SessEnv[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SessEnv.dll
Size

404KB
MD5

68897b629ef96bbee709272d3e6ca9ec
SHA1

f1e3d372c21b96c8a72aabc1c0fbb50ce7ee554b
SHA256

06bcf0bafb27e66b50c5e6d596851dd63902a47273329a2d144892bf63529583
SHA512

c37fcafce81e4f7229b8a3e4e380e23c482206665c2ebf31a7b7b1cc5897dc0df5e4ab674345f8ae3fd425a648f90dd95b3536612a8a918440a1e9cdcd13974a
SSDEEP

6144:hlc4F386x8cPY+IJ6EGZ/eWSHa0XEkj/9623jRgFJKjpPI75CeU4K6LliAVOq0H2:7xzHI8ZSxF62QKjhOCeU4KIzh0pU6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SessEnv.dll

Files

SessEnv.dll
.dll windows:10 windows x86 arch:x86

2da2dafe5f910d65097e1fce5bbb983e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SessEnv.pdb

Imports

msvcrt

_purecall
_CxxThrowException
_vsnwprintf
_vsnprintf
wcscpy_s
?terminate@@YAXXZ
wcscat_s
toupper
wcschr
_wtol
__CxxFrameHandler3
memcpy_s
_wcsicmp
??1type_info@@UAE@XZ
memcmp
memcpy
memmove
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
free
_wcsnicmp
wcsrchr
wcsncmp
iswalpha
swprintf_s
_callnewh
malloc
memset

ntdll

RtlLengthSid
RtlFreeHeap
RtlAllocateHeap
NtQueryInformationProcess
RtlNtStatusToDosError
WinSqmSetDWORD
WinSqmStartSession
WinSqmAddToStream
WinSqmEndSession
WinSqmIsOptedIn
RtlGetActiveConsoleId
EtwEventWriteFull
EtwEventRegister
EtwEventUnregister
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlQueryEnvironmentVariable_U
RtlInitUnicodeStringEx
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlEnumerateGenericTable
RtlAllocateAndInitializeSid
RtlAcquireResourceExclusive
RtlReleaseResource
RtlAcquireResourceShared
DbgPrint
RtlEqualSid
VerSetConditionMask
RtlFreeSid
RtlInitializeResource
RtlVerifyVersionInfo
RtlCaptureStackBackTrace
RtlDeleteResource
NtQuerySystemInformation
NtDuplicateToken

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadStringW
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
ReleaseSRWLockExclusive
SetEvent
LeaveCriticalSection
ResetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
InitializeCriticalSection

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegDeleteTreeW
RegQueryInfoKeyW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegLoadKeyW
RegGetValueW
RegUnLoadKeyW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegDeleteValueW
RegEnumKeyExW
RegOpenCurrentUser

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled
EventSetInformation
EventRegister
EventActivityIdControl
EventWriteTransfer
EventUnregister

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-0

GetThreadId
CreateProcessAsUserW
OpenThreadToken
GetCurrentThread
TerminateProcess
ProcessIdToSessionId
GetCurrentProcessId
OpenProcessToken
CreateProcessW
GetCurrentThreadId
GetCurrentProcess
CreateThread
TerminateThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount
GetVersionExW
GetLocalTime
GetSystemDirectoryW
GetSystemTime

kernel32

UnregisterWaitEx
WTSGetActiveConsoleSessionId
CreateTimerQueue
DeleteTimerQueueTimer
VerifyVersionInfoW
GetComputerNameW
DeleteTimerQueueEx
CreateTimerQueueTimer
MoveFileW
SetVolumeMountPointW

sysntfy

SysNotifyStopServer
SysNotifyStartServer

dismapi

DismInitialize
DismShutdown
DismEnableFeature
DismDisableFeature
DismOpenSession

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StartTraceW
EnableTraceEx2

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoWaitForMultipleHandles
StringFromCLSID
CoSetProxyBlanket
CoCreateInstanceEx
CoInitializeEx
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
DebugBreak

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
MakeAbsoluteSD
GetTokenInformation
FreeSid
CheckTokenMembership
AdjustTokenPrivileges
GetAce
GetFileSecurityW
GetSecurityDescriptorLength
SetSecurityDescriptorControl
InitializeSecurityDescriptor
IsValidSid
DeleteAce
GetSecurityDescriptorControl
CopySid
GetLengthSid
CreateWellKnownSid
AllocateAndInitializeSid
GetAclInformation
SetFileSecurityW
SetTokenInformation
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RevertToSelf
DuplicateToken
EqualSid
GetSecurityDescriptorDacl

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

rpcrt4

RpcServerInqBindings
RpcServerUseProtseqExW
RpcBindingFree
NdrServerCall2
RpcBindingInqAuthClientW
RpcBindingServerFromClient
I_RpcBindingInqLocalClientPID
RpcRevertToSelf
RpcBindingVectorFree
RpcImpersonateClient
RpcFreeAuthorizationContext
RpcGetAuthorizationContextForClient
RpcServerInqCallAttributesW
RpcStringBindingParseW
RpcStringFreeW
UuidToStringW
RpcBindingToStringBindingW
RpcServerUnregisterIfEx
RpcEpRegisterW
RpcServerInqDefaultPrincNameW
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerUseProtseqEpW
UuidCreate

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc

api-ms-win-core-file-l1-1-0

DeleteFileW
CompareFileTime
CreateDirectoryW
FindClose
CreateFileW
GetFileTime
RemoveDirectoryW
GetFileAttributesW
FindNextFileW
FileTimeToLocalFileTime
FindFirstFileW
GetFileSizeEx
SetFilePointer
WriteFile
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
SetFileAttributesW
DeleteVolumeMountPointW
ReadFile

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l2-1-0

MoveFileWithProgressW
GetFileInformationByHandleEx
CreateSymbolicLinkW
CopyFileExW

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

samcli

NetLocalGroupDelMembers
NetLocalGroupAddMembers
NetUserGetInfo

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
GetTempPathW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-security-credentials-l1-1-0

CredUnprotectW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrToIntExW

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

shell32

SHGetKnownFolderPath

scecli

SceSetupSystemByInfName

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 366KB - Virtual size: 365KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2da2dafe5f910d65097e1fce5bbb983e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

kernel32

sysntfy

dismapi

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

rpcrt4

api-ms-win-core-heap-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-shutdown-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

samcli

api-ms-win-core-file-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-security-credentials-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

shell32

scecli

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-localization-l1-2-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 366KB - Virtual size: 365KB

.data Size: 1KB - Virtual size: 14KB

.idata Size: 11KB - Virtual size: 11KB

.didat Size: 1024B - Virtual size: 592B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 366KB - Virtual size: 365KB

.data
Size: 1KB - Virtual size: 14KB

.idata
Size: 11KB - Virtual size: 11KB

.didat
Size: 1024B - Virtual size: 592B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 21KB