dns[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dns.exe
Size

1.7MB
MD5

a3bf28d83fdc72bfb513f7e672c48981
SHA1

d7ab3b754270c3179ef9f982ce940d4f1ecb7163
SHA256

128dac306016577f44847e257a4349fb023f5ded93f71e03fb67cc322663877f
SHA512

dd03fbe6b95d379cd10f090e164767b8815a5609a4bc28843c23cc549eb042821059479777d265700553230273eb029dec261408bdd6bf56c57ab392a3121078
SSDEEP

49152:u7mZ9k0wCRp0Ca5PsYXKIy0BK+CVskxc/cgH5hz/HBa:nACRp0Ca5PsYXPy0BfC+Uihz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dns.exe

Files

dns.exe
.exe windows:6 windows x64

03dd29db44c4b7867ba99b31af7df69a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
__C_specific_handler
_vsnwprintf
__setusermatherr
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
abort
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
islower
calloc
__crtLCMapStringA
___lc_codepage_func
___lc_handle_func
isupper
__pctype_func
_wfsopen
fseek
setlocale
malloc
memcpy
__CxxFrameHandler3
_CxxThrowException
strerror
swscanf_s
fclose
??1type_info@@UEAA@XZ
fwrite
memcpy_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??3@YAXPEAX@Z
_purecall
??_V@YAXPEAX@Z
memset
?terminate@@YAXXZ
strcmp
setvbuf
fsetpos
fgetc
fflush
_fseeki64
memchr
fgetpos
ungetc
free
fputc
strncmp
tolower
sscanf_s
strncpy_s
_time32
strnlen
strtoul
strcpy_s
wcsrchr
_wgetenv
wcsnlen
_itow_s
_ultow
atoi
wcsstr
_wcsnicmp
time
wcstol
_wtoi
_wcsicmp
_itow
wcschr
wcsncmp
ctime
isprint
_strlwr
_vsnprintf
_strnicmp
memcmp
ldiv
swprintf_s
isdigit
srand
rand
sprintf_s
localeconv
strcspn
memmove_s
qsort
_strupr_s
wcstoul
strtol
__uncaught_exception
___mb_cur_max_func
_errno
__crtLCMapStringW
strtok
strstr
strtok_s
strchr
memmove
_stricmp
_initterm
wcscmp

dsrole

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

api-ms-win-core-registry-l1-1-0

RegDeleteValueA
RegSetValueExA
RegDeleteTreeW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExA

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetComputerNameExW
GetSystemTime
GetLocalTime
GetTickCount
GetSystemInfo
GetTickCount64

api-ms-win-core-processthreads-l1-1-2

ExitThread
OpenProcessToken
GetCurrentThread
GetCurrentProcess
CreateThread
TerminateProcess
OpenThreadToken
GetCurrentThreadId
GetCurrentProcessId
ExitProcess

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

dnsapi

DnsFree
DnsQuery_UTF8
Dns_WriteDottedNameToPacket
Dns_ReadRecordStructureFromPacket
DnsIsNSECType
DnsValidateName_W
GetCurrentTimeInSeconds
DnsRecordListUnmapV4MappedAAAAInPlace
DnsRecordStringForType
DnsRecordStringForWritableType
DnsUnicodeToUtf8
Dns_SkipPacketName
DnsIsAMailboxType
DnsReplaceRecordSetUTF8
DnsUtf8ToUnicode
Dns_ReadPacketNameAllocate
Dns_SetRecordDatalength
Dns_ParsePacketRecord
DnsRecordTypeForName
DnsApiFree
DnsStringCopyAllocateEx
Dns_WriteRecordStructureToPacketEx
Dns_SkipToRecord

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
InitializeCriticalSection
WaitForSingleObject
Sleep
LeaveCriticalSection
DeleteCriticalSection
WaitForMultipleObjectsEx
OpenEventW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-file-l2-1-1

MoveFileExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
LoadStringW

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

ws2_32

WSASocketW
WSAIoctl
WSAStartup
setsockopt
WSAGetLastError
select
sendto
send
bind
ioctlsocket
getsockname
listen
WSACleanup
getservbyport
getservbyname
getprotobynumber
getsockopt
closesocket
WSASetLastError
recvfrom
__WSAFDIsSet
accept
htons
inet_ntoa
FreeAddrInfoW
htonl
recv
ntohl
ntohs
connect
WSARecvFrom
GetAddrInfoW
GetNameInfoW
shutdown
inet_addr
getprotobyname
socket

api-ms-win-core-file-l1-2-1

GetDiskFreeSpaceExW
DeleteFileW
GetFullPathNameW
WriteFile
CreateFileW
GetFileAttributesW
CreateDirectoryW
CompareFileTime

api-ms-win-service-core-l1-1-1

StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-winsvc-l1-2-0

OpenServiceA
ChangeServiceConfigA
OpenSCManagerA
RegisterServiceCtrlHandlerW
ControlService
QueryServiceStatus
QueryServiceConfigA

logoncli

DsGetDcCloseW
DsGetDcNextW
DsGetSiteNameW
DsGetDcOpenW
DsGetDcNameW
DsGetDcNameA

wldap32

ord152
ord62
ord133
ord97
ord145
ord14
ord88
ord73
ord13
ord224
ord206
ord170
ord118
ord26
ord12
ord191
ord27
ord135
ord140
ord147
ord188
ord122
ord79
ord142
ord41
ord117
ord87
ord36
ord113
ord40
ord21
ord108
ord194
ord203
ord167
ord10
ord301
ord127
ord16

netutils

NetApiBufferFree

rpcrt4

RpcServerInqDefaultPrincNameW
RpcBindingSetOption
RpcBindingSetAuthInfoExA
RpcErrorGetNextRecord
RpcStringFreeW
RpcServerListen
RpcServerRegisterIfEx
RpcServerUseProtseqEpA
RpcBindingSetAuthInfoExW
RpcMgmtStopServerListening
RpcMgmtSetComTimeout
RpcMgmtWaitServerListen
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcEpUnregister
NdrClientCall3
RpcServerUnregisterIf
RpcImpersonateClient
RpcRevertToSelf
RpcBindingInqAuthClientA
RpcStringFreeA
RpcErrorStartEnumeration
RpcErrorEndEnumeration
RpcBindingVectorFree
RpcEpRegisterA
I_RpcGetExtendedError
RpcBindingFree
RpcServerUseProtseqA
RpcServerInqBindings
UuidCreateSequential
NdrServerCall2
NdrServerCallAll
RpcBindingSetAuthInfoA
RpcServerRegisterAuthInfoW
RpcBindingInqAuthClientW

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-security-base-l1-2-0

CopySid
GetSecurityDescriptorGroup
AccessCheck
GetTokenInformation
AddAccessAllowedAceEx
MapGenericMask
IsValidSecurityDescriptor
SetSecurityDescriptorGroup
AllocateAndInitializeSid
IsValidAcl
GetSecurityDescriptorDacl
GetAclInformation
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
CheckTokenMembership
EqualSid
InitializeSecurityDescriptor
GetLengthSid
AddAccessAllowedAce
GetSecurityDescriptorSacl
AddAce
CreateWellKnownSid
AdjustTokenPrivileges
InitializeAcl
FreeSid
GetAce
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
DeleteAce

sspicli

FreeContextBuffer
QueryContextAttributesW

iphlpapi

NotifyUnicastIpAddressChange
GetAdaptersAddresses
CancelMibChangeNotify2

api-ms-win-core-datetime-l1-1-1

GetTimeFormatW
GetDateFormatW

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
TraceEvent
GetTraceLoggerHandle

api-ms-win-core-string-l2-1-0

CharLowerBuffW
CharUpperBuffW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-io-l1-1-1

GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort

api-ms-win-core-memory-l1-1-2

MapViewOfFile
CreateFileMappingW
OpenFileMappingW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

ncrypt

NCryptOpenStorageProvider
NCryptFreeObject
NCryptOpenKey
NCryptDeleteKey
NCryptSignHash
NCryptCreatePersistedKey
NCryptFinalizeKey
NCryptGetProperty
NCryptSetProperty
NCryptImportKey
NCryptExportKey
NCryptEnumStorageProviders
NCryptFreeBuffer

crypt32

CertOpenStore
CertGetNameStringW
CertDeleteCertificateFromStore
CryptAcquireCertificatePrivateKey
CertFreeCertificateContext
CertSetCertificateContextProperty
CertCreateSelfSignCertificate
CertStrToNameW
CryptEncodeObjectEx
CertEnumCertificatesInStore
CertCompareCertificateName
CertCloseStore
CertAddCertificateContextToStore
CertGetCertificateContextProperty
CertCompareIntegerBlob
CertDuplicateCertificateContext

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

winhttp

WinHttpSendRequest
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpReadData
WinHttpReceiveResponse
WinHttpConnect

api-ms-win-core-com-l1-1-1

CreateStreamOnHGlobal

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW

samcli

NetLocalGroupAdd

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-kernel32-legacy-l1-1-1

GetComputerNameW
MoveFileW
WaitForMultipleObjects
LoadLibraryW

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
RegisterEventSourceW

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy

ntdll

RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlRandom
NtClose
NtCreateFile
RtlInitUnicodeString
NtCancelIoFile
RtlOemToUnicodeN
RtlNtStatusToDosError
RtlEqualSid
WinSqmSetDWORD
WinSqmIsOptedIn
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage
NtDeviceIoControlFile
RtlCopySid
RtlLengthSid
RtlAdjustPrivilege
RtlAllocateAndInitializeSid
RtlUpcaseUnicodeToOemN
RtlAbsoluteToSelfRelativeSD
NtAccessCheckAndAuditAlarm
RtlDestroyHeap
RtlIpv6StringToAddressA
RtlIpv6StringToAddressW
RtlIpv4StringToAddressA
RtlIpv4StringToAddressW
RtlIpv6AddressToStringA
RtlIpv4AddressToStringExA
RtlIpv6AddressToStringExA
RtlIpv6StringToAddressExW
RtlIpv6StringToAddressExA
RtlGetNtProductType
NtOpenProcessToken
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSubAuthorityCountSid
RtlCreateAcl
RtlAddAce
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlNewSecurityObject

advapi32

TraceMessage
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom

bcrypt

BCryptImportKeyPair
BCryptVerifySignature
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
BCryptDestroyHash
BCryptDestroyKey

kernel32

GetFileSize
HeapSetInformation
HeapCreate
HeapReAlloc
GetTimeFormatEx
GetDateFormatEx
FileTimeToLocalFileTime
HeapFree
GetProcessHeap
HeapAlloc
LocalFree
DeleteFileTransactedW
MoveFileTransactedW
UnmapViewOfFile
ReleaseMutex
GetDateFormatA
GetTimeFormatA
LocalAlloc
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
lstrcmpiW
CompareStringW
LoadLibraryExA
GetModuleHandleA
LCMapStringW
CopyFileTransactedW

ktmw32

CommitTransaction
CreateTransaction

mprapi

MprConfigTransportGetHandle
MprAdminBufferFree
MprAdminServerDisconnect
MprConfigBufferFree
MprAdminTransportSetInfo
MprInfoBlockQuerySize
MprConfigTransportGetInfo
MprConfigServerConnect
MprInfoBlockFind
MprConfigServerDisconnect
MprInfoBlockSet
MprAdminTransportGetInfo
MprAdminServerConnect

ntdsapi

DsReplicaFreeInfo
DsUnBindW
DsGetSpnW
DsMakeSpnW
DsBindA
DsQuerySitesFree
DsListSitesW
DsFreeNameResultW
DsQuerySitesByCostW
DsFreeSpnArrayW
DsReplicaGetInfoW
DsWriteAccountSpnW
DsBindW

ole32

StringFromCLSID
CoCreateGuid
CLSIDFromString
CoTaskMemFree

xmllite

CreateXmlReader

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

03dd29db44c4b7867ba99b31af7df69a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

dsrole

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-timezone-l1-1-0

dnsapi

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-version-l1-1-0

ws2_32

api-ms-win-core-file-l1-2-1

api-ms-win-service-core-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

logoncli

wldap32

netutils

rpcrt4

api-ms-win-core-string-l1-1-0

api-ms-win-security-base-l1-2-0

sspicli

iphlpapi

api-ms-win-core-datetime-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-memory-l1-1-2

api-ms-win-core-threadpool-l1-2-0

ncrypt

crypt32

api-ms-win-security-sddl-l1-1-0

winhttp

api-ms-win-core-com-l1-1-1

api-ms-win-security-lsalookup-l2-1-1

samcli

api-ms-win-core-util-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

ntdll

advapi32

bcrypt

kernel32

ktmw32

mprapi

ntdsapi

ole32

xmllite

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.data Size: 24KB - Virtual size: 231KB

.pdata Size: 32KB - Virtual size: 31KB

.idata Size: 22KB - Virtual size: 22KB

.tls Size: 26KB - Virtual size: 26KB

.rsrc Size: 174KB - Virtual size: 173KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 24KB - Virtual size: 231KB

.pdata
Size: 32KB - Virtual size: 31KB

.idata
Size: 22KB - Virtual size: 22KB

.tls
Size: 26KB - Virtual size: 26KB

.rsrc
Size: 174KB - Virtual size: 173KB

.reloc
Size: 8KB - Virtual size: 7KB