r6_dumper[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
r6_dumper.exe
Size 603KB
Sample261027-xrfjysec84
SHA256 e9908aa940ea60312dc5c433fd3c6589b8446d1f7aa1b529063dee917d9b15b0
MD5 54eb396b37f71b568f2128747a9aa9c2
SHA1 0ef9270f529e282764dab680162cf699722781e3
SHA512 8e15a8a5bdbfab9bc07c5249e8d810c10dada067dbe805f82fa104948b6dad0d2edfa6eb10edd260204c1a9a22053dd6204b2780db3b545a82592f6b4926d402
SSDEEP 6144:vTEUdYCfjq+wyl8f0+hqaDX97d6FY9fKeK+ycSCqWfc3s3x1i8DvDh2djEr5m9Hi:QUn++RabX6eQeHycSP3s3X3WErs9HYP
TLSH
T180D48D35A2A500FCD27BC5B88B525953F676784703705AEF139046A72F2BAE41F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
r6_dumper.exe

File Explorer

r6_dumper.exe

.exe 603KB

r6_dumper.exe

IMPHASH 3fbb8d360d94257e2918e48df631a956
SHA256 e9908aa940ea60312dc5c433fd3c6589b8446d1f7aa1b529063dee917d9b15b0
MD5 54eb396b37f71b568f2128747a9aa9c2
SHA1 0ef9270f529e282764dab680162cf699722781e3
SHA512 8e15a8a5bdbfab9bc07c5249e8d810c10dada067dbe805f82fa104948b6dad0d2edfa6eb10edd260204c1a9a22053dd6204b2780db3b545a82592f6b4926d402
SSDEEP 6144:vTEUdYCfjq+wyl8f0+hqaDX97d6FY9fKeK+ycSCqWfc3s3x1i8DvDh2djEr5m9Hi:QUn++RabX6eQeHycSP3s3X3WErs9HYP
TLSH
T180D48D35A2A500FCD27BC5B88B525953F676784703705AEF139046A72F2BAE41F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

276656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

user32

CreatePopupMenu GetMessageA TranslateMessage DispatchMessageA SetProcessDPIAware LoadIconA LoadCursorA FillRect MessageBoxA GetClientRect GetWindowTextLengthA GetWindowTextW SetWindowTextA InvalidateRect UpdateWindow DrawTextW SendMessageA AppendMenuA CreateMenu DrawMenuBar SetMenu EnableWindow MoveWindow ShowWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageA

gdi32

SetTextColor SetBkMode SetBkColor SelectObject Rectangle GetStockObject DeleteObject CreateSolidBrush CreatePen CreateFontA

dwmapi

DwmSetWindowAttribute

uxtheme

SetWindowTheme

kernel32

FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage GetCommandLineW ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize SetEndOfFile WriteConsoleW GetTimeZoneInformation IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetCommandLineA CreateDirectoryA GetTempPathA CloseHandle GetLastError OpenProcess GetTickCount64 VirtualQueryEx ReadProcessMemory GetModuleFileNameA GetProcAddress LoadLibraryExA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetTimeFormatW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetModuleFileNameW GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW GetDateFormatW RtlUnwind

Name

.text

Size

438KB

Virtual Size

437KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

r6_dumper.exe

comctl32

user32

gdi32

dwmapi

uxtheme

kernel32

generic