MpRtp[.]dll[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

MpRtp.dll.7z
Size

965KB
MD5

2b270e5847a7f632ecc692cc4260e024
SHA1

702d028b7032d6df6cf68987908b52857d913731
SHA256

c9b513045e36a0461bff0b293da0d08409b3d2f8b464ff6d0c3390b89ddd9462
SHA512

acbf1c46bf6f48160c0091aa832d83655ef1d0f2fe50b8db14f8bfd496683c384279d814c0ad1ecdf0e6619b0d2ea98221ba8e305e2e0405f0d193cad5845e12
SSDEEP

24576:zX3DnQW7gqYm5znYSVkVakVYB5wwiaoOD4+DHfGTW:fQWDYSEVY/wwUQH9

Score

N/A

Malware Config

Signatures

Files

MpRtp.dll.7z
.7z

Password: infected
MpRtp.dll
.dll windows x64

43fd5a1c4bd88c2cce4fded2ce1153e3

Code Sign

33:00:00:03:8c:38:5d:5c:2e:74:83:cc:fb:00:00:00:00:03:8c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/05/2022, 19:23

Not After

04/05/2023, 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:3d:87:7a:98:35:8d:4f:73:fb:6d:78:98:c5:2e:ec:43:d6:36:a3:58:a7:85:3b:60:ff:12:fc:50:d3:91:82
Signer

Actual PE Digest

3c:3d:87:7a:98:35:8d:4f:73:fb:6d:78:98:c5:2e:ec:43:d6:36:a3:58:a7:85:3b:60:ff:12:fc:50:d3:91:82

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

28/11/2022, 11:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
RegDeleteKeyValueW
RegQueryValueExW
RegCloseKey
CloseServiceHandle
QueryServiceStatus
OpenSCManagerW
OpenServiceW
EventWriteString
CredWriteW
CredReadW
CredFree
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LookupAccountNameW
LsaOpenPolicy
CreateServiceW
IsWellKnownSid
LsaNtStatusToWinError
GetSecurityDescriptorSacl
AllocateAndInitializeSid
SetNamedSecurityInfoW
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
DeleteService
ControlService
QueryServiceConfigW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
ControlTraceW
EnableTraceEx2
StartTraceW
EventAccessControl
ConvertStringSidToSidW
EventAccessRemove
GetTokenInformation
CloseTrace
ProcessTrace
OpenTraceW
ConvertSidToStringSidW
RegSetKeyValueW
RegDeleteKeyW
GetLengthSid
IsValidSid
LookupAccountSidW
EqualSid
CopySid
CreateProcessAsUserW
SetThreadToken
DuplicateTokenEx
OpenProcessToken
OpenThreadToken
RevertToSelf
EventUnregister
EventRegister
EventWriteTransfer
ConvertSecurityDescriptorToStringSecurityDescriptorW

kernel32

CloseThreadpoolIo
SetFileCompletionNotificationModes
CreateThreadpoolIo
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
VerifyVersionInfoW
VerSetConditionMask
CancelThreadpoolIo
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
GetVolumePathNameW
K32GetProcessImageFileNameW
CreateFileW
GetFinalPathNameByHandleW
DeviceIoControl
DeleteTimerQueueTimer
GetComputerNameExW
SetThreadPriority
GetThreadPriority
RtlPcToFileHeader
InitializeCriticalSectionEx
RaiseException
EncodePointer
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
HeapReAlloc
HeapSize
WideCharToMultiByte
GetProcessHeap
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleExW
GetModuleHandleW
ExitProcess
HeapAlloc
HeapFree
GetCurrentThread
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
FreeLibrary
GetCurrentThreadId
ProcessIdToSessionId
GetProcessTimes
OpenProcess
GetTickCount64
GetLastError
CloseHandle
StartThreadpoolIo
GetLocalTime
Sleep
FlushFileBuffers
OpenThread
GetSystemInfo
QueryFullProcessImageNameW
GetTickCount
K32GetModuleInformation
GlobalMemoryStatusEx
QueryDosDeviceW
GetLogicalDriveStringsW
UnmapViewOfFile
CompareStringOrdinal
GetFileTime
GetFileSize
DebugBreak
GetFileSizeEx
FindStringOrdinal
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
CompareFileTime
GetProcessId
GetExitCodeProcess
LockResource
SizeofResource
FindResourceW
QueueUserAPC
WaitForMultipleObjectsEx
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
FormatMessageW
OutputDebugStringW
OpenSemaphoreW
CreateMutexExW
LocalFree
K32EnumProcessModules
VirtualQueryEx
K32GetMappedFileNameW
GetVolumeNameForVolumeMountPointW
GlobalFree
GlobalAlloc
SystemTimeToFileTime
ReadFile
CopyFileW
GetSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
CopyFileExW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetVersionExW
GetProductInfo
SetFileTime
InitializeSRWLock
CreateThread
InitializeCriticalSection
GetModuleHandleA
GetModuleFileNameW
GetSystemDirectoryW
DuplicateHandle
GetSystemWow64DirectoryW
CreateSemaphoreW
CreateFileMappingW
MapViewOfFile
VirtualQuery
CreateDirectoryW
CreateTimerQueueTimer
WriteFile
ExpandEnvironmentStringsW
SetEnvironmentVariableW
ChangeTimerQueueTimer
LoadLibraryW
SetFilePointerEx
FormatMessageA
QueryPerformanceFrequency
SwitchToThread
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
VirtualProtect
LoadLibraryExA
TryAcquireSRWLockExclusive
GetFileInformationByHandleEx
FindFirstFileExW
SetEndOfFile
GetFileAttributesExW
InitOnceBeginInitialize
InitOnceComplete
DecodePointer
LCMapStringEx
CompareStringEx
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetTimeZoneInformation
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
WriteConsoleW
Module32FirstW
Module32NextW
VirtualFreeEx
IsWow64Process
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetExitCodeThread
RtlCompareMemory
CreateNamedPipeW
ConnectNamedPipe
GetOverlappedResult
CreateEventExW
K32GetModuleFileNameExW
SleepEx
WaitForSingleObject
LoadResource
GetFileAttributesW

mpclient

MpConfigGetValueAlloc
MpConfigSetValue
MpConfigClose
MpConfigRegisterForNotifications
MpConfigUnregisterNotifications
MpGetCopyAcceleratorProcessStatus
MpShutdownCopyAcceleratorProcess
MpUtilsExportFunctions
MpHandleClose
MpClientUtilExportFunctions
MpConfigOpen
MpConfigDelValue
MpConfigGetValue
MpManagerOpen
MpManagerVersionQuery
MpFreeMemory
MpAllocMemory

urlmon

MkParseDisplayNameEx

crypt32

CertFreeCertificateContext
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CryptUnprotectMemory

rpcrt4

UuidToStringW
UuidFromStringW
UuidCreate
RpcStringFreeW

userenv

ExpandEnvironmentStringsForUserW

wintrust

WTHelperProvDataFromStateData
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
WinVerifyTrust
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle
WTHelperGetProvSignerFromChain
CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext

ntdll

RtlCompareUnicodeString
NtMapViewOfSection
NtQueryEaFile
RtlInitUnicodeString
NtDeviceIoControlFile
NtWaitForSingleObject
RtlPrefixUnicodeString
NtClose
RtlNtStatusToDosError
RtlGetVersion
RtlLengthSid
NtCreateFile

bcrypt

BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

api-ms-win-core-path-l1-1-0

PathCchRemoveBackslash

mpr

WNetAddConnection2W
WNetCancelConnection2W

winspool.drv

GetPrinterDataW
OpenPrinterW
ClosePrinter

xmllite

CreateXmlReader
CreateXmlWriter

Exports

Exports

MpPluginBypassDlpWarning
MpPluginCheckAccessForClipboardOperation
MpPluginCheckAccessForDragDropOperation
MpPluginCheckAccessForDragDropOperation2
MpPluginCheckAccessForPrintOperation
MpPluginCheckExclusion
MpPluginConfigChange
MpPluginConfigDirectoryMonitoring
MpPluginConfigSyncMonitoring
MpPluginCopyAcceleratorSoftShutdown
MpPluginDeviceControlAccessCheck
MpPluginDeviceControlAuthenticateNetworkShare
MpPluginDeviceControlProvidePrintJobData
MpPluginDeviceControlValidateDataDuplicationRemoteLocationConfiguration
MpPluginDismissDlpWarning
MpPluginDlpDelegateEnforcement
MpPluginDlpGetOfficeEnlightenmentMode
MpPluginDlpGetOperationEnforcmentMode
MpPluginDlpInitializeEnforcementMode
MpPluginDlpIsPrintDetoursNeeded
MpPluginDlpNotifyCloseDocumentFile
MpPluginDlpNotifyPostOpenDocumentFile
MpPluginDlpNotifyPostSaveAsDocument
MpPluginDlpNotifyPostStartPrint
MpPluginDlpNotifyPreOpenDocumentFile
MpPluginDlpNotifyPrePrint
MpPluginDlpNotifyPreSaveAsDocument
MpPluginDlpPrinterAccessCheck
MpPluginEnableDeviceControl
MpPluginEnableDlp
MpPluginEnforceDlpClipboard
MpPluginEnforceDlpReadClipboard
MpPluginFilterManagerNotifyUpdatePlatformInProgress
MpPluginFlushLogData
MpPluginFreeTPRegs
MpPluginGetConfigOperations
MpPluginGetCopyAcceleratorState
MpPluginGetDeviceControlSecurityPolicies
MpPluginGetDeviceControlStatus
MpPluginGetDlpNotificationSettings
MpPluginGetHeartBeatData
MpPluginGetOSCopyAcceleratorStatus
MpPluginGetState
MpPluginGetTPRegs
MpPluginGetThreatCategory
MpPluginGetThreatExecInfo
MpPluginGetThreatInfo
MpPluginInitialize
MpPluginIsSuspended
MpPluginNotifyRpcServerStateChange
MpPluginNotifySessionStateChange
MpPluginNotifySetupProgress
MpPluginPurgeFilterCache
MpPluginQueryDlpState
MpPluginQueryRtpMonitoringInfoEx
MpPluginRefreshConfigsinRTP
MpPluginRefreshDlpPolicySettings
MpPluginRefreshPlatformKillbits
MpPluginRegisterFriendlyProcess
MpPluginReportClipboardOwner
MpPluginReportThreadStatus
MpPluginSendBrowserHeartbeat
MpPluginSendUserModeRegistryData
MpPluginSetDefaultConfigs
MpPluginSetDriverUnloadInProgress
MpPluginSetEngine
MpPluginSetHybridModeState
MpPluginSetState
MpPluginSetUserInformation
MpPluginShutdown
MpPluginSignatureChange
MpPluginStop
MpPluginUpdateBrowserActiveTab
MpPluginUpdateFolderGuardData
MpPluginUpdateModuleMonitorData
MpPluginUpdateMonitoringInfo
MpPluginUpdateMonitoringInfoEx
MpPluginUpdateProcessTaintInfo
MpPluginUpdateTPExclusionsState
MpPluginUpdateTPState

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 576KB - Virtual size: 573KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

43fd5a1c4bd88c2cce4fded2ce1153e3

Code Sign

33:00:00:03:8c:38:5d:5c:2e:74:83:cc:fb:00:00:00:00:03:8cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

3c:3d:87:7a:98:35:8d:4f:73:fb:6d:78:98:c5:2e:ec:43:d6:36:a3:58:a7:85:3b:60:ff:12:fc:50:d3:91:82Signer

Signature Validations

Verification

28/11/2022, 11:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

mpclient

urlmon

crypt32

rpcrt4

userenv

wintrust

ntdll

bcrypt

api-ms-win-core-path-l1-1-0

mpr

winspool.drv

xmllite

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 576KB - Virtual size: 573KB

.data Size: 156KB - Virtual size: 163KB

.pdata Size: 96KB - Virtual size: 92KB

.didat Size: 4KB - Virtual size: 696B

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 20KB - Virtual size: 16KB

33:00:00:03:8c:38:5d:5c:2e:74:83:cc:fb:00:00:00:00:03:8c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

3c:3d:87:7a:98:35:8d:4f:73:fb:6d:78:98:c5:2e:ec:43:d6:36:a3:58:a7:85:3b:60:ff:12:fc:50:d3:91:82
Signer

28/11/2022, 11:52
Valid: false

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 576KB - Virtual size: 573KB

.data
Size: 156KB - Virtual size: 163KB

.pdata
Size: 96KB - Virtual size: 92KB

.didat
Size: 4KB - Virtual size: 696B

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 20KB - Virtual size: 16KB