Rokkit[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Rokkit.exe
Size

5.0MB
MD5

3711e47e9fcda854c9d1061237d4e2b5
SHA1

724a89227448c90e7ea7d1d671ef121c3956b0af
SHA256

9dd0d571aa9522fbd45f6982343e8154767fce521338f5e7a180def9520e4d74
SHA512

f8da76ee9291c080b8fe888eeae2899cc7888ac6f37a75842cb7e1d88c92725d02469947f30981f05642703eca857841f3b762fea134de0bd2f027621fc8b73f
SSDEEP

49152:PRfCTk0CsnHbEiqoFXEMS//4EslxOkX3xrvWUQCNAa0d0ifpIltgByPe+wKSg7tV:r62HUOIzWUNoJf+lqYbwKSgBhtOje

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Rokkit.exe

Files

Rokkit.exe
.exe windows:6 windows x64 arch:x64

2b5283f32bd60a8b3e8ba9a1f18a1c17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

PostQueuedCompletionStatus
TryAcquireSRWLockExclusive
GetLastError
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetProcAddress
WakeAllConditionVariable
SetUnhandledExceptionFilter
GetCurrentThreadId
lstrlenW
FindClose
WakeConditionVariable
OpenProcess
IsWow64Process
GetModuleHandleA
VirtualAllocEx
WriteProcessMemory
SetEnvironmentVariableW
GetFileInformationByHandleEx
MoveFileExW
RemoveDirectoryW
CopyFileExW
AddVectoredExceptionHandler
SetThreadStackGuarantee
Sleep
SetHandleInformation
GetProcessId
SetFilePointerEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetQueuedCompletionStatusEx
SleepConditionVariableSRW
GetModuleHandleW
GetComputerNameExW
LoadLibraryExW
VirtualQuery
FreeLibrary
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
FormatMessageW
GetCurrentDirectoryW
GetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFullPathNameW
GetSystemInfo
FindNextFileW
CreateDirectoryW
FindFirstFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlVirtualUnwind
DeleteFileW
GetProcessTimes
LocalFree
GetSystemTimes
GetProcessIoCounters
VirtualQueryEx
ReadProcessMemory
GetTickCount64
LoadLibraryW
GlobalAlloc
GlobalLock
GlobalUnlock
LoadLibraryExA
GetUserDefaultUILanguage
LCIDToLocaleName
OutputDebugStringA
OutputDebugStringW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
TerminateProcess
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
TlsFree
CloseHandle
AcquireSRWLockShared
SwitchToThread
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseMutex
RtlCaptureContext
GetCurrentThread
GetCurrentProcess
ReleaseSRWLockExclusive
HeapReAlloc
HeapFree
GetProcessHeap
GetFinalPathNameByHandleW
HeapAlloc

ws2_32

WSAStartup
WSACleanup
select
getsockname
send
WSAIoctl
ioctlsocket
getaddrinfo
getsockopt
listen
connect
bind
WSASend
WSARecv
recv
WSASocketW
freeaddrinfo
closesocket
setsockopt
WSAGetLastError
accept
shutdown
socket
getpeername

dbghelp

MiniDumpWriteDump

ntdll

NtWriteFile
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtQuerySystemInformation
NtQueryInformationProcess
NtReadFile
RtlGetVersion

advapi32

SystemFunction036
RegQueryValueExW
OpenProcessToken
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
RegCloseKey
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
RegOpenKeyExW

user32

EnumChildWindows
MonitorFromWindow
DispatchMessageA
GetMessageA
VkKeyScanW
AppendMenuW
CreateMenu
MessageBoxW
SetWindowTextW
GetForegroundWindow
IsWindowVisible
SetCursorPos
MonitorFromPoint
EnumDisplayMonitors
CheckMenuItem
SetMenuItemInfoW
CloseClipboard
GetWindowThreadProcessId
GetWindowTextLengthW
GetWindowTextW
GetRawInputData
ValidateRect
RedrawWindow
PostThreadMessageW
PeekMessageW
GetUpdateRect
MapVirtualKeyW
CreateWindowExW
SetWindowLongPtrW
GetMessageW
RegisterRawInputDevices
GetAncestor
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
CreateIcon
MsgWaitForMultipleObjectsEx
PostMessageW
DestroyWindow
GetClientRect
EnumWindows
GetSystemMetrics
GetKeyboardState
MapVirtualKeyExW
RegisterWindowMessageA
RegisterClassExW
ChangeDisplaySettingsExW
SetWindowPlacement
GetWindowPlacement
SetWindowPos
InvalidateRgn
SetCapture
ReleaseCapture
PostQuitMessage
ShowWindow
SendInput
GetDC
SetClipboardData
IsProcessDPIAware
DestroyAcceleratorTable
DestroyIcon
GetSystemMenu
EnableMenuItem
SendMessageW
SetWindowLongW
ClientToScreen
GetActiveWindow
GetClipCursor
ClipCursor
GetWindowLongPtrW
DefWindowProcW
SetForegroundWindow
GetWindowRect
GetWindowLongW
GetMenu
AdjustWindowRectEx
ShowCursor
SystemParametersInfoA
GetKeyboardLayout
ToUnicodeEx
GetKeyState
GetMonitorInfoW
GetAsyncKeyState
TrackMouseEvent
MonitorFromRect
GetTouchInputInfo
ScreenToClient
CloseTouchInputHandle
GetCursorPos
LoadCursorW
SetCursor
FlashWindowEx
IsWindow
RegisterTouchWindow
SetWindowDisplayAffinity
SetMenu
CreateAcceleratorTableW
OpenClipboard
GetClipboardData
EmptyClipboard
RegisterClipboardFormatW

secur32

QueryContextAttributesW
AcquireCredentialsHandleA
InitializeSecurityContextW
DecryptMessage
EncryptMessage
FreeContextBuffer
ApplyControlToken
DeleteSecurityContext
FreeCredentialsHandle
AcceptSecurityContext

crypt32

CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertCloseStore
CertOpenStore
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertDuplicateStore

shell32

ShellExecuteW
DragFinish
SHCreateItemFromParsingName
DragQueryFileW
CommandLineToArgvW
SHGetKnownFolderPath

ole32

CreateStreamOnHGlobal
CoUninitialize
CoTaskMemFree
CoCreateInstance
RegisterDragDrop
CoInitializeEx
RevokeDragDrop
OleInitialize
CoTaskMemAlloc

bcrypt

BCryptGenRandom

pdh

PdhRemoveCounter
PdhCloseQuery

comctl32

DefSubclassProc
SetWindowSubclass
RemoveWindowSubclass

psapi

EnumProcessModules
GetModuleInformation
GetModuleFileNameExW

powrprof

CallNtPowerInformation

gdi32

CreateRectRgn
DeleteObject
GetDeviceCaps

uxtheme

SetWindowTheme

dwmapi

DwmEnableBlurBehindWindow

oleaut32

SysStringLen
SetErrorInfo
SysFreeString
GetErrorInfo

api-ms-win-crt-runtime-l1-1-0

_c_exit
__p___argv
__p___argc
terminate
_register_thread_local_exe_atexit_callback
_invoke_watson
_exit
exit
_initterm_e
_set_invalid_parameter_handler
_initterm
signal
_cexit
_configure_narrow_argv
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_seh_filter_exe
_set_app_type
abort
_initialize_narrow_environment
_crt_atexit

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr
trunc
ceil
round
floor

api-ms-win-crt-string-l1-1-0

strcpy_s
_wcsicmp
wcslen
strlen
wcsncmp

api-ms-win-crt-convert-l1-1-0

_ultow_s
wcstol

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc
calloc
_set_new_mode
_callnewh
free

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b5283f32bd60a8b3e8ba9a1f18a1c17

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

dbghelp

ntdll

advapi32

user32

secur32

crypt32

shell32

ole32

bcrypt

pdh

comctl32

psapi

powrprof

gdi32

uxtheme

dwmapi

oleaut32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 100KB - Virtual size: 99KB

.eh_fram Size: 512B - Virtual size: 88B

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 37KB - Virtual size: 37KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 100KB - Virtual size: 99KB

.eh_fram
Size: 512B - Virtual size: 88B

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 37KB - Virtual size: 37KB