rune64[.]dll | Triage™

General

Target
rune64.dll
Size 508KB
Sample260825-157r5seq9v
SHA256 5e461e17fba2c426cd8e1e62a95d727ab55d31d1112df0f9445431e8fe0e7f5e
MD5 1c9afea86096462c880e79e505926b77
SHA1 8209c6a07ee6600c57efd7d196be12ed17c7eb93
SHA512 3fce015ea44fd958cacc5340b0819c6ed5d48293ae3a668133c41ce12ef7beaeb34eb2bac336d191f8ddac11376ae852bda567c8ee545e9bb4a1a2365e335a25
SSDEEP 12288:lwKGGjfkBLlF4y1yg8R5TEuRH/l5QfIoV:WKGGjfk1lF4y1yg8jTEuRHtN8
TLSH
T1D3B46C5AA75910F6E07BE23CCA83460BE27278158771D7DF03A187AA1F237E4563E361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rune64.dll

File Explorer

rune64.dll

.dll 508KB

rune64.dll

IMPHASH 4ffcc852728a29a32ffae4c3b1d4d3c8
SHA256 5e461e17fba2c426cd8e1e62a95d727ab55d31d1112df0f9445431e8fe0e7f5e
MD5 1c9afea86096462c880e79e505926b77
SHA1 8209c6a07ee6600c57efd7d196be12ed17c7eb93
SHA512 3fce015ea44fd958cacc5340b0819c6ed5d48293ae3a668133c41ce12ef7beaeb34eb2bac336d191f8ddac11376ae852bda567c8ee545e9bb4a1a2365e335a25
SSDEEP 12288:lwKGGjfkBLlF4y1yg8R5TEuRH/l5QfIoV:WKGGjfk1lF4y1yg8jTEuRHtN8
TLSH
T1D3B46C5AA75910F6E07BE23CCA83460BE27278158771D7DF03A187AA1F237E4563E361
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

209016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

UnmapViewOfFile GetModuleHandleA CreateFileA DisableThreadLibraryCalls CloseHandle CreateThread GetFileSize CreateFileMappingW MapViewOfFile WriteConsoleW CreateFileW HeapSize GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId GetLastError WaitForSingleObjectEx Sleep GetExitCodeThread GetLogicalProcessorInformationEx RtlPcToFileHeader RaiseException QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WideCharToMultiByte MultiByteToWideChar LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First SuspendThread ResumeThread CreateToolhelp32Snapshot HeapReAlloc HeapAlloc GetThreadContext GetProcAddress GetCurrentProcessId GetModuleHandleW FlushInstructionCache SetThreadContext OpenThread VirtualFree VirtualAlloc GetSystemInfo VirtualQuery SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent ExitProcess TerminateProcess GetModuleFileNameW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType GetFileAttributesExW SetFilePointerEx FindClose FindFirstFileExW

ws2_32

accept bind closesocket select shutdown listen WSASocketW getaddrinfo WSACleanup getpeername getsockname send socket ntohs recv freeaddrinfo getnameinfo setsockopt WSAStartup

Name

.text

Size

331KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rune64.dll

kernel32

ws2_32

generic