BTAGService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
BTAGService.dll
Resource
win10v2004-20240426-en
General
-
Target
BTAGService.dll
-
Size
716KB
-
MD5
ff423c506ee8bf49d876f810f1ae3633
-
SHA1
9dbea9f2fe1258b267185d800a3586beddac864e
-
SHA256
19b3226e0bb1e8b2ffbe9de48b8fa0bd68f3169289845cd2d9edc0b047fe6799
-
SHA512
1c299c20b5a8a1e08353a025191a16cd529c4b3bfc0c2475e8a1aed674f391b1206cc4f03cca802c81581e553869ce9e62014619279a6d6cc5c2dd29c675e95d
-
SSDEEP
12288:MnJcb22TKrmQpuv1WB0cwny3W82UEaeWI50MjJCURRBnH4:GJcb23rmQpg1WGM3W82UVpg0MFfRRBH4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BTAGService.dll
Files
-
BTAGService.dll.dll windows:10 windows x86 arch:x86
13d1645077d1a8795e12b3972bb1bae7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcp_win
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xbad_alloc@std@@YAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPBD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Xbad_function_call@std@@YAXXZ
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__itoa_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__strnicmp
_o__wcsnicmp
memmove
_o__wtol
_o_atoi
_o_bsearch
_o_free
_o_isdigit
_o_isprint
_o_isspace
_o_iswdigit
_o_malloc
_o_qsort
_o_realloc
_o_strcat_s
_o_strtok
_o_strtol
_o_strtoul
_o_terminate
_o_toupper
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
_o_wcstoul
_except_handler4_common
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o___stdio_common_vswprintf
_o___stdio_common_vsscanf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o__execute_onexit_table
_o__errno
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
wcsstr
wcschr
_o__wtoi
_o__cexit
_o__callnewh
strstr
strchr
__std_type_info_compare
__std_terminate
__CxxFrameHandler3
memcpy
memcmp
api-ms-win-crt-string-l1-1-0
strncmp
wcsncmp
strnlen
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
FindResourceExW
DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
LoadResource
LockResource
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSRWLockShared
WaitForSingleObject
ReleaseSemaphore
EnterCriticalSection
CreateEventW
ResetEvent
DeleteCriticalSection
AcquireSRWLockShared
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
CreateEventExW
CreateSemaphoreExW
InitializeCriticalSection
OpenSemaphoreW
InitializeSRWLock
ReleaseMutex
InitializeCriticalSectionAndSpinCount
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolCleanupGroup
CreateThreadpoolCleanupGroup
CloseThreadpoolTimer
SetThreadpoolTimerEx
TrySubmitThreadpoolCallback
FreeLibraryWhenCallbackReturns
SetThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolWork
WaitForThreadpoolWaitCallbacks
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolTimer
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWait
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
TerminateProcess
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateInstance
CoImpersonateClient
CoRevertToSelf
CreateStreamOnHGlobal
CoMarshalInterface
CoSetProxyBlanket
CoCreateGuid
CoIncrementMTAUsage
CoGetMalloc
CoDecrementMTAUsage
CoReleaseServerProcess
CoAddRefServerProcess
CoRevokeClassObject
CoRegisterClassObject
CoReleaseMarshalData
CoResumeClassObjects
CoTaskMemAlloc
CoDisconnectObject
CoDisconnectContext
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
EventProviderEnabled
EventSetInformation
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateErrorW
RoOriginateError
GetRestrictedErrorInfo
SetRestrictedErrorInfo
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoRegisterActivationFactories
RoRevokeActivationFactories
RoInitialize
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
SetServiceStatus
api-ms-win-power-setting-l1-1-0
PowerSettingUnregisterNotification
PowerSettingRegisterNotification
api-ms-win-core-winrt-string-l1-1-0
HSTRING_UserUnmarshal
HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString
WindowsCreateString
WindowsDuplicateString
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
RegisterWaitForSingleObject
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
WakeByAddressAll
WaitOnAddress
Sleep
api-ms-win-core-processthreads-l1-1-1
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceEnableLevel
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
combase
ord66
ord168
ord68
ord67
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
rpcrt4
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
NdrCStdStubBuffer2_Release
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
api-ms-win-core-com-midlproxystub-l1-1-0
ObjectStublessClient18
ObjectStublessClient15
ObjectStublessClient24
ObjectStublessClient23
ObjectStublessClient20
ObjectStublessClient27
CStdStubBuffer2_Disconnect
ObjectStublessClient7
ObjectStublessClient22
ObjectStublessClient13
CStdStubBuffer2_QueryInterface
ObjectStublessClient19
NdrProxyForwardingFunction4
CStdStubBuffer2_CountRefs
ObjectStublessClient11
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient3
ObjectStublessClient8
ObjectStublessClient12
CStdStubBuffer2_Connect
ObjectStublessClient9
ObjectStublessClient26
ObjectStublessClient17
ObjectStublessClient14
ObjectStublessClient10
ObjectStublessClient16
ObjectStublessClient21
NdrProxyForwardingFunction3
ObjectStublessClient25
api-ms-win-security-base-l1-1-0
ImpersonateSelf
DuplicateTokenEx
GetSidSubAuthority
RevertToSelf
GetSidSubAuthorityCount
CopySid
GetLengthSid
IsValidSid
GetTokenInformation
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-winrt-error-l1-1-1
IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
RoOriginateLanguageException
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-rtlsupport-l1-2-0
RtlCompareMemory
ws2_32
WSAStartup
WSAGetLastError
WSACleanup
WSALookupServiceEnd
connect
WSASocketW
bind
getsockname
getpeername
setsockopt
listen
WSAEventSelect
WSAEnumNetworkEvents
accept
closesocket
WSARecv
recv
send
WSALookupServiceNextW
WSAAddressToStringW
WSALookupServiceBeginW
WSASetServiceW
WSACreateEvent
WSASend
WSASetEvent
WSAGetOverlappedResult
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW
RegGetValueW
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-io-l1-1-0
DeviceIoControl
CancelIoEx
GetOverlappedResult
ntdll
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQuerySystemInformation
RtlInitUnicodeString
RtlQueryPackageIdentity
NtQueryWnfStateData
NtQueryInformationToken
RtlConvertSidToUnicodeString
RtlPublishWnfStateData
EtwTraceMessage
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlSubscribeWnfStateChangeNotification
api-ms-win-devices-query-l1-1-0
DevFreeObjectProperties
DevFindProperty
DevGetObjectProperties
DevGetObjects
DevFreeObjects
DevCreateObjectQuery
DevCloseObjectQuery
api-ms-win-security-capability-l1-1-0
CapabilityCheck
RpcClientCapabilityCheck
api-ms-win-shcore-stream-l1-1-0
IStream_Write
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
api-ms-win-core-threadpool-legacy-l1-1-0
CreateTimerQueueTimer
QueueUserWorkItem
UnregisterWaitEx
DeleteTimerQueueTimer
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryLocationW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
callhistoryclient
UdmCreateDataSession
UdmCreateSyncCallbackHandler
pimstore
FindMatchingContactEx
phoneom
PhoneRemoveListener
PhoneAPIInitialize
PhoneGetLines
PhoneGetDefaultOutgoingLine
PhoneGetProviderLineServiceInfo
PhoneGetProviderLineInfo
PhoneGetState
PhoneFreeCallInfo
PhoneAddListener
PhoneDial
PhoneEnd
PhoneAcceptIncomingEx
PhoneRejectIncoming
PhoneSetHold
PhonePrivate
PhoneDropAccept
PhoneConference
PhoneSwap
PhoneSendDTMF
PhoneIsActionAvailable
PhoneAPIUninitialize
bcrypt
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
api-ms-win-devices-config-l1-1-1
CM_Unregister_Notification
CM_Register_Notification
CM_Get_Device_Interface_PropertyW
CM_MapCrToWin32Err
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-devices-query-l1-1-1
DevCreateObjectQueryEx
devobj
DevObjGetClassDevs
DevObjDestroyDeviceInfoList
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjCreateDeviceInfoList
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
oleaut32
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
ServiceMain
SvchostPushServiceGlobals
Sections
.text Size: 637KB - Virtual size: 637KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ