dmclient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dmclient.exe
Size

160KB
MD5

75bed58b066e6cf809c771cc8c52490b
SHA1

362a0074a2aa7f0e193c42f7197bbf9796aec2ee
SHA256

e5a3a18729f325f8a15e516c2b70fb9e3a460209b7db86e2f511d420fcebdc3b
SHA512

5d7bda4d8873e70676b67bc31029bc0d16037e8011c220f67fac322af3043efa3f3d7e8e628328e9f793de68499124792cc1e1567d7a0469fe15d59ecaada924
SSDEEP

3072:oCpbPqBkBT0IZZXiLk4U1+bA88GnXNUtSxP2jk:oCtyBWQIZZXiqjcUtwe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dmclient.exe

Files

dmclient.exe
.exe windows:10 windows x64 arch:x64

24fe1092ba4708a7b9fe972d3915a0f0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

dmclient.pdb

Imports

msvcrt

_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_commode
?what@exception@@UEBAPEBDXZ
_CxxThrowException
_callnewh
_exit
malloc
_lock
_vsnprintf_s
_unlock
__dllonexit
??0exception@@QEAA@AEBV0@@Z
exit
memmove
??0exception@@QEAA@XZ
__CxxFrameHandler4
_onexit
??1type_info@@UEAA@XZ
__wgetmainargs
??1exception@@UEAA@XZ
memcmp
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_purecall
memcpy
?terminate@@YAXXZ
??3@YAXPEAX@Z
wcsnlen
_wtoi64
wcstod
memmove_s
vswprintf_s
_vscwprintf
_wcsicmp
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__set_app_type
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExA
GetProcAddress
GetModuleHandleExW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegGetValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockShared
LeaveCriticalSection
AcquireSRWLockShared
CreateMutexExW
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSemaphore
CreateEventExW
CreateSemaphoreExW
SetEvent
EnterCriticalSection
InitializeCriticalSectionEx
ReleaseMutex
ReleaseSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemFree
CLSIDFromString
CoWaitForMultipleHandles

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoUninitialize
RoGetActivationFactory
RoInitialize

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
OpenThreadToken
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

GetUserPreferredUILanguages
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemTime

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-file-l1-1-0

FindFirstFileW
FindClose
DeleteFileW
WriteFile
ReadFile
CreateDirectoryW
FindNextFileW
GetFileSize

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-security-base-l1-1-0

GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

crypt32

CryptStringToBinaryW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

ntdll

NtQueryWnfStateData
RtlGetDeviceFamilyInfoEnum

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

xmllite

CreateXmlReader

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedFileLocationW
GetPersistedRegistryLocationW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

24fe1092ba4708a7b9fe972d3915a0f0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

crypt32

api-ms-win-core-threadpool-l1-2-0

ntdll

api-ms-win-core-registry-l2-1-0

api-ms-win-shcore-stream-l1-1-0

xmllite

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 96KB - Virtual size: 93KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

.didat Size: 4KB - Virtual size: 200B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 828B

.text
Size: 96KB - Virtual size: 93KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.didat
Size: 4KB - Virtual size: 200B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 828B