SessEnv[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

SessEnv.dll
Size

399KB
MD5

9f999b71e06cae7792029ea6ad87d63b
SHA1

c89dfcbe864fae24dad6c606ee6ef446bd308353
SHA256

e5fe36e9aa49f4057c90ba5c96eb6ad91feada455920fc858b835de3e1cf38e4
SHA512

e794d33b5aa77536227130b36d58e256c9d02ce85c39f5716d7954762857a59597b5d3df1b157532cfcb8b1b4cae295fce1f9d86256806f6005337c65cd6f825
SSDEEP

6144:e4c4U87uzqTx0CWx/BNSWEPgleRIUBf91C4QztJWg6nHSKZqIZZxNDc3QmH6IVIg:q2KZdEc2FU4W6nH7UiZxNDsQ3zUp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SessEnv.dll

Files

SessEnv.dll
.dll windows:10 windows x86 arch:x86

43fea293e35fba4c18cf298d7c8c54a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SessEnv.pdb

Imports

msvcrt

wcschr
memcmp
_purecall
wcscat_s
__CxxFrameHandler3
wcscpy_s
_CxxThrowException
_vsnprintf
_vsnwprintf
memcpy
memmove
_except_handler4_common
memcpy_s
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
_wcsnicmp
wcsrchr
wcsncmp
iswalpha
_wtol
??1type_info@@UAE@XZ
swprintf_s
_onexit
?terminate@@YAXXZ
malloc
_wcsicmp
memset

ntdll

NtQueryInformationProcess
RtlLengthSid
NtDuplicateToken
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
WinSqmSetDWORD
WinSqmStartSession
WinSqmAddToStream
WinSqmEndSession
WinSqmIsOptedIn
RtlGetActiveConsoleId
EtwEventWriteFull
EtwEventRegister
EtwEventUnregister
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlQueryEnvironmentVariable_U
RtlInitUnicodeStringEx
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlEnumerateGenericTable
RtlAllocateAndInitializeSid
RtlAcquireResourceExclusive
RtlReleaseResource
RtlAcquireResourceShared
DbgPrint
RtlEqualSid
VerSetConditionMask
RtlFreeSid
RtlInitializeResource
RtlVerifyVersionInfo
RtlCaptureStackBackTrace
RtlDeleteResource
NtQuerySystemInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetProcAddress
LoadLibraryExW
LoadStringW
GetModuleFileNameW
DisableThreadLibraryCalls

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ResetEvent
LeaveCriticalSection
WaitForMultipleObjectsEx
DeleteCriticalSection
EnterCriticalSection
CreateEventW
SetEvent
InitializeCriticalSection

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-0

ProcessIdToSessionId
OpenProcessToken
TerminateThread
OpenThreadToken
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetThreadId
CreateProcessW
GetCurrentProcess
CreateProcessAsUserW
CreateThread
GetCurrentThread

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemTime
GetTickCount
GetVersionExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetLocalTime

kernel32

WTSGetActiveConsoleSessionId
UnregisterWaitEx
DeleteTimerQueueTimer
VerifyVersionInfoW
GetComputerNameW
DeleteTimerQueueEx
CreateTimerQueueTimer
CreateTimerQueue
MoveFileW
SetVolumeMountPointW

sysntfy

SysNotifyStopServer
SysNotifyStartServer

dismapi

DismOpenSession
DismEnableFeature
DismShutdown
DismDisableFeature
DismInitialize

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
StartTraceW
ControlTraceW

api-ms-win-core-registry-l1-1-0

RegLoadKeyW
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExW
RegUnLoadKeyW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegEnumKeyExW
RegOpenCurrentUser
RegSetValueExW
RegDeleteTreeW
RegGetValueW
RegQueryInfoKeyW
RegQueryValueExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
EventActivityIdControl

api-ms-win-core-com-l1-1-0

CoCreateInstanceEx
CoSetProxyBlanket
CoWaitForMultipleHandles
CoCreateInstance
CoCreateGuid
CoUninitialize
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD
RevertToSelf
CreateWellKnownSid
FreeSid
AllocateAndInitializeSid
SetTokenInformation
ImpersonateLoggedOnUser
GetFileSecurityW
GetSecurityDescriptorLength
SetSecurityDescriptorControl
InitializeSecurityDescriptor
IsValidSid
DeleteAce
GetSecurityDescriptorControl
EqualSid
GetAce
CheckTokenMembership
GetTokenInformation
DuplicateToken
GetAclInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AdjustTokenPrivileges
GetLengthSid
SetFileSecurityW
DuplicateTokenEx
CopySid

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc

api-ms-win-core-file-l1-1-0

GetFileSizeEx
ReadFile
GetFileTime
SetFilePointer
CreateFileW
FileTimeToLocalFileTime
FindFirstFileW
WriteFile
FindFirstVolumeW
GetFileAttributesW
CompareFileTime
FindClose
DeleteVolumeMountPointW
DeleteFileW
RemoveDirectoryW
FindVolumeClose
FindNextVolumeW
SetFileAttributesW
FindNextFileW
CreateDirectoryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-io-l1-1-0

DeviceIoControl

rpcrt4

RpcServerRegisterIfEx
RpcServerUnregisterIfEx
RpcStringFreeW
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcServerInqCallAttributesW
RpcGetAuthorizationContextForClient
RpcImpersonateClient
RpcRevertToSelf
UuidCreate
RpcBindingServerFromClient
UuidToStringW
NdrServerCall2
I_RpcBindingInqLocalClientPID
RpcBindingVectorFree
RpcEpRegisterW
RpcServerInqBindings
RpcServerUseProtseqExW
RpcBindingFree
RpcBindingInqAuthClientW
RpcFreeAuthorizationContext
RpcServerUseProtseqEpW

api-ms-win-core-file-l2-1-0

MoveFileWithProgressW
CopyFileExW
CreateSymbolicLinkW
GetFileInformationByHandleEx

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetProcessMitigationPolicy

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

samcli

NetLocalGroupDelMembers
NetLocalGroupAddMembers
NetUserGetInfo

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
GetTempPathW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-security-credentials-l1-1-0

CredUnprotectW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrToIntExW

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

shell32

SHGetKnownFolderPath

scecli

SceSetupSystemByInfName

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 361KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43fea293e35fba4c18cf298d7c8c54a5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

kernel32

sysntfy

dismapi

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-shutdown-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-io-l1-1-0

rpcrt4

api-ms-win-core-file-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

samcli

api-ms-win-core-file-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-security-credentials-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

shell32

scecli

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-localization-l1-2-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 361KB - Virtual size: 361KB

.data Size: 1KB - Virtual size: 13KB

.idata Size: 11KB - Virtual size: 11KB

.didat Size: 1024B - Virtual size: 592B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 361KB - Virtual size: 361KB

.data
Size: 1KB - Virtual size: 13KB

.idata
Size: 11KB - Virtual size: 11KB

.didat
Size: 1024B - Virtual size: 592B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 21KB