RstrtMgr[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

RstrtMgr.dll
Size

166KB
MD5

f82283126cb07933ad9401ba5c4cf98b
SHA1

f7ecc223a8f1427306a358d3a937e71231495f1e
SHA256

c0bcac4acc311c74aaf4a1a9e897538f7019c9b0a9be47df7545325965e80b4b
SHA512

2c7fa220fcb5849c31dc4cc332d4578dd03baf29625df8f016cf23b730cb13224540d1ca045a151d93db7203627330b416c941d156453666f1621234e759474a
SSDEEP

3072:wxQswFGNOSTGd/mtJ3iC7oDxNeks+sH75kMzEhZhHC53P:Zs/ZCd/mP77qNBs+sHz2AF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RstrtMgr.dll

Files

RstrtMgr.dll
.dll windows:10 windows x86 arch:x86

7c08628e262d81b0d56f727169e3dc77

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

RstrtMgr.pdb

Imports

msvcrt

_unlock
_lock
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
__dllonexit
__CxxFrameHandler3
_CxxThrowException
??0exception@@QAE@ABQBD@Z
_purecall
_vsnprintf_s
memcpy_s
malloc
free
??0exception@@QAE@XZ
wcschr
_vsnwprintf
memmove
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBDH@Z
?what@exception@@UBEPBDXZ
_wcsicmp
towlower
??1exception@@UAE@XZ
_onexit
_except_handler4_common
memcmp
wcstoul
memcpy
memset

ntdll

WinSqmSetDWORD
NtQueryInformationFile
RtlFreeUnicodeString
WinSqmStartSession
WinSqmEndSession
NtQueryInformationProcess
NtQuerySystemInformation
RtlQueryPackageClaims
WinSqmSetString
RtlCreateUnicodeString
NtQueryInformationToken
WinSqmAddToStreamEx

kernel32

LeaveCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapCreate
GetLastError
HeapAlloc
EnterCriticalSection
GetProcessHeap
IsWow64Process
GetCurrentProcess
ExpandEnvironmentStringsW
CreateFileW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
QueryPerformanceFrequency
QueryPerformanceCounter
GetFileType
GetFileInformationByHandle
InitializeCriticalSection
ProcessIdToSessionId
GetCurrentProcessId
GetProcessTimes
GetSystemTimeAsFileTime
GetModuleFileNameW
ReleaseMutex
CreateMutexW
OpenMutexW
WaitForSingleObject
OpenProcess
CompareFileTime
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
GetProcAddress
OutputDebugStringW
ReleaseSemaphore
WaitForSingleObjectEx
OpenSemaphoreW
LocalFree
QueryFullProcessImageNameW
GetSystemWindowsDirectoryW
GetApplicationRestartSettings
GetApplicationUserModelId
GetPackageId
GetPackagePath
CreateSemaphoreExW
SetLastError
CreateMutexExW
SetConsoleCtrlHandler
WaitForMultipleObjects
GetConsoleProcessList
FreeConsole
AttachConsole
GenerateConsoleCtrlEvent
TerminateProcess
HeapFree
Sleep
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
CreateNamedPipeW
CreateEventW
ConnectNamedPipe
SetEvent
GetNamedPipeClientProcessId
WriteFile
DuplicateHandle
ResetEvent
ReadFile
GetOverlappedResult
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetTickCount

user32

SendMessageTimeoutW
GetWindowLongW
GetWindowThreadProcessId
GetWindow
GetSystemMetrics
EnumWindows

advapi32

TraceMessage
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
LookupAccountSidW
StartServiceW
QueryServiceStatusEx
ControlService
QueryServiceStatus
CreateProcessAsUserW
GetKernelObjectSecurity
DuplicateTokenEx
EqualSid
CopySid
GetTokenInformation
OpenProcessToken
I_QueryTagInformation
EnumDependentServicesW
OpenServiceW
CloseServiceHandle
EnumServicesStatusExW
OpenSCManagerW
EventUnregister
EventWrite
EventRegister
RegQueryMultipleValuesW
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle

rpcrt4

UuidCreate

ncrypt

BCryptFinishHash
BCryptCreateHash
BCryptGetProperty
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

shlwapi

ord348

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

kernelbase

WTSGetServiceSessionId

Exports

Exports

RmAddFilter
RmCancelCurrentTask
RmEndSession
RmGetFilterList
RmGetList
RmJoinSession
RmRegisterResources
RmRemoveFilter
RmReserveHeap
RmRestart
RmShutdown
RmStartSession

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c08628e262d81b0d56f727169e3dc77

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

user32

advapi32

rpcrt4

ncrypt

shlwapi

ole32

oleaut32

kernelbase

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 140KB

.data Size: 512B - Virtual size: 3KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 140KB - Virtual size: 140KB

.data
Size: 512B - Virtual size: 3KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 10KB - Virtual size: 10KB