Dominate R6 External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Dominate R6 External.exe
Size 2.0MB
Sample260720-eg1g9set9p
SHA256 3b529f3892d20e8d569e88f48aec22eef17c7ee5e2ff8632b26249a3711f38b1
MD5 4a71e02d8e50f071baa4748d1099c654
SHA1 b918a6dc829db2a5d707d6112f199600b7e8dde7
SHA512 8e742a32bcb8f3457509e23fb067b8d242c8fade6a29b9e588f3943b5c2cb219c8dd2e7ae310de3c4735c6e1b68f95ecc11c5f0da703bb2134fb7351192d9fed
SSDEEP 49152:E/IeMc+Onq0ErvhOdupUrapTL2iKeRpJ6iar9F:mUSu5tL2itpHaZF
TLSH
T1B9A58D67F541EAABD934173485B3075B623A6460EF1243CF279936786F933E02F76A80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dominate R6 External.exe

File Explorer

Dominate R6 External.exe

.exe 2.0MB

Dominate R6 External.exe

IMPHASH c67bf4bac5649eaf2c94c5be4938dc57
SHA256 3b529f3892d20e8d569e88f48aec22eef17c7ee5e2ff8632b26249a3711f38b1
MD5 4a71e02d8e50f071baa4748d1099c654
SHA1 b918a6dc829db2a5d707d6112f199600b7e8dde7
SHA512 8e742a32bcb8f3457509e23fb067b8d242c8fade6a29b9e588f3943b5c2cb219c8dd2e7ae310de3c4735c6e1b68f95ecc11c5f0da703bb2134fb7351192d9fed
SSDEEP 49152:E/IeMc+Onq0ErvhOdupUrapTL2iKeRpJ6iar9F:mUSu5tL2itpHaZF
TLSH
T1B9A58D67F541EAABD934173485B3075B623A6460EF1243CF279936786F933E02F76A80
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

458888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA GetStdHandle CreateFileW CloseHandle GetLastError Sleep ExitProcess GetTickCount SetConsoleTextAttribute CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalLock QueryPerformanceCounter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency WideCharToMultiByte MultiByteToWideChar GlobalUnlock GlobalFree GlobalAlloc

user32

SetClipboardData CloseClipboard OpenClipboard SetCursorPos GetWindowThreadProcessId FindWindowA MessageBoxA UpdateWindow GetSystemMetrics SendInput GetAsyncKeyState ShowWindow DestroyWindow PeekMessageW DispatchMessageW TranslateMessage LoadCursorW ScreenToClient ClientToScreen GetCursorPos GetMessageExtraInfo GetClipboardData EmptyClipboard GetKeyboardLayout GetClientRect GetForegroundWindow GetKeyState SetCursor

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

msvcp140

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?setf@ios_base@std@@QEAAHHH@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

vcruntime140

__C_specific_handler __current_exception __current_exception_context _CxxThrowException __std_exception_destroy __std_terminate memcmp strchr memset memmove memcpy memchr __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy strcmp wcslen strlen strncmp strnlen

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func _wfopen __stdio_common_vsscanf fclose fflush fread __p__commode fseek ftell fwrite __stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vsprintf getchar

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

fmodf powf cosf acosf sqrtf __setusermatherr atan2f log logf pow ceilf roundf sinf _fdclass fmaxf

api-ms-win-crt-convert-l1-1-0

strtol atof

api-ms-win-crt-runtime-l1-1-0

__p___argc terminate _register_thread_local_exe_atexit_callback _beginthreadex _c_exit __p___argv _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _errno _cexit _invoke_watson _seh_filter_exe _set_app_type _exit _get_initial_narrow_environment _initterm _initterm_e exit

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale