exposuel[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
exposuel.exe
Size 446KB
Sample261113-nctzcsty3j
SHA256 4217417fbef14e30f6b02380b71526181e04cc4afa99959378daab1c4ca4fde1
MD5 3c3fb7f8a3bb49125ea1b5f7376b270e
SHA1 86cc36aa338bc101503c8ff80449c0c559028ba4
SHA512 3c0354dab4498b8271b7b504746c3505a2584c9e633f15ebb6eed88e8be6a50b5e605f9938d6f06f0b7e23bcd220915d025753b2e5eac19261b75789414f6a8c
SSDEEP 6144:5dbO03eCxDC2qxoFma+vJ0T/8WKEgKmi9oNW/2tqnsIiD+QZ00B3csF17gTwr2SM:5dbAwmaCS/2tHW5kep
TLSH
T12AA4091636A89DDADC22613C91CFA30D6675BCF007A396C7832112629E47BE8DD7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
exposuel.exe

File Explorer

exposuel.exe

.exe 446KB

exposuel.exe

IMPHASH 2c7a8afbd3aa0949c18306a00afe7b1f
SHA256 4217417fbef14e30f6b02380b71526181e04cc4afa99959378daab1c4ca4fde1
MD5 3c3fb7f8a3bb49125ea1b5f7376b270e
SHA1 86cc36aa338bc101503c8ff80449c0c559028ba4
SHA512 3c0354dab4498b8271b7b504746c3505a2584c9e633f15ebb6eed88e8be6a50b5e605f9938d6f06f0b7e23bcd220915d025753b2e5eac19261b75789414f6a8c
SSDEEP 6144:5dbO03eCxDC2qxoFma+vJ0T/8WKEgKmi9oNW/2tqnsIiD+QZ00B3csF17gTwr2SM:5dbAwmaCS/2tHW5kep
TLSH
T12AA4091636A89DDADC22613C91CFA30D6675BCF007A396C7832112629E47BE8DD7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ChangeServiceConfig2A CloseServiceHandle CreateProcessAsUserA CreateServiceA OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExA RegSetValueExA RegisterServiceCtrlHandlerExA SetServiceStatus StartServiceA StartServiceCtrlDispatcherA

user32

BeginPaint CallNextHookEx CreateCaret CreateWindowExA DefWindowProcW DestroyWindow DispatchMessageA DrawTextA DrawTextW EndPaint FillRect FindWindowA GetAsyncKeyState GetClientRect GetDC GetMessageA GetSystemMetrics HideCaret InvalidateRect OpenInputDesktop RegisterClassA ReleaseDC SendMessageA SetForegroundWindow SetThreadDesktop SetTimer SetWindowsHookExA ShowCaret ShowWindow TranslateMessage UnhookWindowsHookEx UnregisterClassA UpdateWindow

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject GetStockObject Rectangle SelectObject SetBkColor SetBkMode SetTextColor

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove strrchr strstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf fclose fflush fopen fputc fputs fread fseek ftell fwrite

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-string-l1-1-0

_strdup memset strcmp strlen strncmp wcscmp

api-ms-win-crt-utility-l1-1-0

rand srand

kernel32

AcquireSRWLockExclusive Beep CloseHandle CopyFileA CreateMutexA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection FindClose FindFirstFileA FindNextFileA FlsAlloc FlsGetValue FlsSetValue GetCommandLineA GetComputerNameA GetCurrentThreadId GetDriveTypeA GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetThreadId GetTickCount InitOnceExecuteOnce InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection MoveFileExA MultiByteToWideChar Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFileAttributesA SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WinExec lstrcmpiA

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

Name

.text

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

exposuel.exe

advapi32

user32

gdi32

wtsapi32

userenv

winhttp

bcrypt

gdiplus

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic