bot3[.]dll | Triage

Resubmissions

24-05-2023 19:53

230524-ymb7eafa8s 8

24-05-2023 19:52

230524-ylkgdsfa7x 3

24-05-2023 19:46

230524-ygzqhsef63 7

Sharing

Copy URL

Twitter E-mail

General

Target

bot3.dll
Size

3.3MB
MD5

e362ae83e78eeb6ab2e6fa885c4bf114
SHA1

c30b0261b6e741d960cd3fb552077efac9ee29b5
SHA256

ecac2400261d2962ba84f149b9104fb6a6955ccb35d4044a464de26c545b2bd5
SHA512

4d27f8cd937f2d919f311c3b039a66a95cead5bb5a2a19424ad3df5c9cd25193434ead5d4c54a4ea83168937401adaa8ad876e21567766bf6abd82c3a3e4be6c
SSDEEP

49152:vfqRHVwASOpGtlqpDIU6iu4NkZTg+cSwDjys6VUbf01OEe04oE4UWz53B8YVTVq4:n6M+qGD8HzNPDVEkXpiJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bot3.dll

Files

bot3.dll
.dll regsvr32 windows x64

Password: infected

2632cc2dde907dd5da51d0829faf8ce5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
CompareStringW
ConvertFiberToThread
ConvertThreadToFiber
CreateEventW
CreateFiber
CreateFileW
CreateRemoteThread
DeleteCriticalSection
DeleteFiber
EncodePointer
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTime
GetSystemTimeAsFileTime
GetTimeZoneInformation
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
RaiseException
ReadConsoleA
ReadConsoleW
ReadFile
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SwitchToFiber
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualAllocEx
VirtualFree
WTSGetActiveConsoleSessionId
WaitForMultipleObjects
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteProcessMemory

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear
VariantInit

Exports

Exports

?DllRegisterServer@@YAXPEAUHWND__@@PEAUHINSTANCE__@@PEADH@Z
?dllmain@@YAXPEAUHWND__@@PEAUHINSTANCE__@@PEADH@Z
CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersA
CryptEnumProvidersW
CryptExportKey
CryptGetHashParam
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashA
CryptSignHashW
DeregisterEventSource
DllRegisterServer
GetAddrInfoW
GetProcessWindowStation
GetUserObjectInformationA
GetUserObjectInformationW
MessageBoxA
MessageBoxW
RegisterEventSourceA
RegisterEventSourceW
ReportEventA
ReportEventW
SetUserObjectInformationA
SetUserObjectInformationW
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
dllmain
freeaddrinfo
getaddrinfo
gethostbyname
getnameinfo
getsockname
getsockopt
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
shutdown
socket

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 761KB - Virtual size: 761KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

2632cc2dde907dd5da51d0829faf8ce5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 761KB - Virtual size: 761KB

.data Size: 29KB - Virtual size: 117KB

.pdata Size: 113KB - Virtual size: 113KB

.00cfg Size: 512B - Virtual size: 56B

.gxfg Size: 10KB - Virtual size: 9KB

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1024B - Virtual size: 624B

.reloc Size: 33KB - Virtual size: 32KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 761KB - Virtual size: 761KB

.data
Size: 29KB - Virtual size: 117KB

.pdata
Size: 113KB - Virtual size: 113KB

.00cfg
Size: 512B - Virtual size: 56B

.gxfg
Size: 10KB - Virtual size: 9KB

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1024B - Virtual size: 624B

.reloc
Size: 33KB - Virtual size: 32KB