Rokkit[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Rokkit.exe
Size

5.0MB
MD5

6334b5d8414507acea4024da901995e1
SHA1

9c1ec9fde1b33501faf7150661541e58ece0331f
SHA256

67d39bc50f7734b19440c7679e864e047e8ae216929c5fb321269cf31009edc7
SHA512

3088a347b6b03e6dd60649d5e0a43d43e949f65d4da77f447078192972f67f54e08233bed8fb45ec0bf7c9f5aca4885d9bc9a9ca55741aec8a9b598b0e2280fb
SSDEEP

49152:j0oWWFXLV8z7dlYGPqP5We9ue/bOy1HuZ+UaHJpMAO3GxjOZaoaTGQEowKSg7tZu:1XhAdqX/ROZ+UBZ4OEoaVwKSgBZS3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Rokkit.exe

Files

Rokkit.exe
.exe windows:6 windows x64 arch:x64

d0f138204f26c866278f46c58186babf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

PostQueuedCompletionStatus
TryAcquireSRWLockExclusive
GetLastError
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetProcAddress
WakeAllConditionVariable
SetUnhandledExceptionFilter
GetCurrentThreadId
lstrlenW
SetEnvironmentVariableW
FindClose
OpenProcess
IsWow64Process
GetModuleHandleA
VirtualAllocEx
WriteProcessMemory
AddVectoredExceptionHandler
SetThreadStackGuarantee
WakeConditionVariable
GetFileInformationByHandleEx
MoveFileExW
RemoveDirectoryW
CopyFileExW
Sleep
SetHandleInformation
GetProcessId
SetFilePointerEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetQueuedCompletionStatusEx
SleepConditionVariableSRW
GetModuleHandleW
GetComputerNameExW
LoadLibraryExW
VirtualQuery
FreeLibrary
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
FormatMessageW
GetCurrentDirectoryW
GetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFullPathNameW
GetSystemInfo
FindNextFileW
CreateDirectoryW
FindFirstFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlVirtualUnwind
DeleteFileW
GetProcessTimes
LocalFree
GetSystemTimes
GetProcessIoCounters
VirtualQueryEx
ReadProcessMemory
GetTickCount64
LoadLibraryW
GlobalAlloc
GlobalLock
GlobalUnlock
LoadLibraryExA
GetUserDefaultUILanguage
LCIDToLocaleName
OutputDebugStringA
OutputDebugStringW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
TerminateProcess
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
TlsFree
CloseHandle
AcquireSRWLockShared
SwitchToThread
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseMutex
RtlCaptureContext
GetCurrentThread
GetCurrentProcess
ReleaseSRWLockExclusive
HeapReAlloc
HeapFree
GetProcessHeap
GetFinalPathNameByHandleW
HeapAlloc

ws2_32

WSAStartup
WSACleanup
select
getsockname
send
WSAIoctl
ioctlsocket
getaddrinfo
getsockopt
listen
connect
bind
WSASend
WSARecv
recv
WSASocketW
freeaddrinfo
closesocket
setsockopt
WSAGetLastError
accept
shutdown
socket
getpeername

dbghelp

MiniDumpWriteDump

ntdll

NtWriteFile
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtQuerySystemInformation
NtQueryInformationProcess
NtReadFile
RtlGetVersion

advapi32

SystemFunction036
RegQueryValueExW
OpenProcessToken
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
RegCloseKey
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
RegOpenKeyExW

user32

EnumChildWindows
MonitorFromWindow
DispatchMessageA
GetMessageA
VkKeyScanW
AppendMenuW
CreateMenu
MessageBoxW
SetWindowTextW
IsWindowVisible
GetForegroundWindow
SetCursorPos
EnumDisplayMonitors
MonitorFromPoint
CheckMenuItem
SetMenuItemInfoW
CloseClipboard
DestroyWindow
RedrawWindow
GetClientRect
PostMessageW
CreateIcon
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
GetWindowThreadProcessId
GetWindowTextLengthW
GetWindowTextW
CreateWindowExW
SetWindowLongPtrW
RegisterRawInputDevices
GetRawInputData
ValidateRect
GetUpdateRect
MapVirtualKeyW
GetAncestor
TranslateAcceleratorW
EnumWindows
GetSystemMetrics
GetKeyboardState
MapVirtualKeyExW
RegisterWindowMessageA
RegisterClassExW
ChangeDisplaySettingsExW
SetWindowPlacement
GetWindowPlacement
SetWindowPos
InvalidateRgn
SetCapture
ReleaseCapture
PostQuitMessage
ShowWindow
SendInput
GetDC
SetClipboardData
IsProcessDPIAware
DestroyAcceleratorTable
DestroyIcon
GetSystemMenu
EnableMenuItem
SendMessageW
SetWindowLongW
ClientToScreen
GetActiveWindow
GetClipCursor
ClipCursor
GetWindowLongPtrW
DefWindowProcW
SetForegroundWindow
GetWindowRect
GetWindowLongW
GetMenu
AdjustWindowRectEx
ShowCursor
SystemParametersInfoA
GetKeyboardLayout
ToUnicodeEx
GetKeyState
GetMonitorInfoW
GetAsyncKeyState
TrackMouseEvent
MonitorFromRect
GetTouchInputInfo
ScreenToClient
CloseTouchInputHandle
GetCursorPos
LoadCursorW
SetCursor
FlashWindowEx
IsWindow
RegisterTouchWindow
SetWindowDisplayAffinity
SetMenu
CreateAcceleratorTableW
OpenClipboard
GetClipboardData
EmptyClipboard
RegisterClipboardFormatW

secur32

QueryContextAttributesW
AcquireCredentialsHandleA
InitializeSecurityContextW
DecryptMessage
EncryptMessage
FreeContextBuffer
ApplyControlToken
DeleteSecurityContext
FreeCredentialsHandle
AcceptSecurityContext

crypt32

CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertCloseStore
CertOpenStore
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertDuplicateStore

shell32

ShellExecuteW
DragFinish
SHCreateItemFromParsingName
DragQueryFileW
CommandLineToArgvW
SHGetKnownFolderPath

ole32

CreateStreamOnHGlobal
CoUninitialize
CoTaskMemFree
CoCreateInstance
RegisterDragDrop
CoInitializeEx
RevokeDragDrop
OleInitialize
CoTaskMemAlloc

bcrypt

BCryptGenRandom

pdh

PdhRemoveCounter
PdhCloseQuery

comctl32

RemoveWindowSubclass
DefSubclassProc
SetWindowSubclass

psapi

EnumProcessModules
GetModuleInformation
GetModuleFileNameExW

powrprof

CallNtPowerInformation

gdi32

CreateRectRgn
DeleteObject
GetDeviceCaps

uxtheme

SetWindowTheme

dwmapi

DwmEnableBlurBehindWindow

oleaut32

SysStringLen
SetErrorInfo
SysFreeString
GetErrorInfo

api-ms-win-crt-runtime-l1-1-0

_c_exit
__p___argv
__p___argc
terminate
_register_thread_local_exe_atexit_callback
_invoke_watson
_exit
exit
_initterm_e
_set_invalid_parameter_handler
_initterm
signal
_cexit
_configure_narrow_argv
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_seh_filter_exe
_set_app_type
abort
_initialize_narrow_environment
_crt_atexit

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr
trunc
ceil
round
floor

api-ms-win-crt-string-l1-1-0

strcpy_s
_wcsicmp
wcslen
strlen
wcsncmp

api-ms-win-crt-convert-l1-1-0

_ultow_s
wcstol

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc
calloc
_set_new_mode
_callnewh
free

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0f138204f26c866278f46c58186babf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

dbghelp

ntdll

advapi32

user32

secur32

crypt32

shell32

ole32

bcrypt

pdh

comctl32

psapi

powrprof

gdi32

uxtheme

dwmapi

oleaut32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 100KB - Virtual size: 100KB

.eh_fram Size: 512B - Virtual size: 88B

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 37KB - Virtual size: 37KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 100KB - Virtual size: 100KB

.eh_fram
Size: 512B - Virtual size: 88B

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 37KB - Virtual size: 37KB