f41641574b38196c2f5a56c4e2b7b9f3149be8180d2756764495a128
MD5 8565e6a33f65a6802837b1c8a0e8f9d0
SHA1 6e94d47bb9f373f123a0b6a03843fbf6a7fc9232
SHA512 cb615cfb8e12a32f3eedb10f89b97c1e4be57da9113d149141f7aed499244b6e29916107a87d76738979556c01b6e3fadd2073efdb40ab23e98d495cf7d11143
SSDEEP 786432:kttHkv6MPfFTxMjyqtMtMWh3dYUd6w7gZHYxzv:kngPfFTqJtMtMWOdHYxz
TLSH
T1DE67235365D4B7B4C0C34230919F478B61D0A13E85FA890D3BDB6C02AE35F576A8E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chaser.exe

File Explorer

chaser.exe

.exe 31.1MB

chaser.exe

IMPHASH 0215ad6a26c9330dffc7a6ed6e7d9eee
SHA256 8bdaa4e0f41641574b38196c2f5a56c4e2b7b9f3149be8180d2756764495a128
MD5 8565e6a33f65a6802837b1c8a0e8f9d0
SHA1 6e94d47bb9f373f123a0b6a03843fbf6a7fc9232
SHA512 cb615cfb8e12a32f3eedb10f89b97c1e4be57da9113d149141f7aed499244b6e29916107a87d76738979556c01b6e3fadd2073efdb40ab23e98d495cf7d11143
SSDEEP 786432:kttHkv6MPfFTxMjyqtMtMWh3dYUd6w7gZHYxzv:kngPfFTqJtMtMWOdHYxz
TLSH
T1DE67235365D4B7B4C0C34230919F478B61D0A13E85FA890D3BDB6C02AE35F576A8E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44781633

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteW

advapi32

GetUserNameW

comdlg32

GetOpenFileNameW

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod

winhttp

WinHttpQueryHeaders

ole32

StringFromGUID2

oleaut32

SysFreeString

ntdll

NtQueryInformationProcess

xinput1_4

ord2

dinput8

DirectInput8Create

cabinet

ord43

dbghelp

MiniDumpWriteDump

urlmon

URLDownloadToFileA

kernel32

SetFileInformationByHandle

user32

GetKeyboardLayout

msvcp140

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z

msvcp140_atomic_wait

__std_atomic_notify_all_direct

winusb

WinUsb_Free

setupapi

SetupDiDestroyDeviceInfoList

imm32

ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

ncrypt

NCryptDeleteKey

wintrust

WTHelperProvDataFromStateData

vcruntime140

strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_beginthreadex

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-stdio-l1-1-0

fclose

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-math-l1-1-0

roundf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_gmtime64_s

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-environment-l1-1-0

getenv

crypt32

CertFreeCertificateChain

ws2_32

setsockopt

Name

.text

Size

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.evr_ssc

Size

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sscx1

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.uzo

Size

Virtual Size

17.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.kmP

Size

660KB

Virtual Size

659KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.[nc

Size

30.4MB

Virtual Size

30.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

chaser.exe

shell32

advapi32

comdlg32

d3d11

dwmapi

winmm

winhttp

ole32

oleaut32

ntdll

xinput1_4

dinput8

cabinet

dbghelp

urlmon

kernel32

user32

msvcp140

msvcp140_atomic_wait

winusb

setupapi

imm32

d3dcompiler_47

ncrypt

wintrust

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

crypt32

ws2_32

generic