atom[.]dll[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
atom.dll.exe
Size 7.5MB
Sample260816-cd3gcaag23
SHA256 b41017f98f93938550a6655981a500ca5a5a97ea9503e3de89948f8d3cab057b
MD5 16165d3d6ccfd3404b2fd36dbb4cfa81
SHA1 f032e1b825b176def5a5ee56a0fc5579b5d17896
SHA512 944569581d262f351fd2a62311edae814ccf6ba24a33c714f4d2dd273c737a48dad6fc29a26db2d892bba8f9620e2a972ca5ae067509e24745233d38119078df
SSDEEP 196608:URobyBfr2lJOVqKXWcF5t2Q8X3ZYFTSRzOeYT9UMeN/I5us:URobyBfrLgU3KFnZE86eYTOMepx
TLSH
T1B086BE55A3C45AE9D416DA38CB14E332C2B2BD624A76C08B499AF70A1F77E514F3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
atom.dll.exe

File Explorer

atom.dll.exe

.dll 7.5MB

atom.dll.exe

IMPHASH 2d4dda0786e1ceafdd51569972dea026
SHA256 b41017f98f93938550a6655981a500ca5a5a97ea9503e3de89948f8d3cab057b
MD5 16165d3d6ccfd3404b2fd36dbb4cfa81
SHA1 f032e1b825b176def5a5ee56a0fc5579b5d17896
SHA512 944569581d262f351fd2a62311edae814ccf6ba24a33c714f4d2dd273c737a48dad6fc29a26db2d892bba8f9620e2a972ca5ae067509e24745233d38119078df
SSDEEP 196608:URobyBfr2lJOVqKXWcF5t2Q8X3ZYFTSRzOeYT9UMeN/I5us:URobyBfrLgU3KFnZE86eYTOMepx
TLSH
T1B086BE55A3C45AE9D416DA38CB14E332C2B2BD624A76C08B499AF70A1F77E514F3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2457740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

ConvertSidToStringSidW DeregisterEventSource GetTokenInformation ImpersonateLoggedOnUser OpenProcessToken RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW RevertToSelf AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptCreateHash BCryptOpenAlgorithmProvider BCryptHashData BCryptGetProperty BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash

kernel32

K32GetProcessMemoryInfo GetProcessGroupAffinity GetNumaHighestNodeNumber IsProcessInJob VirtualAllocExNuma CloseHandle CloseThreadpoolWork CopyFileExW CreateDirectoryW CreateEventExW CreateFileW CreateThread CreateThreadpoolTimer CreateThreadpoolWork DeleteCriticalSection DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FormatMessageW FreeLibrary GetCPInfoExW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetFileAttributesExW GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLongPathNameW GetModuleFileNameW GetModuleHandleW GetProcAddress GetStdHandle GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadConsoleW ReadFile ResetEvent ResumeThread SetEvent SetLastError SetNamedPipeHandleState SetThreadErrorMode SetThreadPriority SetThreadpoolTimer Sleep SleepConditionVariableCS SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW ExitProcess TerminateProcess GetModuleHandleExW HeapFree HeapAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap RaiseException GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers SetFilePointerEx FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler RtlRestoreContext VerSetConditionMask CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache CreateMemoryResourceNotification QueryInformationJobObject GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery SleepEx DebugBreak GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock

ole32

CoGetApartmentType CoInitializeEx CoUninitialize CoWaitForMultipleHandles CoCreateGuid

secur32

QuerySecurityContextToken InitializeSecurityContextW GetUserNameExW FreeCredentialsHandle FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleW AcceptSecurityContext QueryContextAttributesW

vcruntime140

memcpy __C_specific_handler_noexcept __CxxFrameHandler3 __std_terminate _purecall __std_type_info_destroy_list __std_exception_copy __std_exception_destroy __C_specific_handler _CxxThrowException memmove memset

vcruntime140_1

__CxxFrameHandler4

0Gnku2rCaR1IHeIdctBPT0Mu 2I6wJZzxO 2i5Izy8iL5P77gvpCtZleFpxAOGI1xk4 2pHPMePqXf6L5 2yaiutb3pfL6EEw5s9O 34ixLgMKsRQKvYKQW 3zototSaqIINyeZhoj4vcQvPzr6DdTMo 5M5KbRfcuo 5VxP5FajV0I33r9LOxG 5ZLEtOpwdwsjNls5Ogb7cZ 6W5lLbjnt8OLhyo6aOEchMg20RALx0 7cVxNlYjnuEGd8qGgR3sG 8f0vzxUl 8nSdhypjBbPI4zsO 982EDucX2 9NNMKrXYg 9g4R0wdTBhRHIEvzP4LL79 BHc6VHoNGpvXxKHmX8cFnV CalculateSequenceHash Cb1k5MYKEAGvZ Ccto6A6nHiF CleanupSingletonStaticDataStorage CreateSingletonStaticData DIwI7xOReTCTHsvGTTLE2MIKzCJhGO DPK3eoheLTL3WObDPp2 DS6fmIdVUG5dR DestroySingletonStaticData Dt76b0EKtFDG9aRu9B7PXOE4ngf2Pe DxkBsGO7wc4Q EF845QAkyj41tmvSM0eELK EWG3XgLrCpRnoPX GetSingletonStaticData GmdBCbtL08Fd IdmAgPLbVsv IsSingletonStaticDataStorageAvailable KUb7VHx2TouEsh6E NdJUV0UuoH4UTT3yCsZ OdjR5Ligkk8CIs8rrKDMNzspU930L6G1 OqMEg3Lr9BIE3C3IB4pyF4WZivM P6oIdiUgAjfBTm9JVr13tfNKsEp31O PAjmcZPBfKxUuzqeANczN PHGKjntFr4S3 PjfSIreVw7p Q7eCXXhHZhKKHnjvPU4mxHEs RoProPU6 SLGetAtomFromString SLGetAtomFromStringW SLGetStringFromAtom SiEwum2snmbyjj1Bg8aensJkkAn3G SxMXlgXqtVQCBwDYENJTVF97oVVRH T0oMzI4ucvHrT8fHpGEml TidbEuoHch5D6GxXhfxG0aLGLlOQ061k U9BBOdhzkvomAKQFxoorrWN VQ3VuCYwNk VXerk2mVWsi9P8 WlFgODWG7UcCgKCjBTa3 X5Vbhk0a1DcZudNDl8qE XPUNaHZlhEhGfN2AEi6 XcrNOS7TIe9jxMgXAE XkWe9kD6DMj7 XpBMphN6QVQGGIwKxco Ytubtm7zzzC ZDd9yatwz7Lp4wADERwlTmF aFcV0mMchmAet5hhYihdvdVs5 aeiGveNqOjCOl9 bNAaut22NNotlEv cBrSyATbpplmT4c8z3R2wKJPqXpj fSMBBUxdTMV20m6xG5Bl6rJ hXjEP3U4Qta hfXgIMQKyK679oB96WuQcPDu8V3gl hyefAsDds1lRoRAlUE5M5BXzeT iUZUpa0Y kt6wxUhnzV9K6qew5FpNDGsSqG4DnD6V ldh5pxZVHQ7UXnX0cmK1QuW9yB9P lf8Wtj6ffhoNKNe8qvhrFBaZrYplYU6e lqshZj698bZLWnxvqk m638qt5qU mCoCyQ7SLnfQxayisttdkPVOWgLc mPiGRrJJRC7AzcpEvrZCHlt8GyQZaoI nkGKamDj6KRhr8rX p2ptXOjP pg9HjGU qbSzqUc4Gt3dcs rdyS1A88xkQKNqFf1gVXg1eXd s0fXWJpAuyospQic3 u3uF1n460XAfGFQoKbzmLmFfDn54Q8ik v3KxNmc67 v8ImmzzkgVkuhZVKYB vqUdR6KOQlaJ3T vvXuVPX5hKFO04s w8sMDMPQN1 wQeAvvmB9C60qgS94ZKIbU y5KBxzj67jN1nXsU4sDqYueNkZHvHlx yV1sYdY8M

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

195KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

atom.dll.exe

advapi32

bcrypt

kernel32

ole32

secur32

vcruntime140

vcruntime140_1

generic