Tether DMI[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Tether DMI.exe
Size

952KB
MD5

b5602323559d1075e0e6347c0462f03b
SHA1

4d6e2aca5acc9a542cc94e665f012cf2f71bb372
SHA256

5b5e43ae1c49cea1b500ecbc62f1b3e31f9663623f9648d551afaf9f114533d2
SHA512

4317bde60d43c8809c281d07bd9000824cd9bc5982add98a7886e0a467a5cc8c8266d3b4358b0ff13e62668afecedf5de4a2b5776379440026fc430817b553c5
SSDEEP

12288:q2NXEHjV/HNIwkpAyPAKz1LMa2+m3piGwZ0H7Fso6veRSN2ff+zOe9egX7AlGVnc:XUHjL3CAyxptl7do60OegX7AoVnYj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Tether DMI.exe

Files

Tether DMI.exe
.exe windows:6 windows x64

1fb77bcdb9f6d8ef916ebd560ae7ff9d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetSystemFirmwareTable
SizeofResource
HeapFree
DeviceIoControl
InitializeCriticalSectionEx
CreateFileW
HeapSize
GetLastError
LockResource
HeapReAlloc
CloseHandle
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
HeapDestroy
DeleteCriticalSection
FreeLibrary
GlobalUnlock
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
WideCharToMultiByte
GlobalLock
QueryPerformanceCounter
GetProcAddress
QueryPerformanceFrequency
GetModuleHandleW
GlobalFree
GlobalAlloc
LoadLibraryA
MultiByteToWideChar
GetCurrentProcessId
GetProcessHeap
GetCurrentThreadId

user32

DefWindowProcW
GetWindowRect
DestroyWindow
SetWindowPos
MessageBoxW
CreateWindowExW
SendMessageW
GetSystemMetrics
SetClipboardData
GetWindowLongW
RegisterClassExW
ShowWindow
DispatchMessageW
SetWindowLongA
PeekMessageW
SetLayeredWindowAttributes
TranslateMessage
LoadIconW
PostQuitMessage
UnregisterClassW
UpdateWindow
LoadImageW
GetKeyState
ScreenToClient
GetCapture
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
ClientToScreen
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
TrackMouseEvent

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__C_specific_handler
memset
_CxxThrowException
memmove
strstr
__std_terminate
__std_type_info_compare
memchr
__std_exception_copy
__std_exception_destroy
memcmp
__current_exception
memcpy

api-ms-win-crt-stdio-l1-1-0

ftell
feof
_popen
__stdio_common_vswprintf
fgets
_set_fmode
__p__commode
_pclose
__stdio_common_vswprintf_s
__acrt_iob_func
fflush
fclose
__stdio_common_vsscanf
__stdio_common_vsprintf
_wfopen
fwrite
fseek
__stdio_common_vfprintf
fread

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

wmemcpy_s
strcmp
strncmp
strncpy

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
terminate
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_set_app_type
_errno
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo

api-ms-win-crt-math-l1-1-0

cosf
ceilf
sqrtf
__setusermatherr
floorf
fmodf
sinf
acosf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 470KB - Virtual size: 469KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1fb77bcdb9f6d8ef916ebd560ae7ff9d

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

kernel32

user32

advapi32

msvcp140

imm32

d3dcompiler_43

dwmapi

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 294KB - Virtual size: 293KB

.rdata Size: 470KB - Virtual size: 469KB

.data Size: 1024B - Virtual size: 8KB

.pdata Size: 12KB - Virtual size: 11KB

.rsrc Size: 173KB - Virtual size: 173KB

.reloc Size: 1024B - Virtual size: 584B

.text
Size: 294KB - Virtual size: 293KB

.rdata
Size: 470KB - Virtual size: 469KB

.data
Size: 1024B - Virtual size: 8KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 173KB - Virtual size: 173KB

.reloc
Size: 1024B - Virtual size: 584B