USERENV[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

USERENV.dll
Size

401KB
MD5

f96987f056bf5e133ea49ec23dba05e3
SHA1

c86abb4feecb9ad243555a313323185d8c5524d7
SHA256

e2bfcbd500540d3cc2e50fa1ac9f838ea128dc0d64fea48da7517c0e11573fe0
SHA512

364824f5b524e735b2d2c3d51227d28462d1cfade56c334546d294bc2eeab38ffb9562b593ca44bcf65d00a9815e8e402f67bde87716febc4b25840676126cc2
SSDEEP

6144:qhtWRPMP2k1ajPhL6Q4Z15zmVlVRY5OLep8jn+gKE1PPRidzOvMO:qrWR0P8jPhqBzmVqF8z8E1PJGN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
USERENV.dll

Files

USERENV.dll
.dll regsvr32 windows:6 windows x64 arch:x64

7911bd2e09a3c4b909ff5b22b8374be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpGetProxyForUrl
WinHttpOpen
WinHttpDetectAutoProxyConfigUrl
WinHttpGetIEProxyConfigForCurrentUser

kernel32

DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
ReadFile
VirtualProtect
K32GetProcessImageFileNameW
CreateToolhelp32Snapshot
Sleep
GetCurrentThreadStackLimits
CloseHandle
CreateThread
GetProcAddress
GetModuleHandleW
Module32NextW
VirtualQuery
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
FreeLibrary
IsBadReadPtr
MultiByteToWideChar
GetLastError
OutputDebugStringW
WaitForMultipleObjects
PeekNamedPipe
RtlCaptureContext
InitializeCriticalSectionEx
HeapFree
ExpandEnvironmentStringsA
SetLastError
HeapAlloc
GetCurrentProcessId
IsDebuggerPresent
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
LeaveCriticalSection
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetTickCount64
SleepEx
FormatMessageA
WaitForSingleObjectEx
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
GetStdHandle
GetFileType
EnterCriticalSection

user32

CharLowerA

ole32

CoCreateGuid

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z

ws2_32

WSAStartup
WSAGetLastError
socket
__WSAFDIsSet
select
accept
WSASetLastError
recv
send
bind
closesocket
connect
listen
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
ioctlsocket
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
WSACleanup
htonl
ntohl

advapi32

CryptAcquireContextA
CryptGenRandom
CryptGetHashParam
CryptEncrypt
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptReleaseContext

crypt32

CertFreeCertificateContext

wldap32

ord211
ord46
ord143
ord45
ord50
ord60
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord41
ord22

normaliz

IdnToAscii

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr
strrchr
strchr
memchr
__std_type_info_destroy_list
memcmp
__std_exception_destroy
__std_exception_copy
memcpy
_CxxThrowException
__C_specific_handler
memmove
memset

api-ms-win-crt-heap-l1-1-0

calloc
_recalloc
malloc
free
realloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_errno
_initterm
_initterm_e
_crt_atexit
_execute_onexit_table
_seh_filter_dll
_cexit
_register_onexit_function
strerror
__sys_nerr
_beginthreadex
_initialize_narrow_environment
_getpid
_initialize_onexit_table
_configure_narrow_argv

api-ms-win-crt-convert-l1-1-0

strtol
strtoul
strtoll
atoi
wcstombs

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

api-ms-win-crt-string-l1-1-0

isspace
isalnum
isxdigit
strpbrk
isupper
isalpha
_strdup
isgraph
isprint
isdigit
strncmp
strncpy
tolower
islower

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
fputc
fputs
fgets
_open
_close
fflush
__acrt_iob_func
_write
fopen
_lseeki64
fclose
_read
fwrite
fread
__stdio_common_vsprintf
fseek

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_stat64
_access

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

AreThereVisibleLogoffScripts
AreThereVisibleShutdownScripts
CreateAppContainerProfile
CreateEnvironmentBlock
CreateProfile
DeleteAppContainerProfile
DeleteProfileA
DeleteProfileW
DeriveAppContainerSidFromAppContainerName
DeriveRestrictedAppContainerSidFromAppContainerSidAndRestrictedName
DestroyEnvironmentBlock
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EnterCriticalPolicySection
ExpandEnvironmentStringsForUserA
ExpandEnvironmentStringsForUserW
ForceSyncFgPolicy
FreeGPOListA
FreeGPOListW
GenerateGPNotification
GetAllUsersProfileDirectoryA
GetAllUsersProfileDirectoryW
GetAppContainerFolderPath
GetAppContainerRegistryLocation
GetAppliedGPOListA
GetAppliedGPOListW
GetDefaultUserProfileDirectoryA
GetDefaultUserProfileDirectoryW
GetGPOListA
GetGPOListW
GetNextFgPolicyRefreshInfo
GetPreviousFgPolicyRefreshInfo
GetProfileType
GetProfilesDirectoryA
GetProfilesDirectoryW
GetUserProfileDirectoryA
GetUserProfileDirectoryW
HasPolicyForegroundProcessingCompleted
LeaveCriticalPolicySection
LoadProfileExtender
LoadUserProfileA
LoadUserProfileW
ProcessGroupPolicyCompleted
ProcessGroupPolicyCompletedEx
RefreshPolicy
RefreshPolicyEx
RegisterGPNotification
RsopAccessCheckByType
RsopFileAccessCheck
RsopLoggingEnabled
RsopResetPolicySettingStatus
RsopSetPolicySettingStatus
UnloadProfileExtender
UnloadUserProfile
UnregisterGPNotification
VersionExporter
WaitForMachinePolicyForegroundProcessing
WaitForUserPolicyForegroundProcessing

Sections

.text
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7911bd2e09a3c4b909ff5b22b8374be0

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

kernel32

user32

ole32

msvcp140

ws2_32

advapi32

crypt32

wldap32

normaliz

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 301KB - Virtual size: 300KB

.rdata Size: 82KB - Virtual size: 81KB

.data Size: 512B - Virtual size: 12KB

.pdata Size: 15KB - Virtual size: 15KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 301KB - Virtual size: 300KB

.rdata
Size: 82KB - Virtual size: 81KB

.data
Size: 512B - Virtual size: 12KB

.pdata
Size: 15KB - Virtual size: 15KB

.reloc
Size: 1KB - Virtual size: 1KB