iisrstas[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

iisrstas.exe
Size

37KB
MD5

96fea53fbf6c9907e998cc06d202e9af
SHA1

5413d3ce531e9417455c565a0ebd0b3a24ff77dd
SHA256

bcd8e6029626014bc706e3b8234a59e6d660d7553f8eaea8a17ec6ddc5042161
SHA512

959f8a9cee7b77b83954e8d2bf33a5be54115f4e29880215326f04a407c13eae7d28d86c0e28a916e6a7de5d4a6239ab17b6d6dd3f1428ef8040432992b119a7
SSDEEP

768:Zkysuk2EfG5Y2yEiZwf7i3+M9bpXCpJmOSSlYSEZfNPkSvbpJQ:ZZvkY2bpXSeSlYPrvbpJQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
iisrstas.exe

Files

iisrstas.exe
.exe windows x64

efd7b716dcbd98e5696ea37144214e3b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_strcmpi
swprintf_s
sprintf_s
iswctype
wcscpy_s
_wcsicmp
_initterm
__setusermatherr
_cexit
__C_specific_handler
_fmode
_commode
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
?terminate@@YAXXZ
_XcptFilter
free
_callnewh
malloc
memcpy
memcmp
_wtol
memset

atl

ord32
ord58
ord23
ord17
ord20
ord21
ord16
ord30

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQueryInformationProcess

api-ms-win-security-base-l1-2-0

MakeSelfRelativeSD
AdjustTokenPrivileges
SetSecurityDescriptorOwner
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorGroup

api-ms-win-core-synch-l1-2-0

CreateEventW
EnterCriticalSection
Sleep
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
SetEvent

api-ms-win-core-processenvironment-l1-2-0

GetCommandLineW

api-ms-win-core-com-l1-1-1

CoInitializeEx
CoUninitialize
CoInitializeSecurity

oleaut32

LoadRegTypeLi
SysStringLen
SysFreeString

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

api-ms-win-core-processthreads-l1-1-2

OpenProcess
GetCurrentProcess
OpenProcessToken
CreateThread
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-sysinfo-l1-2-1

GetSystemWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-security-lsalookup-l2-1-1

LookupAccountSidW
LookupPrivilegeValueW

api-ms-win-service-management-l1-1-0

OpenServiceW
CloseServiceHandle
OpenSCManagerW
StartServiceW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
RegisterEventSourceW
ReportEventW

api-ms-win-core-misc-l1-1-0

lstrlenW
lstrcmpiW

ext-ms-win-ntuser-message-l1-1-1

GetMessageW
PostThreadMessageW
DispatchMessageW

iisutil

??0BUFFER@@QEAA@XZ
?Resize@BUFFER@@QEAA_NK@Z
PuDbgPrintError
FreeWellKnownSid
AllocateAndCreateWellKnownSid
SetExplicitAccessSettings
??1BUFFER@@QEAA@XZ

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W
QueryServiceConfig2W
QueryServiceConfigW
QueryServiceStatusEx

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

api-ms-win-service-winsvc-l1-2-0

ControlService
QueryServiceStatus

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-memory-l1-1-2

ReadProcessMemory

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

efd7b716dcbd98e5696ea37144214e3b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

atl

ntdll

api-ms-win-security-base-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-com-l1-1-1

oleaut32

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-misc-l1-1-0

ext-ms-win-ntuser-message-l1-1-1

iisutil

api-ms-win-service-management-l2-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-service-winsvc-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-memory-l1-1-2

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 816B

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 512B - Virtual size: 128B

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 816B

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 512B - Virtual size: 128B