RTWorkQ[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RTWorkQ.dll
Size

163KB
MD5

7774bbf22118faf95ed15d14929a49cd
SHA1

f7bfc769c11d44ad0aa4b4e48c66b884b712e312
SHA256

bb802cdbc492b9eb2d155d70d6e4d0bd329a39679dbc82e90656f3c33d729642
SHA512

12c4efec598611fb9347d437756065fac89fef5075696d74ee95c05bf49228de2a570819dd5c619d9a6ec62a04718bfd99a1a228ce2d9d0117764b8aa158487e
SSDEEP

3072:AJn4pQoM25VrhB8wAonr98ne/4sGcCIrpi6Z28biuJWQ57m:AJn4uop5VrMwbr98ne/4sHDvbgr

Score

1^/10

Malware Config

Signatures

Files

RTWorkQ.dll
.dll windows:10 windows x86 arch:x86

caedc48dc623986747ca060fc9a8fdda

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:d3:6c:ea:f4:71:d7:a7:a1:21:ca:e8:77:f8:24:30:82:54:b6:f4:a6:4b:23:4d:0e:30:85:44:75:85:40:f7
Signer

Actual PE Digest

de:d3:6c:ea:f4:71:d7:a7:a1:21:ca:e8:77:f8:24:30:82:54:b6:f4:a6:4b:23:4d:0e:30:85:44:75:85:40:f7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

rtworkq.pdb

Imports

msvcrt

__dllonexit
memcpy
_onexit
memcmp
_XcptFilter
_lock
_callnewh
malloc
free
srand
_amsg_exit
_beginthreadex
_initterm
_except_handler4_common
_unlock
wcsncmp
_purecall
_wcsnicmp
memmove
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-synch-l1-1-0

CancelWaitableTimer
WaitForSingleObject
SetWaitableTimer
DeleteCriticalSection
ReleaseSemaphore
CreateEventW
CreateSemaphoreExW
CreateWaitableTimerExW
InitializeSRWLock
InitializeCriticalSection
EnterCriticalSection
SetEvent
LeaveCriticalSection
ResetEvent
ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

ntdll

TpSetPoolThreadBasePriority
TpTrimPools
NtSetInformationThread
TpSetPoolWorkerThreadIdleTimeout
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlIsCriticalSectionLockedByThread
RtlEqualWnfChangeStamps

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
TlsSetValue
GetCurrentProcess
TlsGetValue
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
TlsFree
TlsAlloc

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoGetApartmentType
CoIncrementMTAUsage
CoDecrementMTAUsage

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolThreadMaximum
SubmitThreadpoolWork
CreateThreadpool
CloseThreadpoolWait
CreateThreadpoolWait
CreateThreadpoolWork
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolThreadMinimum
StartThreadpoolIo
CloseThreadpoolIo
CreateThreadpoolIo
CancelThreadpoolIo
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolTimer
CloseThreadpool
CreateThreadpoolTimer

api-ms-win-core-debug-l1-1-0

DebugBreak

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsAlloc
FlsFree

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-com-private-l1-1-0

CoRevokeInitializeSpy
CoRegisterInitializeSpy

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

RtwqAddPeriodicCallback
RtwqAllocateSerialWorkQueue
RtwqAllocateWorkQueue
RtwqBeginRegisterWorkQueueWithMMCSS
RtwqBeginUnregisterWorkQueueWithMMCSS
RtwqCancelDeadline
RtwqCancelMultipleWaitingWorkItem
RtwqCancelWorkItem
RtwqCreateAsyncResult
RtwqEndRegisterWorkQueueWithMMCSS
RtwqEndUnregisterWorkQueueWithMMCSS
RtwqGetPlatform
RtwqGetWorkQueueMMCSSClass
RtwqGetWorkQueueMMCSSPriority
RtwqGetWorkQueueMMCSSTaskId
RtwqInvokeCallback
RtwqJoinWorkQueue
RtwqLockPlatform
RtwqLockSharedWorkQueue
RtwqLockWorkQueue
RtwqPutMultipleWaitingWorkItem
RtwqPutWaitingWorkItem
RtwqPutWorkItem
RtwqRegisterPlatformEvents
RtwqRegisterPlatformWithMMCSS
RtwqRemovePeriodicCallback
RtwqScheduleWorkItem
RtwqSetDeadline
RtwqSetDeadline2
RtwqSetLongRunning
RtwqShutdown
RtwqStartup
RtwqUnjoinWorkQueue
RtwqUnlockPlatform
RtwqUnlockWorkQueue
RtwqUnregisterPlatformEvents
RtwqUnregisterPlatformFromMMCSS

Sections

.text
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

caedc48dc623986747ca060fc9a8fdda

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

de:d3:6c:ea:f4:71:d7:a7:a1:21:ca:e8:77:f8:24:30:82:54:b6:f4:a6:4b:23:4d:0e:30:85:44:75:85:40:f7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-1-0

ntdll

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 107KB - Virtual size: 107KB

.data Size: 512B - Virtual size: 9KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 64B

.rsrc Size: 31KB - Virtual size: 31KB

.reloc Size: 8KB - Virtual size: 7KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

de:d3:6c:ea:f4:71:d7:a7:a1:21:ca:e8:77:f8:24:30:82:54:b6:f4:a6:4b:23:4d:0e:30:85:44:75:85:40:f7
Signer

.text
Size: 107KB - Virtual size: 107KB

.data
Size: 512B - Virtual size: 9KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 64B

.rsrc
Size: 31KB - Virtual size: 31KB

.reloc
Size: 8KB - Virtual size: 7KB