RstrtMgr[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

RstrtMgr.dll
Size

146KB
MD5

fc485be7cbf7878962e215be719c141e
SHA1

182f504e3d7be8d35fb56072f2152bb5543b6a47
SHA256

f6ebcb79fd6941ab161aae460f1c1991718fc4610c95e53e74ae47ef574d82a9
SHA512

0101c008332f6c70b307571fc6d45f4ce0c1a9fe844b5bc89d3d0c74511521a3b92de4762ef758e27dbfd7fb1dad5c1dce3af35e24af4e99dca6f31b8cc09b3f
SSDEEP

3072:GIFIhNPxlO0mvQ6vYrr0SYKEX3QyITeVfTfVWmZoiHU0K:GblO0OMIJn5dtrY0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RstrtMgr.dll

Files

RstrtMgr.dll
.dll windows:6 windows x86 arch:x86

497b3fd5ca3e721c81ac0a036c756cb4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

RstrtMgr.pdb

Imports

msvcrt

_except_handler4_common
??1type_info@@UAE@XZ
_initterm
free
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
wcschr
_vsnwprintf
??0exception@@QAE@XZ
memmove_s
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
memcpy_s
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
_wcsicmp
towlower
memcpy
memcmp
wcstoul
malloc
memset

ntdll

NtQueryInformationFile
RtlFreeUnicodeString
WinSqmStartSession
WinSqmEndSession
NtQueryInformationProcess
NtQuerySystemInformation
WinSqmSetString
RtlCreateUnicodeString
NtQueryInformationToken
WinSqmSetDWORD
WinSqmAddToStreamEx

kernel32

HeapCreate
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
IsWow64Process
GetCurrentProcess
ExpandEnvironmentStringsW
CreateFileW
HeapDestroy
MapViewOfFile
UnmapViewOfFile
CloseHandle
QueryPerformanceFrequency
QueryPerformanceCounter
GetFileType
GetFileInformationByHandle
InitializeCriticalSection
ProcessIdToSessionId
GetCurrentProcessId
GetProcessTimes
GetSystemTimeAsFileTime
GetModuleFileNameW
ReleaseMutex
CreateMutexW
OpenMutexW
WaitForSingleObject
OpenProcess
CompareFileTime
LocalFree
QueryFullProcessImageNameW
GetSystemWindowsDirectoryW
GetApplicationRestartSettings
SetConsoleCtrlHandler
WaitForMultipleObjects
GetConsoleProcessList
FreeConsole
AttachConsole
GenerateConsoleCtrlEvent
TerminateProcess
GetTickCount
Sleep
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
CreateNamedPipeW
CreateEventW
ConnectNamedPipe
SetEvent
WaitForSingleObjectEx
GetNamedPipeClientProcessId
DeleteCriticalSection
DuplicateHandle
ResetEvent
ReadFile
GetOverlappedResult
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
CreateFileMappingW
WriteFile

user32

GetWindow
GetWindowThreadProcessId
GetWindowLongW
SendMessageTimeoutW
EnumWindows
GetSystemMetrics

advapi32

TraceMessage
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
LookupAccountSidW
StartServiceW
QueryServiceStatusEx
ControlService
QueryServiceStatus
CreateProcessAsUserW
GetKernelObjectSecurity
DuplicateTokenEx
EqualSid
CopySid
GetTokenInformation
OpenProcessToken
I_QueryTagInformation
EnumDependentServicesW
OpenServiceW
CloseServiceHandle
EnumServicesStatusExW
OpenSCManagerW
EventUnregister
EventWrite
EventRegister
RegQueryMultipleValuesW
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegOpenKeyExW
GetTraceLoggerHandle

rpcrt4

UuidCreate

ncrypt

BCryptHashData
BCryptFinishHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider

shlwapi

ord348

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear
VariantInit

Exports

Exports

RmAddFilter
RmCancelCurrentTask
RmEndSession
RmGetFilterList
RmGetList
RmJoinSession
RmRegisterResources
RmRemoveFilter
RmReserveHeap
RmRestart
RmShutdown
RmStartSession

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

497b3fd5ca3e721c81ac0a036c756cb4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

user32

advapi32

rpcrt4

ncrypt

shlwapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 122KB - Virtual size: 121KB

.data Size: 512B - Virtual size: 3KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 122KB - Virtual size: 121KB

.data
Size: 512B - Virtual size: 3KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 9KB - Virtual size: 9KB