claudemeter[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
claudemeter.exe
Size 4.2MB
Sample261113-kstrrasw8q
SHA256 36efd89fa1cebbe46140983325624c65d2ee1ec7b2e55ce10c9b6a61d91343cc
MD5 bd503de004283f9a210f4ef5ed71361d
SHA1 442b8f31e3e2ed3cd1c168efc11def0766213f29
SHA512 c41ad8761e997bfe1aa1c7962f16a7de2316eba8947d2c44bf5239173d5fbcff2c5c204bf36e2056385403105890d5cd3114ccd4c14a757aa2519a29946a6d5b
SSDEEP 49152:zQjCSpKdu3G2i994o1p00B4yiGzVNrev3OwUZXCr6VDgLyJ/j5yjxLN54zUqZ9uN:zQ319CyfW7IlDR4AOSn+Jp
TLSH
T1CF168E03F6A440E9C46EC538C726A233FB32BC9D5960B6AF2BD04A212F66F615F1D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
claudemeter.exe

File Explorer

claudemeter.exe

.exe 4.2MB

claudemeter.exe

IMPHASH acaf5fa430f5e3b7fa9163c030d84716
SHA256 36efd89fa1cebbe46140983325624c65d2ee1ec7b2e55ce10c9b6a61d91343cc
MD5 bd503de004283f9a210f4ef5ed71361d
SHA1 442b8f31e3e2ed3cd1c168efc11def0766213f29
SHA512 c41ad8761e997bfe1aa1c7962f16a7de2316eba8947d2c44bf5239173d5fbcff2c5c204bf36e2056385403105890d5cd3114ccd4c14a757aa2519a29946a6d5b
SSDEEP 49152:zQjCSpKdu3G2i994o1p00B4yiGzVNrev3OwUZXCr6VDgLyJ/j5yjxLN54zUqZ9uN:zQ319CyfW7IlDR4AOSn+Jp
TLSH
T1CF168E03F6A440E9C46EC538C726A233FB32BC9D5960B6AF2BD04A212F66F615F1D715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3031472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

claudemeter.pdb

kernel32

SleepEx FlsSetValue IsThreadAFiber FlsFree FlsAlloc GetProcessHeap HeapFree ReadFileEx WriteConsoleW GetConsoleOutputCP ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx GetCurrentThreadId CreateFileW GetExitCodeProcess CancelIoEx GetModuleHandleW WriteFile SetFileCompletionNotificationModes GetFullPathNameW GetUserDefaultUILanguage CreateIoCompletionPort SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetOverlappedResult CreateProcessW ReadFile PostQueuedCompletionStatus WriteFileEx GetFinalPathNameByHandleW SetLastError SwitchToThread SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode GetTickCount GetCurrentThread SetThreadStackGuarantee FindNextFileW FindFirstFileExW SetFilePointerEx CreateMutexW SetProcessWorkingSetSize GetCurrentProcess FindNextChangeNotification FindFirstChangeNotificationW GlobalAlloc GlobalLock GlobalUnlock WaitForSingleObject InitializeSListHead SetFileInformationByHandle GetLastError SystemTimeToFileTime CloseHandle DeleteFileW GetTimeZoneInformationForYear FindClose SetHandleInformation GetFileAttributesW GetQueuedCompletionStatusEx DuplicateHandle CreateWaitableTimerExW SetWaitableTimer Sleep DeleteCriticalSection TryEnterCriticalSection CreateThread LeaveCriticalSection GetFileType EnterCriticalSection InitializeCriticalSection AddVectoredExceptionHandler HeapReAlloc GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry LoadLibraryA GetProcAddress lstrlenW WideCharToMultiByte RtlVirtualUnwind FormatMessageW MultiByteToWideChar GetModuleHandleExW HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetModuleHandleA GetSystemTimePreciseAsFileTime CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW LoadLibraryExA RaiseException FlushFileBuffers MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact LoadLibraryW GetSystemInfo DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtDeviceIoControlFile NtReadFile NtCreateFile NtWriteFile NtOpenFile NtCancelIoFileEx RtlNtStatusToDosError NtCreateNamedPipeFile

ws2_32

freeaddrinfo setsockopt bind getsockopt connect ioctlsocket WSASocketW WSAStartup recv WSAIoctl send shutdown WSASend getsockname WSAGetLastError getpeername closesocket getaddrinfo

oleaut32

GetErrorInfo SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

RegSetValueExW CredReadW CredFree RegDeleteValueW RegOpenKeyExW RegCloseKey SystemFunction036 RegQueryValueExW

shell32

Shell_NotifyIconW SHQueryUserNotificationState

iphlpapi

NotifyIpInterfaceChange

user32

EmptyClipboard OpenClipboard MessageBeep EndPaint ClientToScreen SetCursor BeginPaint TrackMouseEvent TrackPopupMenu GetCursorPos DefWindowProcW GetLastInputInfo PostQuitMessage MoveWindow SystemParametersInfoW SetTimer SetForegroundWindow SetWindowPos ShowWindow SetWindowLongW GetWindowLongW SetClipboardData GetDC GetSystemMetrics InvalidateRect RegisterClassExW KillTimer SetLayeredWindowAttributes CreateWindowExW GetClientRect PostMessageW LoadCursorW DestroyMenu DestroyIcon AppendMenuW CloseClipboard MessageBoxW CreateIconIndirect SendMessageW PeekMessageW TranslateMessage CreatePopupMenu FillRect LoadImageW DrawTextW ReleaseDC DispatchMessageW LoadIconW

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

gdi32

SelectObject CreateFontW SetBkMode SetTextColor TextOutW GetDeviceCaps DeleteObject DeleteDC CreateCompatibleDC CreateDIBSection CreateSolidBrush

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

vcruntime140

memchr strchr memcpy __C_specific_handler __current_exception __current_exception_context memcmp __CxxFrameHandler3 memmove memset strrchr

api-ms-win-crt-math-l1-1-0

log atan2 fabs __setusermatherr pow round sinf cosf _dclass

api-ms-win-crt-string-l1-1-0

strncmp strlen wcslen strspn strcspn strcmp

api-ms-win-crt-heap-l1-1-0

realloc free _set_new_mode _msize malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

terminate _c_exit _register_onexit_function _register_thread_local_exe_atexit_callback _initialize_onexit_table _exit _get_initial_narrow_environment _beginthreadex _endthreadex _seh_filter_exe _set_app_type _initterm _crt_atexit _configure_narrow_argv _initialize_narrow_environment _cexit _initterm_e __p___argv __p___argc exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale