AutoUpdater[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AutoUpdater.exe
Size 4.3MB
Sample261110-qwsazsys6q
SHA256 4e22ba8c4b860ecf98fb32b64f89a0dad37ce9e2ad1d1c6f06dfb93c238c9a46
MD5 50e50b0f8846017ff08505759a276f22
SHA1 d6af77fed081d250b8685ce963588a93340cd7bb
SHA512 996dbfa4b17bb5d93db6d71e31375eb2d15ed32b5b66e634dd0960bbd9553b48d9781f46322f2e854c4bba9fcff75505dd5824ecb3e1139ce88543c479e37c41
SSDEEP 49152:mInSEN2yIG8KkEI1Sa2PFQcrDImzr05HfYv8cB2iKeRpz6iar9FsEkLS2OgrT:xDr6rY0w2itptaZFh+r
TLSH
T1C426BE03F39686F8D53E937485B74607E736B9025B215BCB1A90A62D6F13BF15E3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AutoUpdater.exe

File Explorer

AutoUpdater.exe

.exe 4.3MB

AutoUpdater.exe

IMPHASH f78cf1d66a585db39629a78a8e95df88
SHA256 4e22ba8c4b860ecf98fb32b64f89a0dad37ce9e2ad1d1c6f06dfb93c238c9a46
MD5 50e50b0f8846017ff08505759a276f22
SHA1 d6af77fed081d250b8685ce963588a93340cd7bb
SHA512 996dbfa4b17bb5d93db6d71e31375eb2d15ed32b5b66e634dd0960bbd9553b48d9781f46322f2e854c4bba9fcff75505dd5824ecb3e1139ce88543c479e37c41
SSDEEP 49152:mInSEN2yIG8KkEI1Sa2PFQcrDImzr05HfYv8cB2iKeRpz6iar9FsEkLS2OgrT:xDr6rY0w2itptaZFh+r
TLSH
T1C426BE03F39686F8D53E937485B74607E736B9025B215BCB1A90A62D6F13BF15E3A320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1623264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

dcomp

DCompositionCreateDevice

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmAssociateContext ImmAssociateContextEx

crypt32

CryptUnprotectData CryptProtectData

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize CoTaskMemAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

CreateThread ExitThread CreateProcessW ExitProcess GetCurrentProcessId TerminateProcess GetCurrentProcess GetStartupInfoW GetCurrentThreadId

api-ms-win-ntuser-sysparams-l1-1-0

GetMonitorInfoW SystemParametersInfoW

api-ms-win-core-errorhandling-l1-1-0

SetLastError RaiseException SetUnhandledExceptionFilter GetLastError UnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

GlobalFree LocalFree GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

api-ms-win-core-memory-l1-1-1

VirtualUnlock VirtualLock

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW SizeofResource GetModuleFileNameW GetModuleHandleExW LoadResource FreeLibraryAndExitThread LockResource FreeLibrary GetProcAddress LoadLibraryExW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW FreeEnvironmentStringsW GetCommandLineA GetEnvironmentStringsW GetStdHandle SetStdHandle GetCommandLineW SetEnvironmentVariableW

api-ms-win-core-file-l1-1-0

CreateFileA CreateDirectoryW GetFileType SetFileInformationByHandle WriteFile DeleteFileW FindFirstFileW SetFilePointerEx FindFirstFileExW FindNextFileW SetEndOfFile FindClose CreateFileW GetFileSize ReadFile GetFileAttributesExW FlushFileBuffers GetFileSizeEx

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar GetStringTypeW CompareStringW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection AcquireSRWLockExclusive InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection ReleaseSRWLockExclusive InitializeCriticalSection

api-ms-win-core-memory-l1-1-0

VirtualProtect MapViewOfFile UnmapViewOfFile

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA

api-ms-win-core-heap-l1-1-0

HeapFree HeapSize HeapReAlloc HeapAlloc GetProcessHeap

urlmon

URLDownloadToFileW

user32

ReleaseCapture SetCapture GetCapture EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos SetLayeredWindowAttributes ShowWindow SetForegroundWindow CreateWindowExW RegisterClassExW DefWindowProcW TrackMouseEvent MsgWaitForMultipleObjectsEx PeekMessageW DispatchMessageW TranslateMessage IsClipboardFormatAvailable EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard PostQuitMessage MessageBoxW GetWindowLongPtrW SetWindowLongPtrW LoadCursorW MonitorFromPoint MonitorFromWindow PostThreadMessageW GetKeyState SetWindowRgn GetWindowRect SetCursor GetCursorPos DestroyWindow ScreenToClient

gdi32

DeleteObject CreateRoundRectRgn

shell32

SHGetKnownFolderPath

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW LCMapStringW FormatMessageA GetLocaleInfoEx IsValidLocale GetUserDefaultLCID GetCPInfo IsValidCodePage GetACP EnumSystemLocalesW LCMapStringEx GetOEMCP

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable Sleep

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlVirtualUnwind RtlUnwind RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsFree FlsAlloc FlsGetValue

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleMode GetConsoleOutputCP ReadConsoleW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

833KB

Virtual Size

833KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AutoUpdater.exe

d3d11

dxgi

dcomp

api-ms-win-shcore-scaling-l1-1-1

imm32

crypt32

api-ms-win-core-com-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l2-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-heap-l1-1-0

urlmon

user32

gdi32

shell32

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-console-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic