Dominate R6 External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Dominate R6 External.exe
Size 2.0MB
Sample260705-sflvdac14v
SHA256 b10a45f049aa25ccdb94cf053d7f2fd82db6c27218646f1a694a5ac0bbadcaab
MD5 a57e6cfb4d559f76fb5e100853575ab5
SHA1 4845f7c59a2acf61bb44348ddac12ed9e4b7b4d8
SHA512 0db1fecdbfa726d89430b9894e62343da2f9b57ddfa60e8cf2c470b984d3d078cb597e112bf13eaddefc6d519166b42527d52a79c3153110a234c697ce5d9842
SSDEEP 49152:akNEkIOnq0ErvredupNlapTL2iKeRpJ6iar9F:2T8u8tL2itpHaZF
TLSH
T13CA59E67F541EAABD934173485B3075B623A6460EF1243CF279936386F933E02F76A84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dominate R6 External.exe

File Explorer

Dominate R6 External.exe

.exe 2.0MB

Dominate R6 External.exe

IMPHASH c67bf4bac5649eaf2c94c5be4938dc57
SHA256 b10a45f049aa25ccdb94cf053d7f2fd82db6c27218646f1a694a5ac0bbadcaab
MD5 a57e6cfb4d559f76fb5e100853575ab5
SHA1 4845f7c59a2acf61bb44348ddac12ed9e4b7b4d8
SHA512 0db1fecdbfa726d89430b9894e62343da2f9b57ddfa60e8cf2c470b984d3d078cb597e112bf13eaddefc6d519166b42527d52a79c3153110a234c697ce5d9842
SSDEEP 49152:akNEkIOnq0ErvredupNlapTL2iKeRpJ6iar9F:2T8u8tL2itpHaZF
TLSH
T13CA59E67F541EAABD934173485B3075B623A6460EF1243CF279936386F933E02F76A84
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

459144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA GetStdHandle CreateFileW CloseHandle GetLastError Sleep ExitProcess GetTickCount SetConsoleTextAttribute CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalLock QueryPerformanceCounter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency WideCharToMultiByte MultiByteToWideChar GlobalUnlock GlobalFree GlobalAlloc

user32

SetClipboardData CloseClipboard OpenClipboard SetCursorPos GetWindowThreadProcessId FindWindowA MessageBoxA UpdateWindow GetSystemMetrics SendInput GetAsyncKeyState ShowWindow DestroyWindow PeekMessageW DispatchMessageW TranslateMessage LoadCursorW ScreenToClient ClientToScreen GetCursorPos GetMessageExtraInfo GetClipboardData EmptyClipboard GetKeyboardLayout GetClientRect GetForegroundWindow GetKeyState SetCursor

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

msvcp140

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?setf@ios_base@std@@QEAAHHH@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

vcruntime140

__C_specific_handler __current_exception __current_exception_context _CxxThrowException __std_exception_destroy __std_terminate memcmp strchr memset memmove memcpy memchr __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy strcmp wcslen strlen strncmp strnlen

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func _wfopen __stdio_common_vsscanf fclose fflush fread __p__commode fseek ftell fwrite __stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vsprintf getchar

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

fmodf powf cosf acosf sqrtf __setusermatherr atan2f log logf pow ceilf roundf sinf _fdclass fmaxf

api-ms-win-crt-convert-l1-1-0

strtol atof

api-ms-win-crt-runtime-l1-1-0

__p___argc terminate _register_thread_local_exe_atexit_callback _beginthreadex _c_exit __p___argv _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _errno _cexit _invoke_watson _seh_filter_exe _set_app_type _exit _get_initial_narrow_environment _initterm _initterm_e exit

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale