DuneCore[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DuneCore.exe
Size 967KB
Sample260805-3nefdaycle
SHA256 323d745c343650ee5065e84a4197daa36c5bf7c44d13a9557659ba25fe68b2d7
MD5 1391cc752c08bd494eedef78a3f5cb90
SHA1 12a96ed003c0288360e85999b1a46f7867331f41
SHA512 e4a2a6deb6568be3d55365d3bffe1f63d69dde769d32117a52cc7ee85f6cdecfcdad26da038e319a0240279951eb195d2301460d1ea3b9479a0ad4ab1a9cabfa
SSDEEP 24576:gETTYEsFpbEGO22Xh5yvh0lhSMXlIk5ipnJJqV:g+TYEsFpbEF5fTIpn8
TLSH
T14F25BF05FDA541F8C06AD1B49696B63BEB313C4803A8C6DB17E4B9942F637E0677E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DuneCore.exe

File Explorer

DuneCore.exe

.exe 967KB

DuneCore.exe

IMPHASH 7947687bd5bb10f8d2a054811f584ee6
SHA256 323d745c343650ee5065e84a4197daa36c5bf7c44d13a9557659ba25fe68b2d7
MD5 1391cc752c08bd494eedef78a3f5cb90
SHA1 12a96ed003c0288360e85999b1a46f7867331f41
SHA512 e4a2a6deb6568be3d55365d3bffe1f63d69dde769d32117a52cc7ee85f6cdecfcdad26da038e319a0240279951eb195d2301460d1ea3b9479a0ad4ab1a9cabfa
SSDEEP 24576:gETTYEsFpbEGO22Xh5yvh0lhSMXlIk5ipnJJqV:g+TYEsFpbEF5fTIpn8
TLSH
T14F25BF05FDA541F8C06AD1B49696B63BEB313C4803A8C6DB17E4B9942F637E0677E702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

650244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Recso\Desktop\dcplus\bin\Release\x64\dcplus.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GetLastError GetProcAddress OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter GetStdHandle GetConsoleMode SetConsoleMode GetCurrentConsoleFontEx SetCurrentConsoleFontEx GetConsoleScreenBufferInfoEx SetConsoleScreenBufferInfoEx GetConsoleWindow SetConsoleWindowInfo SetConsoleScreenBufferSize SetConsoleCursorInfo FlushConsoleInputBuffer SetConsoleTitleA CloseHandle GetExitCodeProcess CreateToolhelp32Snapshot Process32FirstW lstrcmpiW Process32NextW OpenProcess Module32FirstW ReadProcessMemory lstrcmpW Module32NextW GetTickCount64 TerminateProcess LoadLibraryExW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetCurrentThreadId Sleep SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive SetConsoleCP SetConsoleOutputCP GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW

user32

GetClipboardData SetClipboardData SetWindowLongW GetWindowLongW RegisterClassExW GetKeyState PeekMessageW LoadCursorW TranslateMessage GetClassInfoExW DispatchMessageW UpdateWindow ShowWindow SetLayeredWindowAttributes GetMessageExtraInfo UnregisterClassW CreateWindowExW GetSystemMetrics DefWindowProcW ScreenToClient PostQuitMessage EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture GetWindowTextW IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout MessageBoxA GetAsyncKeyState TrackMouseEvent ClientToScreen GetCapture GetForegroundWindow DestroyWindow

gdi32

GetStockObject

shell32

ShellExecuteW ShellExecuteA

ole32

CoUninitialize CoInitializeEx

msvcp140

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter _Query_perf_frequency ?_Incref@facet@locale@std@@UEAAXXZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Xbad_alloc@std@@YAXXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$numpunct@D@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xout_of_range@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xbad_function_call@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z _Xtime_get_ticks ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

imm32

ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException __current_exception_context __current_exception __C_specific_handler memset memcpy memcmp memchr strchr memmove

api-ms-win-crt-runtime-l1-1-0

exit _register_thread_local_exe_atexit_callback _c_exit _errno __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe terminate _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _invoke_watson _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr powf pow _dsign _fdsign roundf log sinf fminf fmaxf sqrtf fmodf cosf ceilf _dclass _ldclass _fdclass fmaf _ldsign logf atan2f acosf

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __p__commode _set_fmode fflush getchar setvbuf __stdio_common_vsscanf _wfopen fsetpos __stdio_common_vfprintf fseek __acrt_iob_func ftell fgetpos fclose _get_stream_buffer_pointers fputc ungetc fgetc fread fwrite _fseeki64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-convert-l1-1-0

strtoull atof strtoll strtod

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp wcscpy_s strcmp strncpy

api-ms-win-crt-time-l1-1-0

_localtime64_s