LogonController[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

LogonController.dll
Size

487KB
MD5

b4aeb4fe33600ed1d75b7211a92f6181
SHA1

260816df83e0fd11e085566114c269213d495b22
SHA256

89cce1c8a714c4d93d69f7d0df3517592eb08e6b0d8f0c0b27ca7bf86c7aa8f6
SHA512

52816ccee959ba6b6a97f60bd145e1f9b3bd58063441046f2cd8e95a27482c7ba5940ca7c449ddbdec6fa86bee78862872efe16a1d65a4d79a41afbef55bab2a
SSDEEP

6144:hLB+q4iJBNtDW4lebT+LAZ8MCxCbUa+dgufap:hL86NtjebT+E6cthga

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LogonController.dll

Files

LogonController.dll
.dll windows:10 windows x86 arch:x86

4ff0d6b997d17be6e05de2b18a399a45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

logoncontroller.pdb

Imports

msvcrt

_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
wcschr
_get_errno
_set_errno
memmove_s
_wtoi
wcstoul
_callnewh
__CxxFrameHandler3
memcpy
memcmp
_ftol2_sse
_CxxThrowException
_wcsicmp
memmove
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
_purecall
??1type_info@@UAE@XZ
memcpy_s
_vsnwprintf
memset

shcore

SHCreateThread
CreateRandomAccessStreamOverStream
SHCreateMemStream
ord190
IsOS
SHSetThreadRef
SHCreateThreadRef
SHGetThreadRef
SHDeleteValueW

shlwapi

ord197
PathFileExistsW

api-ms-win-core-localization-l1-2-1

GetSystemPreferredUILanguages
FormatMessageW

api-ms-win-core-processthreads-l1-1-2

TlsAlloc
GetExitCodeProcess
OpenProcessToken
CreateProcessW
GetCurrentProcessId
TerminateProcess
TlsFree
TlsGetValue
GetCurrentThreadId
TlsSetValue
CreateThread
OpenProcess
GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FreeLibrary
FreeLibraryAndExitThread
GetProcAddress
LoadLibraryExW
GetModuleFileNameA
LockResource
LoadResource
FindResourceExW
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-errorhandling-l1-1-1

SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-2-0

DeleteCriticalSection
InitializeCriticalSectionEx
WaitForMultipleObjectsEx
EnterCriticalSection
WaitForSingleObjectEx
CreateEventExW
SetEvent
AcquireSRWLockExclusive
ReleaseSemaphore
InitializeSRWLock
InitOnceExecuteOnce
Sleep
OpenEventW
LeaveCriticalSection
CreateEventW
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockShared
InitializeCriticalSection
AcquireSRWLockShared
InitOnceBeginInitialize
ReleaseSRWLockExclusive
InitOnceComplete
OpenSemaphoreW
WaitForSingleObject
ReleaseMutex

api-ms-win-core-heap-l1-2-0

HeapSetInformation
HeapSize
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister
EventActivityIdControl

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo
GetRestrictedErrorInfo
IsErrorPropagationEnabled
RoTransformError
RoOriginateErrorW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsGetStringLen
WindowsIsStringEmpty
WindowsDuplicateString

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemWindowsDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetProductInfo
GetSystemDirectoryW
GetWindowsDirectoryW

api-ms-win-core-com-l1-1-1

CoInitializeEx
CLSIDFromString
StringFromGUID2
CoIncrementMTAUsage
CoUninitialize
PropVariantClear
CoTaskMemAlloc
CoTaskMemRealloc
CoDecrementMTAUsage
CoCreateFreeThreadedMarshaler
CoDisableCallCancellation
CoEnableCallCancellation
CoMarshalInterface
CreateStreamOnHGlobal
CoCreateGuid
CoCreateInstance
CoGetApartmentType
RoGetAgileReference
CoReleaseMarshalData
CoCancelCall
CoGetMalloc
CoTaskMemFree
CoWaitForMultipleHandles

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CallbackMayRunLong
FreeLibraryWhenCallbackReturns
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateSemaphoreW

api-ms-win-security-base-l1-2-0

IsWellKnownSid
CopySid
CreateWellKnownSid
GetTokenInformation
GetLengthSid

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegOpenCurrentUser
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-2-1

FindNextFileW
FindClose
DeleteFileW
FindFirstFileExW
CreateFileW

api-ms-win-core-psapi-l1-1-0

K32GetProcessImageFileNameW

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchAppend

api-ms-win-core-file-l2-1-2

CopyFileW

userenv

GetProfilesDirectoryW

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-kernel32-legacy-l1-1-1

RegisterWaitForSingleObject
GetComputerNameW
UnregisterWait

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
QueueUserWorkItem
DeleteTimerQueueTimer

api-ms-win-security-lsapolicy-l1-1-0

LsaRetrievePrivateData
LsaStorePrivateData
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy

api-ms-win-mm-playsound-l1-1-0

PlaySoundW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-rtcore-ntuser-window-l1-1-0

FindWindowW
GetDesktopWindow
SendNotifyMessageW
DefWindowProcW
GetWindowThreadProcessId
DispatchMessageW
PeekMessageW
PostThreadMessageW
GetWindowLongW
UnregisterClassW
DestroyWindow
PostMessageW
GetClassInfoW
SetWindowLongW
TranslateMessage
RegisterClassW
CreateWindowExW

ntdll

NtQueryValueKey
RtlGetSuiteMask
RtlRunOnceExecuteOnce
RtlGetNtProductType
NtOpenKey
RtlUnsubscribeWnfStateChangeNotification
NtOpenProcess
NtQueryInformationToken
NtClose
NtOpenProcessToken
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlInitializeResource
RtlInitUnicodeString
RtlNtStatusToDosError
NtSetInformationProcess
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlInitString
NtPowerInformation
RtlPublishWnfStateData
NtQuerySystemInformation
NtQueryWnfStateData

slc

SLGetWindowsInformationDWORD

user32

CopyRect
LoadCursorW
LoadKeyboardLayoutW
UnloadKeyboardLayout
ActivateKeyboardLayout
RegisterBSDRWindow
GetDC
GetRawInputDeviceList
ReleaseDC
OpenDesktopW
SetThreadDesktop
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
CloseDesktop
OpenInputDesktop
SetSysColors
ShowCursor

cfgmgr32

DevGetObjects
DevFreeObjects

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids

rpcrt4

RpcServerUnregisterIf
RpcBindingVectorFree
RpcEpUnregister
RpcServerListen
RpcEpRegisterW
UuidFromStringW
RpcServerInqBindings
RpcServerRegisterIfEx
NdrServerCall2
I_RpcBindingInqLocalClientPID
I_RpcBindingIsClientLocal
RpcBindingInqAuthClientW
RpcServerUseProtseqW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

api-ms-win-core-registry-l2-2-0

RegDeleteKeyW

api-ms-win-core-misc-l1-1-0

lstrlenW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ff0d6b997d17be6e05de2b18a399a45

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

shcore

shlwapi

api-ms-win-core-localization-l1-2-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-2

userenv

api-ms-win-power-setting-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-mm-playsound-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

ntdll

slc

user32

cfgmgr32

api-ms-win-eventing-classicprovider-l1-1-0

rpcrt4

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-registry-l2-2-0

api-ms-win-core-misc-l1-1-0

Exports

Exports

Sections

.text Size: 448KB - Virtual size: 448KB

.data Size: 1024B - Virtual size: 3KB

.idata Size: 12KB - Virtual size: 11KB

.didat Size: 512B - Virtual size: 436B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 448KB - Virtual size: 448KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 12KB - Virtual size: 11KB

.didat
Size: 512B - Virtual size: 436B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 22KB