rkt[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rkt.exe
Size 6.0MB
Sample261024-nmhn3styb1
SHA256 bac7e40d0bdcf4ecc1c0a07d80a9960931d3297266ef29976b8b457dc39f5ff7
MD5 8f610a10bb3e358a0c3168c7bffa8251
SHA1 3b0fe063edd091e537021a170635d660ed1eb607
SHA512 1e0af74156793733c39cb919a7890bb81cf86bf0405ac1cb7c243bc038626cbcc0c2c8ec91450eb86d7f00f58bf5cc79f9c50ac82b9aaa699fa02cd30b075009
SSDEEP 49152:tv1lWUQu7YtQn20qIz9CTR37wh/qNwffAj3g/bTqSk6snM9EQAOcVsS:YJ4f/lgQ/6SjEQAOAsS
TLSH
T1D556B09EF29BCFAAC152837C8F90773361F23E14232173E77E828A6E54569D485F4606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rkt.exe

File Explorer

rkt.exe

.exe 6.0MB

rkt.exe

IMPHASH b3da054b12e57b13fa725b5157a14e31
SHA256 bac7e40d0bdcf4ecc1c0a07d80a9960931d3297266ef29976b8b457dc39f5ff7
MD5 8f610a10bb3e358a0c3168c7bffa8251
SHA1 3b0fe063edd091e537021a170635d660ed1eb607
SHA512 1e0af74156793733c39cb919a7890bb81cf86bf0405ac1cb7c243bc038626cbcc0c2c8ec91450eb86d7f00f58bf5cc79f9c50ac82b9aaa699fa02cd30b075009
SSDEEP 49152:tv1lWUQu7YtQn20qIz9CTR37wh/qNwffAj3g/bTqSk6snM9EQAOcVsS:YJ4f/lgQ/6SjEQAOAsS
TLSH
T1D556B09EF29BCFAAC152837C8F90773361F23E14232173E77E828A6E54569D485F4606
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1326448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Järjestelmänvalvoja\Downloads\rocket\rocket\Rocket\No

d3dx9_43

D3DXMatrixTranspose D3DXVec3Transform

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId SleepConditionVariableSRW GetFileSizeEx CreateFileA VerifyVersionInfoW SleepEx Sleep PeekNamedPipe ReadFile GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA GetSystemDirectoryA DeleteCriticalSection InitializeCriticalSectionEx EnterCriticalSection GetTickCount FormatMessageW AcquireSRWLockExclusive ReleaseSRWLockExclusive AllocConsole Module32NextW GetConsoleWindow Module32FirstW Process32FirstW Process32NextW ReadProcessMemory SetLastError GetModuleHandleW GetFileInformationByHandleEx WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcessId CloseHandle OpenProcess QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress CreateToolhelp32Snapshot GetLastError WriteProcessMemory LeaveCriticalSection QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock CreateThread GlobalFree GlobalAlloc MultiByteToWideChar CreateFile2 WaitForMultipleObjects AreFileApisANSI

user32

TrackMouseEvent ReleaseCapture GetClientRect ClientToScreen SetCapture ScreenToClient GetKeyState GetAsyncKeyState GetSystemMetrics SetCursor GetCapture LoadCursorW EnumWindows DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage SetWindowLongW PostQuitMessage UpdateWindow SetForegroundWindow SetWindowDisplayAffinity mouse_event SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetWindowThreadProcessId SetCursorPos GetCursorPos GetForegroundWindow

advapi32

CryptDestroyHash RegOpenKeyExW RegCloseKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyKey CryptEncrypt CryptImportKey RegQueryValueExW

shell32

ShellExecuteW

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

WSACloseEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs send gethostname WSASetLastError WSAStartup WSACleanup setsockopt WSAIoctl htons socket __WSAFDIsSet select accept bind connect WSACreateEvent getsockname htonl getsockopt ioctlsocket listen recv getpeername getaddrinfo freeaddrinfo sendto recvfrom

crypt32

CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertFreeCertificateChainEngine CertEnumCertificatesInStore CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertOpenStore CertCloseStore CertGetCertificateChain CertFreeCertificateChain

wldap32

ord46 ord211 ord60 ord45 ord50 ord217 ord22 ord26 ord27 ord32 ord143 ord301 ord33 ord35 ord79 ord30 ord200 ord41

normaliz

IdnToAscii IdnToUnicode

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Mtx_lock _Mtx_unlock ?uncaught_exceptions@std@@YAHXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmAssociateContextEx

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memset strrchr memchr memmove memcmp __current_exception __current_exception_context __C_specific_handler _CxxThrowException __std_exception_copy __std_exception_destroy __std_terminate strstr strchr

api-ms-win-crt-stdio-l1-1-0

fread fputs freopen_s feof fopen _close _fileno _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos _write _read fgetc fputc _open fgets __p__commode _set_fmode __stdio_common_vsscanf __stdio_common_vsprintf_s _lseeki64 __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func ftell

api-ms-win-crt-string-l1-1-0

_strdup wcslen strcmp strspn strpbrk strncpy strcpy_s strncmp strcspn strlen _wcsicmp

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-heap-l1-1-0

realloc malloc calloc free _set_new_mode _callnewh

api-ms-win-crt-time-l1-1-0

_time64 strftime _gmtime64

api-ms-win-crt-convert-l1-1-0

strtoull strtoul strtol atoi strtoll wcstombs atof strtod

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _exit _get_wide_winmain_command_line _c_exit _register_thread_local_exe_atexit_callback _initialize_wide_environment _configure_wide_argv _set_app_type exit _cexit _crt_atexit _beginthreadex terminate _register_onexit_function _initialize_onexit_table __sys_nerr _errno abort __sys_errlist _seh_filter_exe

api-ms-win-crt-filesystem-l1-1-0

_lock_file _stat64 _access _fstat64 _unlink _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-math-l1-1-0

atan2f powf ceilf acosf _dsign _fdopen fmodf log logf sinf cosf sqrt __setusermatherr sqrtf pow