U:\hl1\goldsrc\tier0\Release\tier0.pdb
Static task
static1
Behavioral task
behavioral1
Sample
tier0.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
tier0.dll
Resource
win10v2004-20240508-en
General
-
Target
tier0.dll
-
Size
331KB
-
MD5
fbfeb5dae01b4b2456cd1ebabbed4922
-
SHA1
1960f93db4f23c3012855e389e30005910592c61
-
SHA256
55e64559ba6acc4c0efc3bef92382714a6b9b8a4bd4696e8c920e709c803b250
-
SHA512
03148956ec8254a6d41ab970f9215e3bc3a302c8f578078b3441aa1b12ebc3b59e7dcc9c4dcb1e7335d7087acff1d8b09a824e96d07c7aa69db23b24fddae8dc
-
SSDEEP
6144:mPFYIaq66FzxSr5qnplXT8P0wdf/B4gIAFBXLGlS:mPFYSdFNKEnplXQP0wd/B4gIAPLG8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tier0.dll
Files
-
tier0.dll.dll windows:5 windows x86 arch:x86
49470f0b0f93eb47dccf25977ac0fef7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ws2_32
send
recv
WSAGetLastError
WSASetLastError
recvfrom
kernel32
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThread
GetSystemInfo
QueryPerformanceFrequency
SetThreadAffinityMask
GetVersionExA
GetCurrentProcess
IsBadReadPtr
IsBadWritePtr
TerminateProcess
IsBadStringPtrA
GetCommandLineA
IsDebuggerPresent
FreeLibrary
VirtualFree
GetProcAddress
VirtualAlloc
LoadLibraryA
CreateFileA
RaiseException
GetModuleFileNameA
GetCurrentThreadId
CloseHandle
GetModuleHandleA
SetPriorityClass
SetThreadPriority
GetTickCount
DeviceIoControl
WaitForSingleObject
SetEvent
TerminateThread
CreateEventA
ExitThread
CreateThread
PulseEvent
WriteConsoleW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
TlsSetValue
OpenProcess
Sleep
GetExitCodeProcess
CreateSemaphoreA
ReleaseSemaphore
InterlockedExchange
GetLastError
ResetEvent
InterlockedExchangeAdd
GetExitCodeThread
WaitForMultipleObjects
GetThreadPriority
CreateMutexA
ReleaseMutex
TlsAlloc
TlsFree
SuspendThread
ResumeThread
GetNumberOfConsoleInputEvents
ReadConsoleInputA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
HeapDestroy
HeapCreate
SetEndOfFile
GetProcessHeap
CreateFileW
CompareStringW
TlsGetValue
SetEnvironmentVariableA
EncodePointer
DecodePointer
GetModuleHandleW
ExitProcess
HeapValidate
HeapWalk
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
MoveFileA
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetLastError
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
FatalAppExitA
SetConsoleCtrlHandler
LoadLibraryW
GetLocaleInfoW
WriteFile
GetModuleFileNameW
user32
GetKeyState
ScreenToClient
GetCursorPos
PeekMessageA
GetDlgItemInt
GetWindowRect
EnumWindows
SetDlgItemInt
EndDialog
GetDesktopWindow
SetWindowPos
IsWindowVisible
DialogBoxParamA
SetDlgItemTextA
GetWindowThreadProcessId
advapi32
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
Exports
Exports
??0CThread@@QAE@XZ
??0CThreadEvent@@QAE@PAX_N@Z
??0CThreadEvent@@QAE@_N@Z
??0CThreadFastMutex@@QAE@XZ
??0CThreadFullMutex@@QAE@_NPBD@Z
??0CThreadLocalBase@@QAE@XZ
??0CThreadMutex@@QAE@XZ
??0CThreadSemaphore@@QAE@JJ@Z
??0CThreadSyncObject@@IAE@XZ
??0CVProfNode@@QAE@PBDHPAV0@0H@Z
??0CVProfile@@QAE@XZ
??0CValidator@@QAE@H@Z
??0CWorkerThread@@QAE@XZ
??1CThread@@UAE@XZ
??1CThreadEvent@@QAE@XZ
??1CThreadFullMutex@@QAE@XZ
??1CThreadLocalBase@@QAE@XZ
??1CThreadMutex@@QAE@XZ
??1CThreadSemaphore@@QAE@XZ
??1CThreadSyncObject@@QAE@XZ
??1CVProfNode@@QAE@XZ
??1CVProfile@@QAE@XZ
??1CValidator@@QAE@XZ
??1CWorkerThread@@UAE@XZ
??4CThreadFastMutex@@QAEAAV0@ABV0@@Z
??4CThreadLocalBase@@QAEAAV0@ABV0@@Z
??4CTier0@@QAEAAV0@ABV0@@Z
??4CVProfNode@@QAEAAV0@ABV0@@Z
??4CVProfile@@QAEAAV0@ABV0@@Z
??4CValidator@@QAEAAV0@ABV0@@Z
??7CThreadSyncObject@@QBE_NXZ
??BCThreadSyncObject@@QAEPAXXZ
??_7CThread@@6B@
??_7CWorkerThread@@6B@
??_FCThreadEvent@@QAEXXZ
??_FCThreadFullMutex@@QAEXXZ
?AddBudgetGroupName@CVProfile@@IAEHPBDH@Z
?AddValidationLock@CValidator@@QAEXPAVCThreadMutex@@@Z
?AssertOwnedByCurrentThread@CThreadFastMutex@@QAE_NXZ
?AssertOwnedByCurrentThread@CThreadFullMutex@@QAE_NXZ
?AssertOwnedByCurrentThread@CThreadMutex@@QAE_NXZ
?AssertUseable@CThreadSyncObject@@IAEXXZ
?AtRoot@CVProfile@@QBE_NXZ
?BExcludeAllocationFromTracking@CValidator@@AAE_NPBDH@Z
?BMemLeaks@CValidator@@QAE_NXZ
?BoostPriority@CWorkerThread@@QAEHXZ
?BudgetGroupNameToBudgetGroupID@CVProfile@@QAEHPBD@Z
?BudgetGroupNameToBudgetGroupID@CVProfile@@QAEHPBDH@Z
?Call@CWorkerThread@@IAEHII_NP6GIIPBQAXHI@Z@Z
?CallMaster@CWorkerThread@@QAEHII@Z
?CallWorker@CWorkerThread@@QAEHII_N@Z
?Check@CThreadEvent@@QAE_NXZ
?ClaimArrayMemory@CValidator@@QAEXPAX@Z
?ClaimMemory@CValidator@@QAEXPAX@Z
?ClearPrevTime@CVProfNode@@QAEXXZ
?DiffAgainst@CValidator@@QAEXPAV1@@Z
?DisableVTuneGroup@CVProfile@@QAEXXZ
?DumpNodes@CVProfile@@IAEXPAVCVProfNode@@H_N@Z
?EnableVTuneGroup@CVProfile@@QAEXPBD@Z
?EnterScope@CVProfNode@@QAEXXZ
?EnterScope@CVProfile@@QAEXPBDH0_N@Z
?EnterScope@CVProfile@@QAEXPBDH0_NH@Z
?ExitScope@CVProfNode@@QAE_NXZ
?ExitScope@CVProfile@@QAEXXZ
?Finalize@CValidator@@QAEXXZ
?FindBudgetGroupName@CVProfile@@IAEHPBD@Z
?FindNode@CVProfile@@QAEPAVCVProfNode@@PAV2@PBD@Z
?FindObject@CValidator@@QAEPAVCValObject@@PAX@Z
?FindOrCreateCounter@CVProfile@@QAEPAHPBDW4CounterGroup_t@@@Z
?FreeNodes_R@CVProfile@@IAEXPAVCVProfNode@@@Z
?Get@CThreadLocalBase@@QBEPAXXZ
?GetBudgetGroupColor@CVProfile@@QAEXHAAH000@Z
?GetBudgetGroupFlags@CVProfile@@QBEHH@Z
?GetBudgetGroupID@CVProfNode@@QAEHXZ
?GetBudgetGroupName@CVProfile@@QAEPBDH@Z
?GetCallHandle@CWorkerThread@@QAEPAXXZ
?GetCallParam@CWorkerThread@@QBEIXZ
?GetChild@CVProfNode@@QAEPAV1@XZ
?GetClientData@CVProfNode@@QBEHXZ
?GetCounterGroup@CVProfile@@QBE?AW4CounterGroup_t@@H@Z
?GetCounterName@CVProfile@@QBEPBDH@Z
?GetCounterNameAndValue@CVProfile@@QBEPBDHAAH@Z
?GetCounterValue@CVProfile@@QBEHH@Z
?GetCurCalls@CVProfNode@@QAEHXZ
?GetCurTime@CVProfNode@@QAENXZ
?GetCurTimeLessChildren@CVProfNode@@QAENXZ
?GetCurrentCThread@CThread@@SAPAV1@XZ
?GetDetailLevel@CVProfile@@QBEHXZ
?GetL2CacheMisses@CVProfNode@@QAEHXZ
?GetName@CThread@@QAEPBDXZ
?GetName@CVProfNode@@QAEPBDXZ
?GetNumBudgetGroups@CVProfile@@QAEHXZ
?GetNumCounters@CVProfile@@QBEHXZ
?GetOrigNameAddress@CVProfNode@@QAEPBXXZ
?GetParent@CVProfNode@@QAEPAV1@XZ
?GetPeakFrameTime@CVProfile@@QAENXZ
?GetPeakTime@CVProfNode@@QAENXZ
?GetPrevCalls@CVProfNode@@QAEHXZ
?GetPrevSibling@CVProfNode@@QAEPAV1@XZ
?GetPrevTime@CVProfNode@@QAENXZ
?GetPrevTimeLessChildren@CVProfNode@@QAENXZ
?GetPriority@CThread@@QBEHXZ
?GetResult@CThread@@QAEHXZ
?GetRoot@CVProfile@@QAEPAVCVProfNode@@XZ
?GetSibling@CVProfNode@@QAEPAV1@XZ
?GetSubNode@CVProfNode@@QAEPAV1@PBDH0@Z
?GetSubNode@CVProfNode@@QAEPAV1@PBDH0H@Z
?GetThreadHandle@CThread@@QAEPAXXZ
?GetThreadId@CThread@@QAEIXZ
?GetThreadProc@CThread@@MAEP6GIPAX@ZXZ
?GetTimeLastFrame@CVProfile@@QAENXZ
?GetTotalCalls@CVProfNode@@QAEHXZ
?GetTotalTime@CVProfNode@@QAENXZ
?GetTotalTimeLessChildren@CVProfNode@@QAENXZ
?GetTotalTimeSampled@CVProfile@@QAENXZ
?GetUniqueNodeID@CVProfNode@@ABEHXZ
?Handle@CThreadSyncObject@@QAEPAXXZ
?Init@CThread@@MAE_NXZ
?IsAlive@CThread@@QAE_NXZ
?IsEnabled@CVProfile@@QBE_NXZ
?Join@CThread@@QAE_NI@Z
?Lock@CThreadFastMutex@@QCEXI@Z
?Lock@CThreadFastMutex@@QDEXI@Z
?Lock@CThreadFullMutex@@QAEXI@Z
?Lock@CThreadFullMutex@@QAEXXZ
?Lock@CThreadMutex@@QAEXXZ
?Lock@CThreadMutex@@QBEXXZ
?MarkFrame@CVProfNode@@QAEXXZ
?MarkFrame@CVProfile@@QAEXXZ
?NumFramesSampled@CVProfile@@QAEHXZ
?OnExit@CThread@@MAEXXZ
?OutputReport@CVProfile@@QAEXHPBDH@Z
?PMEEnable@CVProfile@@QAEX_N@Z
?PMEInitialized@CVProfile@@QAEX_N@Z
?PValObjectFirst@CValidator@@QAEPAVCValObject@@XZ
?Pause@CVProfNode@@QAEXXZ
?Pause@CVProfile@@QAEXXZ
?PeekCall@CWorkerThread@@QAE_NPAI@Z
?Pop@CValidator@@QAEXXZ
?PopGroup@CVProfile@@QAEXXZ
?Pulse@CThreadEvent@@QAE_NXZ
?Push@CValidator@@QAEXPBDPAX0@Z
?PushGroup@CVProfile@@QAEXH@Z
?RegisterNumBudgetGroupsChangedCallBack@CVProfile@@QAEXP6AXXZ@Z
?Release@CThreadFullMutex@@QAE_NXZ
?Release@CThreadSemaphore@@QAE_NJPAJ@Z
?RenderLeaks@CValidator@@QAEXXZ
?RenderObjects@CValidator@@QAEXH@Z
?Reply@CWorkerThread@@QAEXI@Z
?RequiresThreadSafety@CVProfile@@QAE_NXZ
?Reset@CThreadEvent@@QAE_NXZ
?Reset@CVProfNode@@QAEXXZ
?Reset@CVProfile@@QAEXXZ
?ResetCounters@CVProfile@@QAEXW4CounterGroup_t@@@Z
?ResetPeak@CVProfNode@@QAEXXZ
?ResetPeaks@CVProfile@@QAEXXZ
?Resume@CThread@@QAEIXZ
?Resume@CVProfNode@@QAEXXZ
?Resume@CVProfile@@QAEXXZ
?Set@CThreadEvent@@QAE_NXZ
?Set@CThreadLocalBase@@QAEXPAX@Z
?SetBudgetGroupID@CVProfNode@@QAEXH@Z
?SetClientData@CVProfNode@@QAEXH@Z
?SetCurFrameTime@CVProfNode@@QAEXK@Z
?SetName@CThread@@QAEXPBD@Z
?SetPriority@CThread@@QAE_NH@Z
?SetThreadSafe@CVProfile@@QAEX_N@Z
?SetTrace@CThreadFastMutex@@QAEX_N@Z
?SetTrace@CThreadFullMutex@@QAEX_N@Z
?SetTrace@CThreadMutex@@QAEX_N@Z
?SetUniqueNodeID@CVProfNode@@AAEXH@Z
?Sleep@CThread@@SAXI@Z
?Start@CThread@@UAE_NI@Z
?Start@CVProfile@@QAEXXZ
?Stop@CThread@@QAEXH@Z
?Stop@CVProfile@@QAEXXZ
?SumTimes@CVProfile@@IAEXPAVCVProfNode@@H@Z
?SumTimes@CVProfile@@IAEXPBDH@Z
?Suspend@CThread@@QAEIXZ
?Term@CVProfile@@QAEXXZ
?Terminate@CThread@@QAE_NH@Z
?ThreadProc@CThread@@CGIPAX@Z
?TryLock@CThreadFastMutex@@QCE_NXZ
?TryLock@CThreadFastMutex@@QDE_NXZ
?Unlock@CThreadFastMutex@@QCEXXZ
?Unlock@CThreadFastMutex@@QDEXXZ
?Unlock@CThreadFullMutex@@QAEXXZ
?Unlock@CThreadMutex@@QAEXXZ
?Unlock@CThreadMutex@@QBEXXZ
?UnlockValidationLocks@CValidator@@QAEXXZ
?UsePME@CVProfile@@QAE_NXZ
?VTuneGroupEnabled@CVProfile@@IAE_NXZ
?VTuneGroupID@CVProfile@@IAEHXZ
?Validate@CVProfNode@@QAEXAAVCValidator@@PAD@Z
?Validate@CVProfile@@QAEXAAVCValidator@@PAD@Z
?Validate@CValidator@@QAEXAAV1@PAD@Z
?ValidateGlobals@CTier0@@SAXAAVCValidator@@@Z
?Wait@CThreadEvent@@QAE_NI@Z
?Wait@CThreadSyncObject@@QAE_NI@Z
?WaitForCall@CWorkerThread@@QAE_NIPAI@Z
?WaitForCall@CWorkerThread@@QAE_NPAI@Z
?WaitForCreateComplete@CThread@@MAE_NPAVCThreadEvent@@@Z
?Yield@CThread@@SAXXZ
?fDumped@?BA@??GetBudgetGroupFlags@CVProfile@@QBEHH@Z@4_NA
?fDumped@?BA@??GetBudgetGroupName@CVProfile@@QAEPBDH@Z@4_NA
?fDumped@?BA@??GetName@CVProfNode@@QAEPBDXZ@4_NA
?fDumped@?BA@??GetOrigNameAddress@CVProfNode@@QAEPBXXZ@4_NA
?fDumped@?BA@??GetParent@CVProfNode@@QAEPAV2@XZ@4_NA
?fDumped@?BA@??PopGroup@CVProfile@@QAEXXZ@4_NA
?fDumped@?BA@??PushGroup@CVProfile@@QAEXH@Z@4_NA
?fDumped@?CB@??PushGroup@CVProfile@@QAEXH@Z@4_NA
?g_bInException@@3_NC
?s_iCurrentUniqueNodeID@CVProfNode@@0HA
AssertValidStringPtr
BGetMiniDumpLock
CallAssertFailedNotifyFunc
CallFlushLogFunc
CatchAndWriteMiniDump
CatchAndWriteMiniDumpForVoidPtrFn
CrackSmokingCompiler
CreateSimpleThread
DLog
DWarning
DeclareCurrentThreadIsMainThread
DoNewAssertDialog
Error
GetCPUInformation
GetSpewOutputFunc
InitPME
Is64BitWindows
IsInAssert
IsLogActive
IsSpewActive
Log
MemAllocScratch
MemFreeScratch
MiniDumpUnlock
Msg
Plat_Alloc
Plat_FloatTime
Plat_Free
Plat_GetCommandLine
Plat_GetCurrentThreadID
Plat_IsInDebugSession
Plat_MSTime
Plat_PrimaryThreadID
Plat_Realloc
Plat_RegisterPrimaryThread
Plat_RegisterThread
Plat_SetThreadName
Plat_SimpleLog
SetAssertFailedNotifyFunc
SetFlushLogFunc
SetInAssert
SetMiniDumpFunction
ShouldUseNewAssertDialog
ShutdownPME
SpewActivate
SpewAndLogActivate
SpewAndLogChangeIfStillDefault
SpewChangeIfStillDefault
SpewOutputFunc
TestThread_Yield
Test_HasFailed
Test_HasFinished
Test_IsActive
Test_RunFrame
Test_RunTest
Test_SetFailed
Test_TerminateThread
ThreadGetCurrentId
ThreadGetCurrentProcessId
ThreadGetPriority
ThreadInMainThread
ThreadInterlockedCompareExchange
ThreadInterlockedCompareExchangePointer
ThreadInterlockedDecrement
ThreadInterlockedExchange
ThreadInterlockedExchangeAdd
ThreadInterlockedExchangePointer
ThreadInterlockedIncrement
ThreadIsProcessActive
ThreadSleep
ValidateSpew
WaitForMultipleEvents
Warning
WriteMiniDump
_AssertValidReadPtr
_AssertValidReadWritePtr
_AssertValidWritePtr
_DMsg
_DSpewMessage
_ExitOnFatalAssert
_SpewInfo
_SpewMessage
_SpewMessageType
g_ClockSpeed
g_ClockSpeedMicrosecondsMultiplier
g_ClockSpeedMillisecondsMultiplier
g_ClockSpeedSecondsMultiplier
g_VProfCurrentProfile
g_cBadCycleCountReceived
g_dwClockSpeed
g_pMemAlloc
g_pVCR
g_ulLastCycleSample
vtune
Sections
.text Size: 255KB - Virtual size: 254KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ