lsass[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

lsass.exe
Size

21KB
MD5

48f5d0fc306752d4f93042d490666abd
SHA1

3e237cfac70722fc488813e13822c7cb414fe6c0
SHA256

9dd0a72ef85c6c8d17bcd160b24167a47294cc073eeea2600a5e829f5e621c36
SHA512

f4dbb4c0be6f39e4934fbe3d98b49571c3861c6b4e389b64c35b62af270b4971e40622e923927fe0e0b0c2f454b7fcf37225c946cb538a88124d23ecc0d1fe08
SSDEEP

384:Vxrg659cTm8UlbudbUhR08AqB6Ty0qNWKdzLWg0:Vxrg6592BU0dg/0Nq/pLza

Score

1^/10

Malware Config

Signatures

Files

lsass.exe
.exe windows x86

cd34303891171fb5835b5bd38eea5ec5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__commode
__p__fmode
__setusermatherr
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
memcpy
memset
strcpy_s
_vsnprintf_s

ntdll

NtCreatePort
NtConnectPort
NtListenPort
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
NtSetSecurityObject
NtOpenEvent
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
RtlSetProcessIsCritical
NtSetInformationProcess
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
NtSetInformationFile
RtlCreateSecurityDescriptor
RtlLengthSid
RtlSetOwnerSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
RtlAllocateAndInitializeSid
RtlAddMandatoryAce
RtlSetSaclSecurityDescriptor
RtlMakeSelfRelativeSD
RtlUnhandledExceptionFilter
DbgPrintEx
NtRequestWaitReplyPort

rpcrt4

I_RpcMapWin32Status
RpcServerRegisterIf2
RpcServerListen
RpcServerUseProtseqEpW
NdrServerCall2

sspisrv

SspiSrvInitialize
SspiSrvClientCallback

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetErrorMode
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedCompareExchange
InterlockedExchange

api-ms-win-core-libraryloader-l1-1-0

GetProcAddress
LoadLibraryExW
GetModuleHandleA

api-ms-win-core-localregistry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-misc-l1-1-0

LocalAlloc
LocalFree
Sleep

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
SetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
ExitThread
CreateThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

SetEvent
OpenEventW
CreateEventW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-1-0

GetTokenInformation

Exports

Exports

LsaGetInterface
LsaRegisterExtension

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd34303891171fb5835b5bd38eea5ec5

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

rpcrt4

sspisrv

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.data Size: 1024B - Virtual size: 972B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 872B

.text
Size: 16KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 972B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 872B