RobRunPort[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RobRunPort.exe
Size 1.6MB
Sample261113-b991maew5x
SHA256 c6f90747ad843acb77bf0c51046885e382f442457c586bc4b369eeed73a651a4
MD5 6d875f4f5df89abbf2bbfc48e9b6bd61
SHA1 5745b4fd78407c1393b2d126484ed12f3323d21b
SHA512 65cdd4971e9e898901f14ee0c68fc33d3f843d37e3b2876cb5d149348318572835de426e124d00fed3801ad47cf4bd91159326ca20d33be0fd802b1076fee4ab
SSDEEP 49152:6xa6MPeXjR+uIugJ4zRel/3khC/sRel/3khC/fnd:6ZMPeql/3Fl/3
TLSH
T1D685AE40A1E700ECE1B79074D4A76F1BE539B81487305AEB23A8052D6FF23D45AFB796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RobRunPort.exe

File Explorer

RobRunPort.exe

.exe 1.6MB

RobRunPort.exe

IMPHASH fb39b99ad8137b90f1bfc9a4620aea79
SHA256 c6f90747ad843acb77bf0c51046885e382f442457c586bc4b369eeed73a651a4
MD5 6d875f4f5df89abbf2bbfc48e9b6bd61
SHA1 5745b4fd78407c1393b2d126484ed12f3323d21b
SHA512 65cdd4971e9e898901f14ee0c68fc33d3f843d37e3b2876cb5d149348318572835de426e124d00fed3801ad47cf4bd91159326ca20d33be0fd802b1076fee4ab
SSDEEP 49152:6xa6MPeXjR+uIugJ4zRel/3khC/sRel/3khC/fnd:6ZMPeql/3Fl/3
TLSH
T1D685AE40A1E700ECE1B79074D4A76F1BE539B81487305AEB23A8052D6FF23D45AFB796
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

572368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcessId ExitProcess CreateThread GetCurrentThread GetSystemTimeAsFileTime GetTickCount VirtualAlloc VirtualFree GetModuleFileNameA GetModuleFileNameW GetModuleHandleW GetModuleHandleExA GetProcAddress LoadLibraryA MoveFileExW MultiByteToWideChar AllocConsole FreeConsole AttachConsole CreateToolhelp32Snapshot Thread32First Thread32Next SetEvent CreateEventA WaitForMultipleObjects CreateSemaphoreA CreateFileA WideCharToMultiByte ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SetLastError HeapAlloc HeapFree GetProcessHeap TerminateProcess GetTickCount64 GetFileAttributesW GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetLocaleInfoA CreateWaitableTimerW SetEndOfFile HeapReAlloc HeapSize CreateFileW GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW OutputDebugStringW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent WriteFile ReadFile WriteConsoleW GetModuleHandleExW RtlUnwind GetFileType GetStdHandle DeleteCriticalSection InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RtlLookupFunctionEntry RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentThreadId GetStartupInfoW GetCurrentProcess Sleep CreateWaitableTimerExW CreateMutexW SetWaitableTimer WaitForSingleObject LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError SetUnhandledExceptionFilter CloseHandle GetTempFileNameW DeleteFileA DeleteFileW CreateDirectoryW GetCurrentDirectoryW GetEnvironmentVariableW

user32

GetMessageA TranslateMessage DispatchMessageA PeekMessageA RegisterHotKey PostMessageA DefWindowProcA PostQuitMessage RegisterClassA ScreenToClient CreateWindowExA SetLayeredWindowAttributes SetWindowPos IsWindowVisible IsIconic GetAsyncKeyState SendInput SetTimer GetCursorPos SetCursor SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard MapVirtualKeyW GetKeyNameTextW PostMessageW SetWindowLongPtrW GetWindowLongPtrW ShowWindow RegisterRawInputDevices GetRawInputData LoadCursorA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetWindowThreadProcessId EnumWindows SetWindowLongA GetWindowLongA ClientToScreen MessageBoxA GetWindowRect GetClientRect InvalidateRect EndPaint BeginPaint GetForegroundWindow GetSystemMetrics

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

d3d11

D3D11CreateDevice

d2d1

ord1

dwrite

DWriteCreateFactory

dcomp

DCompositionCreateDevice

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeGetTime timeBeginPeriod

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

Name

.text

Size

741KB

Virtual Size

741KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

843KB

Virtual Size

843KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

28.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RobRunPort.exe

kernel32

user32

advapi32

d3d11

d2d1

dwrite

dcomp

d3dcompiler_47

dwmapi

winmm

imm32

generic