runtime[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
runtime.dll.exe
Size 314KB
Sample261110-z9m3vsbc79
SHA256 b62220191f940c681ae090deae9ba3c53fff593b2202464dd8dcecc567c1c5e9
MD5 c4b02fd5389930f89bf552da72d0036b
SHA1 d88e6f56aff93a6a1a39f583c8e13359279f8333
SHA512 d42f2f278ce08caad5fb6567c92a85071c2bec51a6f0be0d655518f1d5b622b7d031e8643f9bab050ed8b4de4bc5b9c626e73c8c3146a4701b5154acb2346851
SSDEEP 6144:P81rjcY7WeWbg09gT+b1qcGLShIfKHwNhhpzUN+oCeL:POrlWXb4vhpY
TLSH
T1B364E91BA69358FCC127C0788BBAA773B431B86C41386E6B1B95CF313E60F64556DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
runtime.dll.exe

File Explorer

runtime.dll.exe

.dll 314KB

runtime.dll.exe

IMPHASH 4455487fd5fea5b7d63e6526a7fb3bac
SHA256 b62220191f940c681ae090deae9ba3c53fff593b2202464dd8dcecc567c1c5e9
MD5 c4b02fd5389930f89bf552da72d0036b
SHA1 d88e6f56aff93a6a1a39f583c8e13359279f8333
SHA512 d42f2f278ce08caad5fb6567c92a85071c2bec51a6f0be0d655518f1d5b622b7d031e8643f9bab050ed8b4de4bc5b9c626e73c8c3146a4701b5154acb2346851
SSDEEP 6144:P81rjcY7WeWbg09gT+b1qcGLShIfKHwNhhpzUN+oCeL:POrlWXb4vhpY
TLSH
T1B364E91BA69358FCC127C0788BBAA773B431B86C41386E6B1B95CF313E60F64556DB24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

GetUserNameW RegCloseKey RegOpenKeyExW RegQueryValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateFileW DeleteCriticalSection DeleteFileW EnterCriticalSection FindClose FindFirstFileW FindNextFileW FormatMessageA GetComputerNameW GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetFileSizeEx GetLastError GetLocalTime GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTickCount64 GetUserDefaultLocaleName GlobalMemoryStatusEx InitializeCriticalSection LeaveCriticalSection LoadLibraryA LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent Sleep TlsGetValue VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-heap-l1-1-0

calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_errno _execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf _read _wfopen fclose fputc fputs fwrite

api-ms-win-crt-string-l1-1-0

memset strcmp strlen strncmp strnlen wcscmp wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

rand_s

user32

GetDC GetSystemMetrics ReleaseDC

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

Name

.text

Size

259KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

66B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

988B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

runtime.dll.exe

advapi32

bcrypt

crypt32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

winhttp

generic