AtNi[.]dll[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AtNi.dll.exe
Size 621KB
Sample221110-s3715achbl
SHA256 8c1d88db5b9f8e123deace0a90ce7cd8adc1d03a923eeb4cbda2a0406a1ece9d
MD5 9bdbf02aaaf65292441247688263ad0c
SHA1 7be1902670f67475fbbdc9128bbd0d77fc23668a
SHA512 e95dfd7195378cfd6647c8e3a3d30e17950ced3d55649d6456d4cb571815375763503fd97e9c9dfe210cf09793cb2dcd2be80c053d2ed78e074d0160e16b837a
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWiygQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XhZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

AtNi.dll.exe

.dll 621KB

AtNi.dll.exe

IMPHASH bf309f28e2e75a572eb2f2244be62b26
SHA256 8c1d88db5b9f8e123deace0a90ce7cd8adc1d03a923eeb4cbda2a0406a1ece9d
MD5 9bdbf02aaaf65292441247688263ad0c
SHA1 7be1902670f67475fbbdc9128bbd0d77fc23668a
SHA512 e95dfd7195378cfd6647c8e3a3d30e17950ced3d55649d6456d4cb571815375763503fd97e9c9dfe210cf09793cb2dcd2be80c053d2ed78e074d0160e16b837a
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWiygQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XhZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

11860

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA InvalidateRect GetMessageW DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW LoadStringW ShowWindow DispatchMessageW SetGestureConfig GetGestureInfo TranslateAcceleratorW TranslateMessage LoadCursorW PostQuitMessage UpdateWindow BeginPaint EndPaint CloseGestureInfoHandle ScreenToClient

gdi32

Polyline LineTo CreatePen MoveToEx DeleteObject SelectObject

ole32

CoLoadLibrary

crypt32

CryptStringToBinaryA

kernel32

GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers SetStdHandle HeapReAlloc GetFileSizeEx WriteConsoleW SetConsoleCtrlHandler GetFileType GetStdHandle GetProcessHeap EnumSystemLocalesW SetFilePointerEx ReadFile ReadConsoleW OutputDebugStringW CreateFileW HeapSize CloseHandle GetUserDefaultLCID IsValidLocale GetStringTypeW DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCurrentThread HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

ACeujVZMknFDjv AHuDGMflBfPryOEYjuTfbzJdEM ATjQPkInxPUGuUu AmbryhtjKWGeCnsRXR AukYzjkZpQjlyb BEHGKvjtYm BRUFxz BUZBRSzPLxRhY BZCzGXtURmWdIZoaE BZqjzJIejob BmZYhYQxzCQQ BubGPfVJvMw CBkyPEXjXbRUHKXJo CEsNfdgPgd CVPqxJEtookkvK CaJBhuFKGDiSQoojdQF CcKlmw CfrkXlNpYveSkH CtcUKaNM CtmIxtaSEWrJoeKFHYsQVRF DCcTBPjgUmKACiowmtURUFfgN DRpUgpG DYDsOtWxMUufQk DacmPRKwn DdBIgVVvJpDDYojhSveGWyVC DllRegisterServer EDkUTFetsWTlyEplV EZveIcVQbxXQvHAc EetKwkljiiO EiwSmYwuw EjKZnNkyirwOPcLJfvNShOHV ElumsVBNoiVQFecpcx FVCmCSsewcOgpmVCPhNN FeniiccJDJZQOquCQEDZFbp GhuZhUSaPqDNPQyLmKmMs GidoxoYzkYTZBUKjTczrNz GmOuZYJiGNspxqOxoBCu GoueteXAa HZyUwOgdhWiacaSFvYDsgUbdhh HtmqUvH HvKfMTiGc HwiGZdXrkhPSBdQhcNF IOKBBQdlpeQCrqGhE IftUczqAOEEpksLc IujIKjACwijLXf JPOlfklrHwimOYpdWU JldHyQJYHPfgwSota KHRcAfeWiWXczrzetcsf KSBSWsMPLKrvLpLuQEVBQaA KXPHHrx KqKYPtMNYPZwVVbFgnJskTDgXZ KrLeibTbke KtNQbfYVcdlRzCxJLbItSH KtZFnRWCN KyUDQzimOqrGaUdqnpHCadI LNVXKJhSBOeqiQPpxZuBrf LbOnTCPkjmOOEdhEeyEy LlFIOHcteRaL MAmiSwkyFlQMDaCByXR MHyRvOCLFO MbZnllsXkfnyOmtthLrL MbsuSbHtpeltWArBKaXuf MltZiwCXSxF NFzpzSbcGrv NXasCwwz NfwIIEvnLCKXIrpxWtDCbXx NgkonMKeLNPfNxT NlplQAUkkIZ OQruapyPUnukiDhEvANkgElZqh ORBMTIE OdtvuFxrrpfsY OoZePWcMAAdh PbgMOKpkqAeEgOBtpecKal PhHcvOzcWKVEzqGUAuH PqcNviu PxhniQgzegWvoSCaIPorRhqOEt PzcLCLdBlIdqBxBTbNiI RFSoSJnzzPHjPzvZCOvWT RSrAlLsSbnJmicoYtpKsPYkwFn ReujwDwTrVxLhVwaWvQS RqzpZDiLuFMWsJ SUemGjmeVuPs ScnrskpiicPdg SeCKWgTgmmtDUvFC SjnxUxHKGlth StNIEkqRHMtB StepECvENJONrwlynYAOx SyluAQQc SyvpWCmyZbMrEFnfTmyrBRH TLTUEROtrtYd TdNJCbJiInjtCOpp TndRvx TpEywJZSeYXzmbHgod TrziFVlHgMVVONOLNIfRem TzKueUFolaHBJPFhx UClTVsmfYtgzIL URuQMqrUPMSAGVyWQTqN UbLvGEZfkFcvnnw VXfdoDKAoHiAA VeRxloJdVvetDztDxLQT VkIbTCoknzceJuPcnCXzzPj VqNxpzS WPumZrRRafooNh WQIBBQj WUVuwTliAyCBAOHuSOD WsADtJekvYjSfChaZ XBRWcmDQWuUdmmFxx XDLVzSefOKneeAsytcH XDecZDvu XNmJlnrJjgZEjPQQeoOIT XWdPewUOSEaHKCHnynymDhLttF XmEMSisfXGvwdcnUI XxYbsglQgKXTYWUmlX YOqqPZdimbNEuvMaM YXgNyXKelZfQK YrlEvikMuwUvtjDbAASCV YrpQLSvKN YtyiKWITImQlOTP ZMAtbEQuVEpze ZOTjVFL ZXigMFrErZGCgnGQdpTo ZcqfXQvmSIhHXuDEPmA ZmNbZwqyJPRHpqmUZOmpJexK aOxloUcrMaTBrKRkXkvrKaAy aXDBQtKlOSCf azZsnWvbQULjBuaCVG bCHMpZKuNDwxXrs bFyNFHBUflbBAfRZV bGaVPXQawxz bVRtqQ bWXHfJrBjrdcVRLbuT blakCcJabYayatiII bsEGIgCVUNZeSRsr btMHyPMu bteqpXpGuaIzWJWPXQj buvNCuoglefZoipISdUp bvumZozkETqFchaDGgv cKgbFcy chPwzpRWTYf cliUpMkAyvnx cpEBzofbApJInexgeY cpNZFVzZSKe cpmbLfWGBjxaaZNR csebqY czlJGyv dOrUqBBEUz disvxAJjTCcpofcItH djhGwwWdNkNOGnSMVhO drTNkYg elaOoLpqFiyIbnyvaU fAKHjGkpTjHcAAfMvshh fBFgQesCsDDEqolwHzSbbSIs fDZRRfyfwlYoeFo fLcYUVhVDDHHRUryudAO fWkhxqQSpEMsqhItVIr fZQaoqMpByybzlfgG fadaIHaPgvjpA fodVsUcqiRZtLe fwWFiWowsdju gQiEYElmfk gexCIfMSOkWBVEs gnKyXNiVXhIQQVNkxutn hHoSVYFgUoRXoGwPBdTY hKiUTWNKTCBHARIejKtitX hTcXrfT hdpzQLMeXdHLAXI hqmMcxlMowrqdmwCD huwZDnzyRrUuSv hwwioGqcSiONSnnoqSgGGlYG hwxiWyDPZ iIMUBUcxlPgIoCou iXVpeLZjxHYfZy ickoyirauzuqSYooWRxIBKP ixEhmcgYbORYTvwI jXSCkxhrXSnIiziUsUkSa jhMrQlkZnbNzE jnmtHhyvcXOtUsFySuhzSRFwZ jqfPKICr kFVNBreOaZSGgseVYXfZAQSt kLMzjQJrPZFPf kONtiEAEi kUNUwtZ lIEZQCqZKko lZiHnzEuXoXZIzRd larnkUFYFI lfFBdv mJFTxuzjmKwZE mJPUafqK mRinbRZ miGqUGeEk muHYTksHDRccMJtbMIVY nEWvJUznqPuIORIkmbdcWjKd nXCjDafayJLQ nfPVFCecEC ntSsSyvUegFeD nttFqgw nuflNZYxVuFptSebTKUXxH oFyUMrjmgKtGCEsn oJhfaaiLZFHiBCXJlPO oPpitKCbVriCZu oTMlKNA pOQozXdpf pqXsDgFAKqxqyeZwyCjZ qhBjRUFjPgGnZCYf qnqswBvEbONoReovLIKnVYuSA qpggbjTvfN rGJIMlvpqBhxViL rUmobKc rfqEeKHAx rsgxCEvQpI rstbQmhTSxcrhUlcaxRFhGIXK rxpoWUmUrHlSIHeznkyrivE rzgTPjoxRh sFmMISJDeOoy sGzvLqVdsbQ sRyuPhAwDlOgUlGVpIfduYySp sTHzpfVYU sUKvQIa sVMFsGCCfvDfoTh sfAGqCcFJlYOMkqZahTjTiAX stMogsRXrfH tBAtJGzOlooKPbZ tTdsornziSGMnYRGtlv taVJVqMCMlkFIDWVCcDLV twRKUF uTtYPS ujLBGDEExK ujfIFiuxQFuoWpBYlfPja unVwakRZhbHEVJWGGZDyCZP utlgNYXohozxx uvBxDGCDNqLbDaufFb vycQUvI vzdSRyxeERBiXlOkqVUB wAHuFSGPWcgVtPzRzoUTnbwo wiIXJqSWsUXvPbq wjeHVSTrDxCzMVNUFEQoz xPjfyQjUovqeohLapv xeyyJZUMQlYiCHikxXoEko xmDlQKqSmhiJfARRXzslVED xzJluXH yAYxFjbdwTSooJJzoq yBpkXiNAKugdWlxIPQKL yIApLlDSJNmmOc yMokeHArDgIyDvmsuwd yVLTygbNjHTxXaOuZBkHmpajxq yhCymcBLApUWyPqapsEDJtfjMV yjGXMXnz yprPVXLUkdnzWv yzkENTmBV zQnFkEsglvSmYtKlkFDTme zdMhYw

Name

.text

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ