easwrt[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

easwrt.dll
Size

140KB
MD5

5d8dab0dc49656e5e6100d044c9c1840
SHA1

e0846468386bcf2c31d4e1a3f3c89a95bad16163
SHA256

a446af1532ed9c4b5aee6a8c8a6e2bc1be18b21d532c5a0c2d4d9b51973f8ade
SHA512

588f4ddf5af421d9616b66c2f3bc9549370ba040672971088ddda12d99a1c89729b6ece6e8044659ebc789c3e5aca67a1d2257937b14b304cf426c68fb4095e9
SSDEEP

3072:jGGPl2h3yL+eA2DxsmNS4AJMxfCC4Oy95Dh6wT6UU9yWuFvnlh:zqyL+/mNS4YMxKhJ95DZUkfl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
easwrt.dll

Files

easwrt.dll
.dll windows:10 windows x86 arch:x86

40276fab5b8b84d7de03f869104c61b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

easwrt.pdb

Imports

msvcrt

_except_handler4_common
_vsnwprintf
memcpy_s
__CxxFrameHandler3
_onexit
__dllonexit
memmove
_unlock
_lock
memcpy
_initterm
memcmp
_purecall
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_wtoi
toupper
memset

twinapi.appcore

ord12
ord500
ord3
ord2

api-ms-win-core-com-l1-1-0

CoGetInterfaceAndReleaseStream
CoGetCallerTID
CoMarshalInterface
CreateStreamOnHGlobal
CoGetCallContext
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegDeleteTreeW
RegEnumValueW
RegQueryInfoKeyW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids
GetTraceEnableLevel

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsCreateString
WindowsStringHasEmbeddedNull

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventProviderEnabled
EventUnregister
EventWriteTransfer

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
AcquireSRWLockShared
WaitForSingleObject
WaitForSingleObjectEx
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
OpenSemaphoreW
CreateMutexExW
ReleaseMutex
AcquireSRWLockExclusive

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateErrorW
RoOriginateError
RoTransformError
GetRestrictedErrorInfo

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
LoadLibraryExW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

rpcrt4

RpcBindingBind
RpcBindingCreateW
NdrClientCall4
RpcBindingFree
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
RpcBindingSetAuthInfoExW
I_RpcMapWin32Status
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
NdrOleFree
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_AddRef
IUnknown_Release_Proxy

api-ms-win-core-com-midlproxystub-l1-1-0

NdrProxyForwardingFunction5
ObjectStublessClient12
ObjectStublessClient6
ObjectStublessClient11
ObjectStublessClient14
CStdStubBuffer2_CountRefs
ObjectStublessClient8
ObjectStublessClient9
ObjectStublessClient19
ObjectStublessClient17
ObjectStublessClient10
CStdStubBuffer2_QueryInterface
ObjectStublessClient13
ObjectStublessClient7
ObjectStublessClient22
ObjectStublessClient16
CStdStubBuffer2_Disconnect
ObjectStublessClient21
ObjectStublessClient3
NdrProxyForwardingFunction3
ObjectStublessClient23
NdrProxyForwardingFunction4
CStdStubBuffer2_Connect
ObjectStublessClient15
ObjectStublessClient18
ObjectStublessClient20

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

oleaut32

VariantClear
VariantInit

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetProcessId
OpenThreadToken
GetCurrentProcess
GetCurrentThread

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetTokenInformation
CheckTokenMembership
CopySid
EqualSid
GetLengthSid
GetSecurityDescriptorDacl
PrivilegeCheck
DuplicateToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

combase

ord157
ord90

advapi32

AllocateAndInitializeSid
OpenServiceW
StartServiceW
FreeSid
RegDeleteValueW
RegCreateKeyExW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
RegSetValueExW
RegOpenKeyExW
RegCloseKey

kernel32

GetSystemWindowsDirectoryW
CreateFileW

ntdll

RtlInitializeResource
RtlAcquireResourceExclusive
RtlReleaseResource
NtOpenThreadToken
NtClose
NtDuplicateToken
NtOpenProcessToken
WinSqmSetString
NtGetCachedSigningLevel
NtSetCachedSigningLevel
NtQuerySystemInformation
NtQueryInformationToken
RtlInitUnicodeString
RtlInitializeSid
RtlSubAuthoritySid
RtlGetNtProductType
RtlLengthSid
RtlCopySid
RtlIsMultiSessionSku
RtlSubAuthorityCountSid
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
RtlEqualSid
RtlDeleteResource

ole32

CoGetObject

user32

ord2521
SystemParametersInfoW
GetClassNameW
IsWindow
EnableWindow
GetAncestor
ord2529
UpdatePerUserSystemParameters
GetWindow
GetWindowThreadProcessId

authz

AuthzInitializeContextFromSid
AuthzAddSidsToContext
AuthzAccessCheck
AuthzFreeContext
AuthzFreeResourceManager
AuthzInitializeResourceManager

samcli

NetUserGetInfo

netutils

NetApiBufferFree

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
LsaLookupSids

samlib

SamQueryInformationDomain
SamCloseHandle
SamOpenDomain
SamQueryInformationUser
SamQuerySecurityObject
SamOpenUser
SamConnect
SamFreeMemory

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
EasClientSecurityPolicyApply
EasClientSecurityPolicyCheckCompliance
EasGetClientDeviceInformation
EasRegisterEncryptionProvider
EasShowConsentDialog
EasUnRegisterEncryptionProvider

Sections

.text
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40276fab5b8b84d7de03f869104c61b5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

twinapi.appcore

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-string-l1-1-0

oleaut32

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

combase

advapi32

kernel32

ntdll

ole32

user32

authz

samcli

netutils

api-ms-win-security-lsapolicy-l1-1-0

samlib

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 114KB - Virtual size: 114KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 10KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 24B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 114KB - Virtual size: 114KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 10KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 24B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB