sdclt[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sdclt.exe
Size

1.1MB
MD5

1bef9c1bb0d98f9c3aa95a4a0f7afba0
SHA1

d129e4fdbf4fea7133a59d91c3e307c1a22af907
SHA256

101466f431c78a6636723cd5764deac14c6a3faa61f912dcd92e3636e6d8bd0b
SHA512

ff379e5e6763639108d1660957db7ca9cd311aa6bf7e049377a3ea28093126a4fe80287669af9bf72f5dee183b6681bc503404cd59bf8fc3174be72ce1a63836
SSDEEP

24576:YcItMH67gvZemf1CxmdiglWauBz2ah9yptQHZ7RHegR:9HKFmf1CsTlWau0aaQ5dH9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sdclt.exe

Files

sdclt.exe
.exe windows:10 windows x86

c7b747ce75c5c31a2bb0e3ac2a25aaec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

ExtTextOutW
ExcludeClipRect
DeleteDC
GdiFlush
SelectObject
SetLayout
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectW
SetTextColor
SetBkColor
DeleteObject
GetDeviceCaps

user32

FindWindowExW
LoadCursorW
SetCursor
DestroyCursor
GetSystemMetrics
SendMessageW
GetDC
ReleaseDC
GetWindowThreadProcessId
DestroyWindow
PostThreadMessageW
UnregisterClassW
GetDlgCtrlID
CopyRect
GetDesktopWindow
MessageBoxW
EnumWindows
SendMessageTimeoutW
EndPaint
BeginPaint
GetClassNameW
CheckRadioButton
RedrawWindow
DispatchMessageW
SendDlgItemMessageW
SetWindowPos
DeferWindowPos
EqualRect
IsWindowVisible
EndDeferWindowPos
SetDlgItemTextW
MapWindowPoints
GetWindowRect
UpdateWindow
GetClientRect
GetParent
BeginDeferWindowPos
GetWindowTextLengthW
GetAncestor
DrawFrameControl
OffsetRect
InflateRect
ShowWindow
IsWindow
CallWindowProcW
SetWindowLongW
SetWindowTextW
DestroyIcon
GetFocus
GetWindowTextW
GetWindowLongW
CreateDialogParamW
SetForegroundWindow
GetLastActivePopup
SetFocus
GetDlgItem
EnableWindow
TranslateMessage
KillTimer
SetTimer
IsDialogMessageW
DefWindowProcW
PostMessageW
GetClassInfoExW
LoadImageW
GetSysColor
RegisterClassExW
GetSysColorBrush
CreateWindowExW
IsDlgButtonChecked
EndDialog
GetDlgItemTextW
GetMessageW
RegisterWindowMessageW
CheckDlgButton
LoadIconW
SystemParametersInfoW
DialogBoxParamW
ChangeWindowMessageFilterEx

msvcrt

wcsrchr
_except_handler4_common
_controlfp
_wtol
_onexit
__dllonexit
iswspace
_vscwprintf
strchr
wcspbrk
_wcsupr
wcsncmp
memcpy_s
_purecall
_wtoi
free
malloc
_callnewh
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
memset
_vsnwprintf
memmove
wcsstr
wcschr
_wcsicmp
_wcsnicmp
swscanf
__p__fmode
_ismbblead
__setusermatherr
_initterm
_acmdln
_lock
_unlock
memcpy
?terminate@@YAXXZ

spp

SxTracerDebuggerBreak
SxTracerShouldTrackFailure
SxTracerGetThreadContextRetail

reagent

WinReGetConfig

wer

WerReportSubmit
WerReportSetParameter
WerReportAddFile
WerReportCloseHandle
WerReportCreate

oleaut32

SysStringLen
SysAllocString
VariantInit
SysFreeString
SysAllocStringLen

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
TraceMessage
RegisterTraceGuidsW
GetTraceEnableFlags

api-ms-win-core-com-l1-1-1

CLSIDFromString
CoWaitForMultipleHandles
CoInitializeSecurity
CoGetMalloc
PropVariantClear
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoInitializeEx
CoDisconnectObject
CoTaskMemAlloc
CoTaskMemFree
CoGetClassObject
CoUninitialize

api-ms-win-core-synch-l1-2-0

CreateEventW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
ResetEvent
Sleep
InitializeCriticalSectionAndSpinCount
SetEvent

api-ms-win-core-processthreads-l1-1-2

OpenProcess
GetThreadId
CreateProcessW
TlsAlloc
GetCurrentThreadId
GetCurrentProcess
TlsSetValue
TlsGetValue
TerminateProcess
CreateThread
GetCurrentProcessId
ProcessIdToSessionId
OpenProcessToken

api-ms-win-core-errorhandling-l1-1-1

SetErrorMode
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-security-base-l1-2-0

CheckTokenMembership
AdjustTokenPrivileges
DuplicateToken
CreateWellKnownSid
GetTokenInformation
DuplicateTokenEx
EqualSid

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
GetCommandLineW

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc
HeapSetInformation

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegUnLoadKeyW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegLoadKeyW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetLocalTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l1-2-1

GetVolumePathNamesForVolumeNameW
CompareFileTime
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
DeleteFileW
GetDiskFreeSpaceExW
QueryDosDeviceW
FileTimeToLocalFileTime
GetLongPathNameW
CreateDirectoryW
GetFileAttributesW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
CreateFileW

sspicli

GetUserNameExW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

mpr

WNetAddConnection3W

api-ms-win-security-lsalookup-l2-1-1

LookupAccountSidW
LookupPrivilegeValueW

api-ms-win-core-interlocked-l1-2-0

InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureStackBackTrace

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
LoadStringW
FreeLibrary

crypt32

CryptUnprotectMemory
CryptProtectMemory

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-localization-l1-2-1

GetUserDefaultLCID
GetCalendarInfoW
GetLocaleInfoW
FormatMessageW
GetLocaleInfoEx

api-ms-win-core-datetime-l1-1-1

GetDateFormatW
GetTimeFormatW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-file-l2-1-1

MoveFileExW

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-core-kernel32-legacy-l1-1-1

WTSGetActiveConsoleSessionId
GetStartupInfoA
GetComputerNameW

api-ms-win-core-localization-obsolete-l1-3-0

GetNumberFormatW

ext-ms-win-kernel32-windowserrorreporting-l1-1-1

RegisterApplicationRestart

shell32

ord16
SHBindToObject
SHBindToParent
ord727
ShellExecuteW
SHGetDesktopFolder
ord77
SHGetIDListFromObject
SHSetTemporaryPropertyForItem
SHCreateItemFromParsingName
SHBrowseForFolderW
ord102
ShellExecuteExW
SHGetSpecialFolderLocation
ord155
CommandLineToArgvW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetStockIconInfo
SHParseDisplayName
ord75

uxtheme

SetWindowTheme

ole32

CreateClassMoniker
GetRunningObjectTable
CreateBindCtx

shlwapi

PathCompactPathExW
PathIsNetworkPathW
ord172
PathFileExistsW
StrRetToBufW
SHAutoComplete
PathIsDirectoryW
ord174
ord219
PathFindFileNameW

comctl32

ImageList_ReplaceIcon
ImageList_Destroy
ImageList_AddMasked
ImageList_Add
ord345
InitCommonControlsEx
PropertySheetW
ImageList_Create
ord344

ntdll

RtlEnumerateGenericTableWithoutSplayingAvl
RtlCheckPortableOperatingSystem
RtlGetThreadErrorMode
NtSetInformationFile
RtlGetLastNtStatus
NtSetInformationProcess
RtlNtStatusToDosError
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableAvl
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
NtQuerySystemInformation
RtlSetThreadErrorMode
NtSetInformationKey
NtQueryKey
NtQueryVolumeInformationFile
NtQueryInformationFile
EtwTraceMessage
WinSqmAddToStreamEx
RtlFreeHeap
RtlAllocateHeap
WinSqmAddToStream

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

vssapi

GetProviderMgmtInterfaceInternal
CreateVssBackupComponentsInternal
VssFreeSnapshotPropertiesInternal

bcd

BcdOpenObject
BcdGetElementData
BcdCloseObject
BcdQueryObject
BcdCloseStore
BcdOpenSystemStore

api-ms-win-eventing-controller-l1-1-0

StartTraceW
EnableTraceEx2
ControlTraceW

Sections

.text
Size: 455KB - Virtual size: 454KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 614KB - Virtual size: 613KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7b747ce75c5c31a2bb0e3ac2a25aaec

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

spp

reagent

wer

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-2-1

sspicli

api-ms-win-core-util-l1-1-0

mpr

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

crypt32

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-localization-obsolete-l1-3-0

ext-ms-win-kernel32-windowserrorreporting-l1-1-1

shell32

uxtheme

ole32

shlwapi

comctl32

ntdll

wtsapi32

vssapi

bcd

api-ms-win-eventing-controller-l1-1-0

Sections

.text Size: 455KB - Virtual size: 454KB

.data Size: 5KB - Virtual size: 9KB

.idata Size: 12KB - Virtual size: 12KB

.rsrc Size: 614KB - Virtual size: 613KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 455KB - Virtual size: 454KB

.data
Size: 5KB - Virtual size: 9KB

.idata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 614KB - Virtual size: 613KB

.reloc
Size: 17KB - Virtual size: 17KB