ReAgent[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

ReAgent.dll
Size

242KB
MD5

3cc04cb09fafad87942437fddee11ee3
SHA1

141bbc74fb3329d5bf2574ed163fc83680ba733f
SHA256

9a5023058aba16edd42de38447888bbbcced803c32297e21376e24a9defeff1e
SHA512

76b19f4596b20c104a24530abbd613b0e4d1b21e6e2d7e1902c6a669b6ce164d320206745d747a904e348337e2a39bb527e54f0de3816982139c0bb9628ae5ac
SSDEEP

6144:LAbBU7pSQl38vaD8q+nYPFK1ztA2t4FWWY:V7dYa5KYOCFW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ReAgent.dll

Files

ReAgent.dll
.dll windows:6 windows x86 arch:x86

6d6e21e643a766cddebf5645ed16140a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ReAgent.pdb

Imports

msvcrt

??3@YAXPAX@Z
_purecall
_wcsicmp
??2@YAPAXI@Z
atol
_atoi64
_vsnprintf
_XcptFilter
malloc
_vsnwprintf
memcpy
memset
_wcslwr
free
_initterm
_amsg_exit
_except_handler4_common
_snwscanf_s
_wcsupr
swprintf_s
memmove
wcstoul
_wcsnicmp
wcscat_s
wcscpy_s
_ultow_s
wcschr
wcsrchr
wcsstr
wcsnlen
strncmp

ntdll

RtlRaiseStatus
RtlNtStatusToDosError
RtlFreeHeap
RtlInitUnicodeString
NtQuerySystemInformation
RtlFreeUnicodeString
RtlStringFromGUID
RtlAllocateHeap
NtOpenFile
NtWaitForSingleObject
NtDeviceIoControlFile
NtCreateEvent
NtOpenKey
NtEnumerateKey
WinSqmSetString
NtQueryAttributesFile
NtUnloadKey
NtLoadKey
NtAdjustPrivilegesToken
NtOpenProcessToken
NtOpenThreadToken
RtlFreeSid
RtlSetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
NtSetSecurityObject
NtCreateKey
NtDeleteValueKey
NtQueryValueKey
NtSetValueKey
NtDeleteKey
NtAllocateUuids
LdrGetProcedureAddress
RtlInitAnsiString
LdrGetDllHandle
NtResetEvent
RtlGetVersion
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
NtYieldExecution
DbgPrintEx
RtlReAllocateHeap
RtlDowncaseUnicodeChar
RtlCompareMemory
NtClose
RtlGUIDFromString
WinSqmIncrementDWORD
WinSqmSetDWORD
NtQueryKey

kernel32

GetLastError
CreateFileW
TlsFree
DeleteCriticalSection
TlsSetValue
TlsAlloc
InitializeCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
GetSystemDirectoryW
DeleteFileW
GetFileAttributesExW
SetLastError
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
WriteFile
SetEndOfFile
ReadFile
GetFileSize
GetCurrentProcess
SetFileAttributesW
GetFileInformationByHandle
TlsGetValue
CreateDirectoryW
GetVolumeNameForVolumeMountPointW
DeviceIoControl
FindVolumeClose
FindNextVolumeW
GetDiskFreeSpaceExW
GetDriveTypeW
FindFirstVolumeW
CopyFileW
MoveFileExW
CloseHandle
GetVolumePathNameW
GetFullPathNameW
GetFileAttributesW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
FindClose
FindNextFileW
CopyFileExW
FindFirstFileW
GetVolumePathNamesForVolumeNameW
SetErrorMode
ReleaseActCtx
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleFileNameW
GetModuleHandleW
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
VirtualFree
GetCurrentThread
LoadLibraryW
GetProcAddress
FreeLibrary
RemoveDirectoryW
GetVersionExW

advapi32

AllocateAndInitializeSid
DuplicateTokenEx
SetThreadToken
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
EventWrite
EventUnregister
EventRegister
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
SetNamedSecurityInfoW
FreeSid
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExW
RegQueryValueExW
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
TraceMessage

user32

SendMessageW

comctl32

ord345

imagehlp

ImageNtHeader

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

VariantClear
SysFreeString
SysAllocString
VariantInit

shell32

ShellExecuteExW

wdscore

ConstructPartialMsgVW
CurrentIP
WdsSetupLogMessageW

Exports

Exports

WinRE_Generalize
WinReAddLogFile
WinReCompleteRecovery
WinReCopyLogFilesToRamdisk
WinReCopySetupFiles
WinReCreateLogInstance
WinReCreateLogInstanceEx
WinReDeleteLogFiles
WinReGetConfig
WinReGetGroupPolicies
WinReGetLogFile
WinReGetWIMInfo
WinReInstall
WinReIsInstallMedia
WinReOpenLogInstance
WinRePostRecovery
WinReRestoreLogFiles
WinReSetConfig
WinReSetRecoveryAction
WinReSetRecoveryActionEx
WinReUnInstall
WinReUpdateLogInstance
winreFindInstallMedia
winreGetBinaryArch

Sections

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d6e21e643a766cddebf5645ed16140a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

advapi32

user32

comctl32

imagehlp

ole32

oleaut32

shell32

wdscore

Exports

Exports

Sections

.text Size: 223KB - Virtual size: 222KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 223KB - Virtual size: 222KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 10KB - Virtual size: 10KB