pid[.]5164[.]InstallAssistService[.]exe[.]0xdd2c50[.]0x9a0000[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target

pid.5164.InstallAssistService.exe.0xdd2c50.0x9a0000.dmp
Size

228KB
MD5

51acac882375db93431a93f26843a5ba
SHA1

26353d678d3dce0d0755f0016330a812f46d7c7b
SHA256

d8e7275db3e86b960833e32d77f5d0971e36c1e23fbb33d8e994db0b9233880e
SHA512

5036b3e48c0fe8ab04a0ad69d6d1441c7349c56d53e96057184cb2746e5df06794326e37bfe93064c8d69c64bbe329985260b746d48097c0948e989cfa3ef7a7
SSDEEP

3072:ZdLK3LZYBvYtCVZjkcAvv7G99A/m/D44awHvvyY15x:LLO5wJknLGTA/6v/PKY/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pid.5164.InstallAssistService.exe.0xdd2c50.0x9a0000.dmp

Files

pid.5164.InstallAssistService.exe.0xdd2c50.0x9a0000.dmp
.exe windows:5 windows x86

a1de771a29e23cb8d23e63250818b5c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
Sleep
WTSGetActiveConsoleSessionId
GetCurrentProcess
CloseHandle
QueueUserWorkItem
CreateEventW
GetLastError
SetEvent
WaitForSingleObject
CompareStringW
GetProcessHeap
SetEndOfFile
CreateFileW
CreateFileA
WriteConsoleW
SetStdHandle
LoadLibraryW
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
GetLocaleInfoW
GetStringTypeW
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WriteFile
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetFileAttributesA
CreateDirectoryA
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
GetCommandLineW
HeapSetInformation
RaiseException
GetCPInfo
RtlUnwind
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
HeapCreate
ExitProcess
ReadFile
SetFilePointer
SetEnvironmentVariableA

advapi32

EqualSid
ControlService
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
ReportEventW
RegisterServiceCtrlHandlerW
SetServiceStatus
DeregisterEventSource
StartServiceCtrlDispatcherW
RegisterEventSourceW
FreeSid
OpenProcessToken
GetTokenInformation
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
AllocateAndInitializeSid

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

wtsapi32

WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

ws2_32

sendto
bind
socket
closesocket
setsockopt
getsockname
ntohs
WSAStartup
recvfrom
htons
htonl
inet_addr

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1de771a29e23cb8d23e63250818b5c4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

oleaut32

wtsapi32

userenv

ws2_32

Sections

.text Size: 140KB - Virtual size: 140KB

.rdata Size: 28KB - Virtual size: 28KB

.data Size: 16KB - Virtual size: 16KB

.rsrc Size: 28KB - Virtual size: 28KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 140KB - Virtual size: 140KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 28KB - Virtual size: 28KB

.reloc
Size: 12KB - Virtual size: 12KB