LOKICHESTER[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
LOKICHESTER.dll
Size 1.4MB
Sample260712-sgj26sd191
SHA256 a0db00e62bfbbf529c3049b690182750cc1cd3015ec2401feee1c02a5d4f7868
MD5 bf5f433caf21a5be0b47e70921489769
SHA1 d880f4224078a146e057154af64274f8180e8d44
SHA512 be83e457c1a40734d1fb9eac03f8c2ea4f4da24a38d52ac46104317ea67fcd6e49b77602d17affad3039019c2800851f483435261730a7dbc90fb78e682dff8e
SSDEEP 24576:RqW7AcpciKLl2hi1DJlxzvrA7IzT0t4bURhnOi1h0lhSMXll+OLHa:7ZciKLl2hidn9A7iy4bURhnHsV+kH
TLSH
T1C3658E1261660AE8D57FA174C85A3F1BFB3934004368A7DF2ED408C75B96AE1B27F742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LOKICHESTER.dll

File Explorer

LOKICHESTER.dll

.dll 1.4MB

LOKICHESTER.dll

IMPHASH bcf84217cdc9e9bc9387c2135bd40cad
SHA256 a0db00e62bfbbf529c3049b690182750cc1cd3015ec2401feee1c02a5d4f7868
MD5 bf5f433caf21a5be0b47e70921489769
SHA1 d880f4224078a146e057154af64274f8180e8d44
SHA512 be83e457c1a40734d1fb9eac03f8c2ea4f4da24a38d52ac46104317ea67fcd6e49b77602d17affad3039019c2800851f483435261730a7dbc90fb78e682dff8e
SSDEEP 24576:RqW7AcpciKLl2hi1DJlxzvrA7IzT0t4bURhnOi1h0lhSMXll+OLHa:7ZciKLl2hidn9A7iy4bURhnHsV+kH
TLSH
T1C3658E1261660AE8D57FA174C85A3F1BFB3934004368A7DF2ED408C75B96AE1B27F742
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

859604

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetCurrentProcessId LocalFree FormatMessageA CloseHandle AddVectoredExceptionHandler RemoveVectoredExceptionHandler GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA GetLastError WakeAllConditionVariable GetFileInformationByHandleEx VirtualProtect AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx GetCurrentThreadId Sleep SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive VirtualAlloc GetSystemInfo GetProcAddress GetModuleHandleA InitOnceComplete InitOnceBeginInitialize FreeLibraryAndExitThread DisableThreadLibraryCalls GetSystemTimeAsFileTime CreateThread InitializeSListHead

user32

RegisterClassExA CreateWindowExA ReleaseCapture SetCapture GetCapture GetForegroundWindow SetCursorPos GetKeyState GetMessageExtraInfo TrackMouseEvent SetCursor GetKeyboardLayout GetCursorPos EmptyClipboard GetClipboardData CallWindowProcA ScreenToClient LoadCursorA DestroyWindow MessageBoxA MessageBoxW GetWindowLongA SetWindowLongPtrW GetClientRect EnumWindows GetWindowThreadProcessId GetKeyNameTextA SetWindowLongPtrA OpenClipboard CloseClipboard IsWindowUnicode SetClipboardData DefWindowProcA ClientToScreen

shell32

ShellExecuteW

msvcp140

_Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Xlength_error@std@@YAXPEBD@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?fail@ios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Xbad_function_call@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?rdstate@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xout_of_range@std@@YAXPEBD@Z

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

d3dcompiler_43

D3DCompile

vcruntime140

memchr _purecall __std_terminate __std_exception_copy memcpy memmove __std_type_info_destroy_list __std_exception_destroy __C_specific_handler memset strchr strstr memcmp _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

fclose _get_stream_buffer_pointers fputc fread fflush fgetpos ftell fseek _wfopen __acrt_iob_func fsetpos _fseeki64 __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf fwrite setvbuf fgetc ungetc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

calloc malloc free _callnewh

api-ms-win-crt-math-l1-1-0

logf powf atan2f acosf ceilf fmodf sqrt log _dclass pow _fdsign _ldsign _dsign cos cosf sin sqrtf sinf

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func

api-ms-win-crt-string-l1-1-0

strcpy strcmp strncpy strncmp wcslen strlen

api-ms-win-crt-convert-l1-1-0

atof strtoull strtoll strtod

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment abort _initterm_e _initterm _seh_filter_dll _cexit _configure_narrow_argv _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _errno