drvinst[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

drvinst.exe
Size

247KB
MD5

44daf0a410ab80e7cab7c12ede5ffb34
SHA1

2d42a8eaba2829a1641fc580da5e337c75997a99
SHA256

3493630ee740508d0db760a7648470f2987752d9b205ccca805a66c3524e2b58
SHA512

662056f517a0e41ab60ccaf408290fb9b6d71f9f255b3901354b29b91f82de79526ac5a6602a01488bbf3cbdb83a1f8ab3143d7785dbb5f1de735af413b422ee
SSDEEP

6144:JaH7iaH7TaH7BaH7QaH7GaH7UjaomLPwu2:wbBbebobbb9b23mZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
drvinst.exe

Files

drvinst.exe
.exe windows x86

ed4425cf217058da6bdf611263e571dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
_vsnwprintf
wcschr
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
wcsrchr
toupper
memmove
memcpy
_wcsicmp
_vsnprintf
_resetstkoflw
swscanf
_controlfp
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr

ntdll

EtwEventRegister
EtwEventUnregister
EtwTraceMessage
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlNtStatusToDosError
NtSetInformationFile
NtQueryInformationFile
DbgPrintEx
NtQueryInformationProcess
EtwEventWrite
WinSqmSetDWORD
WinSqmSetString
WinSqmEndSession
WinSqmStartSession
RtlUpcaseUnicodeString
RtlInitUnicodeStringEx
NtQuerySystemInformation

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetErrorMode
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

FileTimeToSystemTime
WriteFile
CreateFileW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-interlocked-l1-1-0

InterlockedCompareExchange
InterlockedExchange

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary
GetProcAddress
GetModuleHandleW
LoadLibraryExA
GetModuleHandleA

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile

api-ms-win-core-misc-l1-1-0

lstrcmpiW
lstrlenW
LocalAlloc
LocalFree
Sleep

api-ms-win-core-processthreads-l1-1-0

ExitProcess
OpenProcessToken
SetThreadToken
OpenThreadToken
GetCurrentProcess
ExitThread
GetCurrentThreadId
CreateThread
TerminateProcess
GetExitCodeThread
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-synch-l1-1-0

SetEvent
OpenEventW
WaitForMultipleObjectsEx
CreateEventW
OpenProcess
ReleaseMutex
WaitForSingleObjectEx
CreateMutexW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-security-base-l1-1-0

CheckTokenMembership
DuplicateTokenEx
GetTokenInformation
FreeSid
IsValidSid
AllocateAndInitializeSid
InitializeAcl
AdjustTokenPrivileges
GetKernelObjectSecurity
CopySid
GetLengthSid
EqualSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx

setupapi

SetupDiSetDevicePropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
pSetupDiGetStrongNameForDriverNode
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
CM_Get_DevNode_Status
SetupDiCallClassInstaller
SetupDiSetDriverInstallParamsW
SetupDiGetDriverInstallParamsW
SetupDiEnumDriverInfoW
SetupDiGetClassPropertyW
SetupDefaultQueueCallbackW
SetupOpenInfFileW
SetupDiGetINFClassW
SetupFindNextMatchLineW
SetupDiDestroyDriverInfoList
SetupDiGetDeviceInstanceIdW
SetupDiSetSelectedDriverW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
pGetDriverPackageHash
SetupGetInfDriverStoreLocationW
SetupDiInstallClassW
SetupDiSetClassPropertyW
pSetupStringFromGuid
SetupDiReportAdditionalSoftwareRequested
SetupDiReportGenericDriverInstalled
SetupDiReportPnPDeviceProblem
pSetupDiCrimsonLogDeviceInstall
SetupCloseFileQueue
SetupUninstallNewlyCopiedInfs
SetupTermDefaultQueueCallback
SetupGetFileQueueFlags
SetupPromptReboot
SetupCommitFileQueueW
SetupInitDefaultQueueCallbackEx
SetupScanFileQueueW
SetupSetFileQueueFlags
SetupOpenFileQueue
CM_Set_DevNode_Problem
SetupDiReportDriverNotFoundError
SetupDiOpenDevRegKey
SetupDiBuildDriverInfoList
SetupCopyOEMInfW
SetupInstallLogCloseEventGroup
pSetupSetGlobalFlags
pSetupGetGlobalFlags
SetupInstallLogCreateEventGroup
SetupDiGetClassInstallParamsW
SetupDiSetClassInstallParamsW
SetupVerifyInfFileW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsExW
CM_Setup_DevNode
SetupDiRemoveDevice
SetupFindFirstLineW
SetupGetStringFieldW
SetupDiGetActualModelsSectionW
SetupGetFieldCount
SetupFindNextLine
SetupCloseInfFile
pSetupSetDriverPackageRestorePoint
pSetupValidateDriverPackage
SetupGetNonInteractiveMode
SetupSetThreadLogToken
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInfoW
pSetupDiBuildInfoDataFromStrongName
SetupDiReportDeviceInstallError
SetupDiGetDevicePropertyW
SetupDiDestroyDeviceInfoList
SetupGetThreadLogToken
SetupWriteTextLog
pSetupDoLastKnownGoodBackup

kernel32

CompareStringW
GetThreadLocale
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
RegEnumValueW
FlushFileBuffers
SetFilePointer
GetVersionExW
GetLocalTime
GetFileSize
DeleteFileW
GetFileInformationByHandle
CreateHardLinkW
FindClose
FindNextFileW
SetFileAttributesW
lstrcmpW
FindFirstFileW
MoveFileExW
GetCommandLineA
CreateFileMappingW
SetEndOfFile
CreateDirectoryW
GetFileAttributesW
GetFullPathNameW
LoadLibraryExW
GetCurrentThread
GetModuleFileNameA
GetSystemWindowsDirectoryW
RaiseException
FileTimeToLocalFileTime
lstrlenA
WideCharToMultiByte
DelayLoadFailureHook
GetSystemWow64DirectoryW
LoadLibraryW
GetCommandLineW
LCMapStringW

Sections

.text
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed4425cf217058da6bdf611263e571dd

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

setupapi

kernel32

Sections

.text Size: 237KB - Virtual size: 236KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 237KB - Virtual size: 236KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB