Dumper[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Dumper.exe
Size 1012KB
Sample260620-3cgrcsas9n
SHA256 c0649b76d8d824fd495f42bde122b5308b0c1e35d353ae98c8c8c131890ad43c
MD5 5def36bb306679c179e94442438982ea
SHA1 91948a60fe8e581864a4b052ffa3c71c6528bc0e
SHA512 128327d68f82552d771204422aa18833e3b78c35e6750073698392d3e9d93d1255257779ee04afcb98d5a730f5e39aff43488a58762f693c7f11df1ca4224504
SSDEEP 24576:BNGYs3sxPFW0jHmOp4vMn5L2Mya6xQcifYHcqkdEU9NFdjbt03:BNhysxdmk5L2Mya6xQc9cqkdEU9NFdP
TLSH
T1BF259E5AA7A401E9C177D07CC6578617E7B270091330ABEB16E18BA52F23AE17B3F741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dumper.exe

File Explorer

Dumper.exe

.exe 1012KB

Dumper.exe

IMPHASH 4a39d279400a0d6f67df4ce627ea6740
SHA256 c0649b76d8d824fd495f42bde122b5308b0c1e35d353ae98c8c8c131890ad43c
MD5 5def36bb306679c179e94442438982ea
SHA1 91948a60fe8e581864a4b052ffa3c71c6528bc0e
SHA512 128327d68f82552d771204422aa18833e3b78c35e6750073698392d3e9d93d1255257779ee04afcb98d5a730f5e39aff43488a58762f693c7f11df1ca4224504
SSDEEP 24576:BNGYs3sxPFW0jHmOp4vMn5L2Mya6xQcifYHcqkdEU9NFdjbt03:BNhysxdmk5L2Mya6xQc9cqkdEU9NFdP
TLSH
T1BF259E5AA7A401E9C177D07CC6578617E7B270091330ABEB16E18BA52F23AE17B3F741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

772240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\Downloads\Dumper (1)\x64\Release\Dumper.pdb

advapi32

GetTokenInformation AddAccessAllowedAce GetLengthSid SetSecurityInfo InitializeAcl OpenProcessToken IsValidSid RegCreateKeyExA RegDeleteKeyA CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt SystemFunction036

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

ws2_32

setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl freeaddrinfo listen inet_ntop recvfrom sendto ioctlsocket gethostname getaddrinfo htons getsockname getpeername connect inet_pton bind WSACleanup WSAStartup WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect ntohl getsockopt send WSAEnumNetworkEvents recv WSACreateEvent WSACloseEvent

bcrypt

BCryptGenRandom

kernel32

GetLocaleInfoEx FormatMessageA GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetModuleFileNameA VirtualProtect HeapFree SetDefaultDllDirectories AddDllDirectory GetCurrentProcess GetModuleFileNameW InitializeCriticalSectionEx CreateFileW GetCurrentThreadId GetSystemDirectoryW UnmapViewOfFile GetModuleHandleA HeapSize Sleep GetTickCount64 GetLastError GetFileAttributesA HeapReAlloc CloseHandle CreateThread HeapAlloc AddVectoredExceptionHandler HeapDestroy DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile QueryPerformanceCounter SetDllDirectoryW LocalFree ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryW SleepEx GetTickCount MultiByteToWideChar WideCharToMultiByte WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx InitializeCriticalSection GetSystemInfo SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter OutputDebugStringW IsDebuggerPresent MoveFileExW InitializeSListHead GetSystemTimeAsFileTime

user32

MessageBoxA

shell32

ShellExecuteA

msvcp140

_Thrd_join _Mtx_unlock _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_counter _Thrd_detach _Xtime_get_ticks ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_id ?_Xlength_error@std@@YAXPEBD@Z

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context _CxxThrowException __current_exception __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler strchr memcpy memset strrchr memcmp memchr memmove strstr wcschr

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free calloc realloc _callnewh

api-ms-win-crt-runtime-l1-1-0

abort _errno _beginthreadex system _resetstkoflw _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit __sys_errlist _seh_filter_exe _set_app_type _invalid_parameter_noinfo _get_initial_narrow_environment _initterm _initterm_e _exit terminate __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback __sys_nerr exit _cexit

api-ms-win-crt-string-l1-1-0

tolower strlen strncmp towlower _strdup wcsncpy strpbrk wcsncmp isxdigit strcmp strspn wcspbrk _stricmp wcslen strcspn _wcsdup isspace

api-ms-win-crt-stdio-l1-1-0

_write _set_fmode _fileno _close _lseeki64 _read __p__commode fgets fwrite _wfopen fgetc _wopen __stdio_common_vsprintf __stdio_common_vsscanf ftell _pclose fseek feof fgetpos fclose fputs fflush setvbuf fputc __acrt_iob_func _popen _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr _fdopen _dsign

api-ms-win-crt-time-l1-1-0

_time64 _localtime64 _gmtime64 strftime

api-ms-win-crt-convert-l1-1-0

wcstombs strtol atoi strtoll strtoul strtod strtoull

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlock_file _lock_file _unlink _fstat64

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort