diagtrack[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

diagtrack.dll
Size

918KB
MD5

b0b5e154f90b6f2fcc1bad0a926170ad
SHA1

4c34a83469ed635b668539fcc58f885280a62f17
SHA256

341a8616a718c1e55ebcde628f6ccace89d300e2aee11bd234dacd8e3f7c0dec
SHA512

cf1bda5e043fe47672502a54fa6012fafa7eaf9c5daa6e97a93fb552383d576daa91c8840458f3066e3c44634c192bec97a6730eca79afd176a8ac80ebb6729d
SSDEEP

12288:k1Ucf7r2T07q6R0Kxl3vSvR96pCNYRiWz41TSOWx/TMR8hAor4:uUcf7r2T07R5fSJ96pCBqJHxrMehAf

Score

1^/10

Malware Config

Signatures

Files

diagtrack.dll
.dll windows:10 windows x86 arch:x86

ea34951910857764688fed3eb7f3a3af

Code Sign

33:00:00:03:75:56:0e:9b:25:e1:0d:76:b5:00:00:00:00:03:75
Certificate

Issuer

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/04/2018, 17:29

Not After

14/12/2018, 17:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Development Root Certificate Authority 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/05/2014, 17:33

Not After

28/05/2029, 17:43

Subject

CN=Microsoft Development PCA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:b3:52:e9:a5:03:f4:24:f4:7c:e2:20:87:ba:c5:9f:7a:b6:54:df:00:42:49:9b:45:6b:28:8d:1a:2a:d3:3d
Signer

Actual PE Digest

3b:b3:52:e9:a5:03:f4:24:f4:7c:e2:20:87:ba:c5:9f:7a:b6:54:df:00:42:49:9b:45:6b:28:8d:1a:2a:d3:3d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

PDB Paths

diagtrack.pdb

Imports

msvcrt

_finite
_vscwprintf
realloc
wcsnlen
wcsncmp
towlower
strnlen
time
sprintf_s
wcsstr
_wtoi
swscanf_s
_wcsnicmp
memcpy_s
_wcstoui64
_wtof
towupper
swprintf_s
rand
srand
_snwscanf_s
_ftol2
memcmp
_except_handler4_common
??1type_info@@UAE@XZ
_snprintf
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
memcpy
__CxxFrameHandler3
_CxxThrowException
_stricmp
_wcsicmp
_vsnwprintf
malloc
_purecall
??_V@YAXPAX@Z
free
memmove
wcschr
vswprintf_s
??8type_info@@QBEHABV0@@Z
rand_s
_wcsdup
_onexit
wcscpy_s
_wcstoi64
??3@YAXPAX@Z
memset

kernel32

UnhandledExceptionFilter
GetTickCount64
WakeConditionVariable
AcquireSRWLockExclusive
SleepConditionVariableSRW
ReleaseSRWLockExclusive
MoveFileExW
RaiseFailFastException
UnregisterWaitEx
DisableThreadLibraryCalls
Sleep
CreateEventW
InitializeConditionVariable
CloseThreadpool
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
WaitForSingleObject
FindResourceExW
FreeResource
EncodePointer
LocalAlloc
SetUnhandledExceptionFilter
GetVersionExW
WaitForMultipleObjectsEx
SetEvent
GetSystemDirectoryW
InitializeCriticalSectionAndSpinCount
GetUserGeoID
GetSystemDefaultLCID
GetNativeSystemInfo
GetThreadPriority
GlobalFree
GetProcessHeap
HeapFree
HeapAlloc
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
CreateThread
WaitForSingleObjectEx
CreateEventExW
WerRegisterMemoryBlock
WriteFile
CreateFileW
WideCharToMultiByte
CreateThreadpoolTimer
EnterCriticalSection
LeaveCriticalSection
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadPriority
WaitForMultipleObjects
FindNextChangeNotification
FindFirstChangeNotificationW
WTSGetActiveConsoleSessionId
AcquireSRWLockShared
ReleaseSRWLockShared
ReadFile
GetFileSize
FindCloseChangeNotification
CreateThreadpool
SetThreadpoolThreadMaximum
CreateThreadpoolWork
SubmitThreadpoolWork
FileTimeToSystemTime
MultiByteToWideChar
SetFilePointerEx
GetSystemPreferredUILanguages
GetProductInfo
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSizeEx
ResetEvent
GetTempPathW
MoveFileW
VirtualAlloc
VirtualFree
QueryPerformanceFrequency
GetSystemInfo
SetThreadPriorityBoost
FlushViewOfFile
GlobalMemoryStatusEx
OpenProcess
QueryUnbiasedInterruptTime
GetTempFileNameW
GetSystemPowerStatus
K32GetPerformanceInfo
IsWow64Process
CreateProcessW
GetExitCodeProcess
CreateToolhelp32Snapshot
FindFirstFileExW
Process32NextW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateWaitableTimerExW
SetWaitableTimerEx
SetFilePointer
GetStdHandle
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
SetWaitableTimer
ResumeThread
TerminateJobObject
SystemTimeToFileTime
CopyFileW
FindFirstFileW
FindClose
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
CreateDirectoryW
GetFileAttributesW
LocalFree
SetLastError
GetCurrentThread
ExpandEnvironmentStringsW
SetEnvironmentVariableW
FormatMessageW
OutputDebugStringW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
CloseHandle
GetModuleFileNameA
GetProcAddress
GetLastError
RaiseException
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
LoadResource
SizeofResource
LockResource
InitializeCriticalSection
LoadLibraryExA
DelayLoadFailureHook
Process32FirstW

advapi32

QueryTraceW
AdjustTokenPrivileges
ImpersonateSelf
CryptGenRandom
RegQueryValueExW
GetTokenInformation
ConvertSidToStringSidW
CloseTrace
TraceSetInformation
EnableTraceEx2
ProcessTrace
OpenTraceW
StartTraceW
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
LookupAccountSidW
ConvertStringSidToSidW
AllocateLocallyUniqueId
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
ImpersonateLoggedOnUser
ControlTraceW
RevertToSelf
RegDeleteKeyExW
EventWrite
RegNotifyChangeKeyValue
DuplicateTokenEx
CreateProcessAsUserW
EnumServicesStatusExW
RegDeleteValueW
StopTraceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService
QueryServiceStatus
RegisterServiceCtrlHandlerExW
SetServiceStatus
EventUnregister
EventRegister
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCopyTreeW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteTreeW
RegDeleteKeyW
RegCloseKey
RegGetValueW
OpenThreadToken
EventWriteTransfer

ole32

CoCreateGuid
StringFromGUID2
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateInstance

ntdll

EtwTraceMessage
RtlGetVersion
WinSqmIsOptedInEx
NtQuerySystemInformation
RtlNtStatusToDosError
NtQueryInformationProcess
NtSetInformationFile
NtQueryInformationThread
NtSetInformationThread

user32

LoadStringW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
ExpandEnvironmentStringsForUserW

rpcrt4

UuidFromStringW
RpcStringFreeW
UuidToStringW

oleaut32

SysFreeString
SysStringLen
SysAllocString

bcrypt

BCryptGenRandom

shlwapi

SHCreateStreamOnFileW
PathFileExistsW
UrlEscapeW

xmllite

CreateXmlWriter
CreateXmlReader

winhttp

WinHttpWriteData
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpCrackUrl
WinHttpSetStatusCallback
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpSetCredentials
WinHttpQueryOption
WinHttpGetDefaultProxyConfiguration
WinHttpSetTimeouts
WinHttpReadData
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpConnect
WinHttpSetOption
WinHttpGetProxyForUrl

crypt32

CryptBinaryToStringW
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptStringToBinaryA
CryptSignMessage

wtsapi32

WTSQueryUserToken

Exports

Exports

?_LoadSharedStringResource@@YG?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@K@Z
?gs_lifetimeManager@@3VCLifetimeManager@Diagnostics@Microsoft@@A
RunDll32Main
ServiceMain
SvchostPushServiceGlobals
UtcSysprepGeneralize

Sections

.text
Size: 825KB - Virtual size: 825KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea34951910857764688fed3eb7f3a3af

Code Sign

33:00:00:03:75:56:0e:9b:25:e1:0d:76:b5:00:00:00:00:03:75Certificate

Extended Key Usages

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03Certificate

Key Usages

3b:b3:52:e9:a5:03:f4:24:f4:7c:e2:20:87:ba:c5:9f:7a:b6:54:df:00:42:49:9b:45:6b:28:8d:1a:2a:d3:3dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

ole32

ntdll

user32

userenv

rpcrt4

oleaut32

bcrypt

shlwapi

xmllite

winhttp

crypt32

wtsapi32

Exports

Exports

Sections

.text Size: 825KB - Virtual size: 825KB

.data Size: 3KB - Virtual size: 4KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 36KB - Virtual size: 36KB

.reloc Size: 38KB - Virtual size: 37KB

33:00:00:03:75:56:0e:9b:25:e1:0d:76:b5:00:00:00:00:03:75
Certificate

33:00:00:00:03:c6:f9:b4:c3:ae:be:59:4b:00:00:00:00:00:03
Certificate

3b:b3:52:e9:a5:03:f4:24:f4:7c:e2:20:87:ba:c5:9f:7a:b6:54:df:00:42:49:9b:45:6b:28:8d:1a:2a:d3:3d
Signer

.text
Size: 825KB - Virtual size: 825KB

.data
Size: 3KB - Virtual size: 4KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 36KB - Virtual size: 36KB

.reloc
Size: 38KB - Virtual size: 37KB