rkmon32[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rkmon32.dll
Size

3.2MB
MD5

789d4c638e5111daa4e38cca18b9f5b4
SHA1

34734ca14b9bdce629703436b79d00034c21a2f3
SHA256

b925d8c97575ff784e92bc9a3f1d5daf34d0bc3c17c09ed1895e6b88ed0d44d5
SHA512

35bdc2af510e732118e0cfd99ea4f306015d97cfd86e783338d6f9f7714ac383bf0e63c4d831c54363d8a8b4edd103fd15d53d48c26aee1b303dbf25597f53f0
SSDEEP

49152:WzQqMHcWkP004MNRHJUKkxbU4QUXe/E0UIYQFA4EJPzxTQ7T4qY4wWs5sPdg:dq1VJVRHJUKk5U4QUXe/E0UIO5xT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rkmon32.dll

Files

rkmon32.dll
.dll windows:5 windows x86 arch:x86

c7fcde119c2b08343546a5219293fe8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Adlice\RogueKillerQt\RelWithDebInfo\roguekillermon.pdb

Imports

ws2_32

WSAIoctl
getaddrinfo
getnameinfo
freeaddrinfo

kernel32

DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileW
MoveFileExW
MapViewOfFile
UnmapViewOfFile
LocalFree
SetErrorMode
Sleep
FormatMessageW
GetVolumeInformationW
RaiseException
CreateThread
Module32FirstW
Module32NextW
DeviceIoControl
DefineDosDeviceW
QueryDosDeviceW
GetOverlappedResult
WriteFile
ReadFile
FlushFileBuffers
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
WaitNamedPipeW
CancelIo
LocalAlloc
VirtualAlloc
VirtualFree
HeapAlloc
HeapFree
GetProcessHeap
GetFileAttributesExW
GetFileType
SetFilePointerEx
lstrlenW
GetDriveTypeW
GetDiskFreeSpaceW
IsBadReadPtr
IsBadWritePtr
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
ResumeThread
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetStdHandle
SwitchToFiber
DeleteFiber
CreateFiber
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
FormatMessageA
InitializeCriticalSection
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
CreateFileMappingA
SwitchToThread
FlushInstructionCache
VirtualProtect
VirtualQuery
LoadLibraryExW
SetFileAttributesW
CreateFileW
RemoveDirectoryW
CreateDirectoryW
FindClose
GetVersionExA
GetFileAttributesW
OutputDebugStringA
GetEnvironmentVariableW
GetModuleFileNameW
GetModuleFileNameA
GetStringTypeW
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SuspendThread
GetThreadContext
OutputDebugStringW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
FreeLibrary
GetVersionExW
GetModuleHandleW
VerSetConditionMask
GetTickCount
CreateEventW
WaitForMultipleObjects
ResetEvent
SetEvent
GlobalUnlock
GlobalLock
GlobalSize
GetComputerNameW
GetSystemDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleA
CloseHandle
WaitForSingleObject
SetThreadContext
ReadProcessMemory
GetLastError
TerminateThread
TerminateProcess
OpenProcess
GetProcAddress
GetCurrentProcessId
GetCurrentProcess
GetFullPathNameW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
GetLongPathNameW
GetShortPathNameW
GetDateFormatW
GetTimeFormatW
CompareFileTime
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
SetLastError
GetCurrentThread
LoadLibraryW
QueueUserWorkItem
InterlockedFlushSList
ExitProcess
SetConsoleCtrlHandler
ExitThread
FreeLibraryAndExitThread
HeapReAlloc
GetConsoleCP
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
SetEndOfFile
HeapSize
GetTimeZoneInformation
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW

user32

SendMessageA
GetSystemMetrics
GetMessageW
GetProcessWindowStation
GetUserObjectInformationW
FindWindowA
MessageBoxW
GetClipboardData

shell32

ord51
SHGetFolderPathW

ole32

CoTaskMemFree
StringFromCLSID

advapi32

ConvertSidToStringSidW
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetExplicitEntriesFromAclW
RegSetKeySecurity
RegGetKeySecurity
GetAce
ConvertStringSidToSidW
LookupAccountSidW
CopySid
GetLengthSid
IsValidSid
SetEntriesInAclW
CheckTokenMembership
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
InitializeSecurityDescriptor
InitializeAcl
FreeSid
AllocateAndInitializeSid
GetTokenInformation
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetUserNameW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

shlwapi

StrCmpIW
StrDupW
PathUnExpandEnvStringsW
PathUnquoteSpacesW
PathSearchAndQualifyW
PathRemoveFileSpecW
PathRemoveBlanksW
PathRemoveBackslashW
PathRemoveArgsW
PathQuoteSpacesW
PathIsRelativeW
PathIsPrefixW
PathIsDirectoryW
PathGetDriveNumberW
PathGetArgsW
PathFindFileNameW
PathFindExtensionW
PathFileExistsW
PathAppendW

psapi

GetProcessImageFileNameW
GetModuleInformation
GetModuleFileNameExW
GetModuleBaseNameW

userenv

GetProfilesDirectoryW

wsock32

shutdown
gethostname
sendto
recvfrom
inet_ntoa
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
WSAGetLastError
recv
send
WSASetLastError
accept
bind
closesocket
connect
listen
setsockopt
socket
getpeername
htons
__WSAFDIsSet
select
htonl

ntdll

NtOpenKey
strchr
floor
memset
_wtoi64
strcspn
_wcsicmp
memchr
tolower
toupper
NtDeleteKey
memcpy
memmove
NtDeleteValueKey
NtSetValueKey
NtCreateKey
NtQueryKey
qsort
strncpy
strrchr
strcmp
strncmp
strspn
strtoul
_strnicmp
wcsstr
_stricmp
atoi
strstr
strtol
strpbrk
memcmp
NtQueryVirtualMemory
wcschr
wcsrchr
isspace

wininet

InternetGetConnectedState

mpr

WNetGetConnectionW

wtsapi32

WTSEnumerateSessionsW

crypt32

CertDuplicateCertificateContext
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 710KB - Virtual size: 710KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7fcde119c2b08343546a5219293fe8e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

shell32

ole32

advapi32

shlwapi

psapi

userenv

wsock32

ntdll

wininet

mpr

wtsapi32

crypt32

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 710KB - Virtual size: 710KB

.data Size: 26KB - Virtual size: 63KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.gfids Size: 512B - Virtual size: 420B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 128KB - Virtual size: 127KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 710KB - Virtual size: 710KB

.data
Size: 26KB - Virtual size: 63KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.gfids
Size: 512B - Virtual size: 420B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 128KB - Virtual size: 127KB