Dominate R6 External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Dominate R6 External.exe
Size 2.0MB
Sample260822-e1v2ws1brc
SHA256 25418000a47129256969bd9f4268e9c2f61500aae4772e8358f55d237b768396
MD5 13fa41ec6ce0fce2de8e24a7c47ba14d
SHA1 0c0c04b3518e364c86b7fd37239693b423e65f7a
SHA512 653e7da87bcb8ae701be953d7269f8960e14b06f898ffce077924450c3a1852f58a20e86fabaf2338fa11e12752c01589c09b866cbe822530200972a01cd4f7c
SSDEEP 49152:gXVQ234xn60ErvR/upMVhapTL2iKeRpJ6iar9F:4/BumAtL2itpHaZF
TLSH
T1FFA58E63F541EAABD534173485B3075B623A7460EB1243CF679936786F933E02F7AA80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dominate R6 External.exe

File Explorer

Dominate R6 External.exe

.exe 2.0MB

Dominate R6 External.exe

IMPHASH 9c61d43c584a38241b21b5e562f8f4b1
SHA256 25418000a47129256969bd9f4268e9c2f61500aae4772e8358f55d237b768396
MD5 13fa41ec6ce0fce2de8e24a7c47ba14d
SHA1 0c0c04b3518e364c86b7fd37239693b423e65f7a
SHA512 653e7da87bcb8ae701be953d7269f8960e14b06f898ffce077924450c3a1852f58a20e86fabaf2338fa11e12752c01589c09b866cbe822530200972a01cd4f7c
SSDEEP 49152:gXVQ234xn60ErvR/upMVhapTL2iKeRpJ6iar9F:4/BumAtL2itpHaZF
TLSH
T1FFA58E63F541EAABD534173485B3075B623A7460EB1243CF679936786F933E02F7AA80
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

469120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA GetStdHandle CreateFileW CloseHandle GetLastError Sleep ExitProcess GetTickCount SetConsoleTextAttribute CreateToolhelp32Snapshot GlobalLock QueryPerformanceCounter GlobalUnlock InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency WideCharToMultiByte MultiByteToWideChar Process32NextW GlobalFree GlobalAlloc Process32FirstW

user32

SetClipboardData CloseClipboard OpenClipboard GetWindowThreadProcessId FindWindowA MessageBoxA UpdateWindow GetSystemMetrics SendInput GetAsyncKeyState ShowWindow DestroyWindow PeekMessageW DispatchMessageW TranslateMessage LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetClipboardData GetKeyState GetForegroundWindow GetMessageExtraInfo GetKeyboardLayout EmptyClipboard

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

msvcp140

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?setf@ios_base@std@@QEAAHHH@Z ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z

vcruntime140

__std_exception_destroy _CxxThrowException __C_specific_handler __current_exception __current_exception_context __std_exception_copy strchr memset memmove memcpy memchr __std_terminate memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

fflush _set_fmode fclose _wfopen __acrt_iob_func __stdio_common_vsprintf_s fseek ftell __p__commode fwrite __stdio_common_vfprintf __stdio_common_vsprintf getchar __stdio_common_vsscanf fread

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

fmodf powf cosf roundf acosf sqrtf __setusermatherr atan2f log logf pow fmaxf ceilf sinf

api-ms-win-crt-string-l1-1-0

wcslen strcmp strncmp strncpy strlen strnlen

api-ms-win-crt-convert-l1-1-0

atof strtol

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback terminate _c_exit _beginthreadex _errno __p___argv __p___argc _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _exit _seh_filter_exe _set_app_type exit _get_initial_narrow_environment _initterm _initterm_e

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale