wertok[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wertok.exe
Size 446KB
Sample261113-nd46qaax4x
SHA256 bf70342647283165977c0280dddd76a7538c152e7c01a8cb1f38f84f71c92e5c
MD5 826c0de6e1278abf49d50c909e34919f
SHA1 ce354e39fd56ca76de4b47a834e255d57127dbec
SHA512 fd1041a483687d01f333c5ddc45bcc58815f851d96dd0f65dfbda1c227fa43001f55a5739e8fa2dae7e74f824c7b7c1ebfb69208011f30dc4d1df73c1560854f
SSDEEP 6144:vwUee3esx3iG3BIFGa30J0T/8WqVgKmi9oNW/2Nqn8IiDeQZ00h3csF177Twr2Sn:vwUeOgGaE+fRVvMiW5kep
TLSH
T1B5A4E71636A89DDADC22613C91CFA31D6635BCF003A396C7932112629E47BE89D7FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wertok.exe

File Explorer

wertok.exe

.exe 446KB

wertok.exe

IMPHASH 2c7a8afbd3aa0949c18306a00afe7b1f
SHA256 bf70342647283165977c0280dddd76a7538c152e7c01a8cb1f38f84f71c92e5c
MD5 826c0de6e1278abf49d50c909e34919f
SHA1 ce354e39fd56ca76de4b47a834e255d57127dbec
SHA512 fd1041a483687d01f333c5ddc45bcc58815f851d96dd0f65dfbda1c227fa43001f55a5739e8fa2dae7e74f824c7b7c1ebfb69208011f30dc4d1df73c1560854f
SSDEEP 6144:vwUee3esx3iG3BIFGa30J0T/8WqVgKmi9oNW/2Nqn8IiDeQZ00h3csF177Twr2Sn:vwUeOgGaE+fRVvMiW5kep
TLSH
T1B5A4E71636A89DDADC22613C91CFA31D6635BCF003A396C7932112629E47BE89D7FF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ChangeServiceConfig2A CloseServiceHandle CreateProcessAsUserA CreateServiceA OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExA RegSetValueExA RegisterServiceCtrlHandlerExA SetServiceStatus StartServiceA StartServiceCtrlDispatcherA

user32

BeginPaint CallNextHookEx CreateCaret CreateWindowExA DefWindowProcW DestroyWindow DispatchMessageA DrawTextA DrawTextW EndPaint FillRect FindWindowA GetAsyncKeyState GetClientRect GetDC GetMessageA GetSystemMetrics HideCaret InvalidateRect OpenInputDesktop RegisterClassA ReleaseDC SendMessageA SetForegroundWindow SetThreadDesktop SetTimer SetWindowsHookExA ShowCaret ShowWindow TranslateMessage UnhookWindowsHookEx UnregisterClassA UpdateWindow

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject GetStockObject Rectangle SelectObject SetBkColor SetBkMode SetTextColor

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove strrchr strstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf fclose fflush fopen fputc fputs fread fseek ftell fwrite

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-string-l1-1-0

_strdup memset strcmp strlen strncmp wcscmp

api-ms-win-crt-utility-l1-1-0

rand srand

kernel32

AcquireSRWLockExclusive Beep CloseHandle CopyFileA CreateMutexA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection FindClose FindFirstFileA FindNextFileA FlsAlloc FlsGetValue FlsSetValue GetCommandLineA GetComputerNameA GetCurrentThreadId GetDriveTypeA GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetThreadId GetTickCount InitOnceExecuteOnce InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection MoveFileExA MultiByteToWideChar Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFileAttributesA SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WinExec lstrcmpiA

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

Name

.text

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wertok.exe

advapi32

user32

gdi32

wtsapi32

userenv

winhttp

bcrypt

gdiplus

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic