easwrt[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

easwrt.dll
Size

183KB
MD5

a6bc2195074c8378d7fb15bffea4bfe0
SHA1

e1c8b29a353e55457842fc216ed6f7ddf4c332c1
SHA256

92d91e18354d48a4846cd71f680df8c81c462508310d9bf60f5617e4debb12f6
SHA512

d193383eb8ff3fcd283add8f8f624597cacaba4cdfad33cf264527ec340fa3f88eb0f400f49221ae5d05edf78a73e5a516aae9e4eed83f30b53bc56c6d97c414
SSDEEP

3072:PtGkaNi2xXibxdcfLGrmTkJkf1LbvMZhn2yTN3NF6fy8QD5vR3ruLq4CouYH1Kf:y1ibxqgmtPML2INF6fy8QDz3+woBH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
easwrt.dll

Files

easwrt.dll
.dll windows:6 windows x64 arch:x64

a9e964785fec14cc183973c18d2771c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

easwrt.pdb

Imports

msvcrt

_vsnwprintf
_wtoi
memcmp
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
malloc
free
__C_specific_handler
memset
??2@YAPEAX_K@Z
_purecall
??3@YAXPEAX@Z
memcpy

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlEqualSid
RtlNtStatusToDosError
RtlInitializeSid
RtlSubAuthoritySid
RtlInitUnicodeString
RtlGetNtProductType
RtlCopySid
NtClose
RtlSubAuthorityCountSid
NtOpenThreadToken
NtOpenProcessToken
NtDuplicateToken
NtQueryInformationToken
NtQuerySystemInformation
NtSetCachedSigningLevel
NtGetCachedSigningLevel
WinSqmSetString
RtlReleaseResource
NtQueryInformationProcess
RtlAcquireResourceExclusive
RtlInitializeResource
RtlLengthSid
RtlDeleteResource

kernel32

EncodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockShared
RaiseException
DisableThreadLibraryCalls
DecodePointer
AcquireSRWLockShared
DeleteCriticalSection
GetModuleFileNameW
GetLastError
LocalAlloc
LocalFree
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetComputerNameW
GetCurrentThread
CloseHandle
CloseThreadpoolTimer
TlsGetValue
FreeLibrary
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
GetModuleHandleExW
WaitForSingleObject
SetEvent
TlsSetValue
OpenProcess
InitOnceExecuteOnce
ReleaseSemaphore
FreeLibraryAndExitThread
InitializeSRWLock
CreateSemaphoreW
FreeLibraryWhenCallbackReturns
CreateEventExW
CreateThreadpoolTimer
CallbackMayRunLong
OpenSemaphoreW
TlsAlloc
TrySubmitThreadpoolCallback
TlsFree
CreateThread
LoadLibraryExW
GetProcAddress
GetVersionExW
CreateFileW
CompareStringOrdinal
GetPackageFamilyName
GetProcessHeap
HeapFree
HeapAlloc
GetSystemWindowsDirectoryW
GetProcessId
DuplicateHandle

ole32

ObjectStublessClient9
ObjectStublessClient3
ObjectStublessClient10
ObjectStublessClient6
ObjectStublessClient22
NdrProxyForwardingFunction5
ObjectStublessClient20
ObjectStublessClient16
ObjectStublessClient19
CoTaskMemFree
ObjectStublessClient13
ObjectStublessClient11
NdrProxyForwardingFunction3
ObjectStublessClient18
ObjectStublessClient7
ObjectStublessClient15
ObjectStublessClient23
ObjectStublessClient8
ObjectStublessClient17
ObjectStublessClient12
NdrProxyForwardingFunction4
ObjectStublessClient14
CoTaskMemAlloc
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket
CoUninitialize
CreateStreamOnHGlobal
StringFromGUID2
CoGetObject
CoReleaseMarshalData
RoGetAgileReference
CoWaitForMultipleHandles
CoGetCallerTID
CoGetCallContext
CoCopyProxy
CoGetInterfaceAndReleaseStream
CoGetApartmentType
CoInitializeEx
CoMarshalInterface
ObjectStublessClient21

user32

GetWindow
ord2521
GetWindowThreadProcessId
UpdatePerUserSystemParameters
SystemParametersInfoW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
IsWindow
PostThreadMessageW
EnableWindow
DispatchMessageW
ord2529
GetClassNameW

advapi32

OpenProcessToken
RegSetValueExW
PrivilegeCheck
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
ConvertSidToStringSidW
GetSecurityDescriptorDacl
LsaLookupSids
CopySid
GetLengthSid
EventWrite
CreateWellKnownSid
LsaFreeMemory
CheckTokenMembership
RegGetValueW
LsaClose
DuplicateToken
GetTokenInformation
LsaOpenPolicy
EventUnregister
OpenThreadToken
FreeSid
AllocateAndInitializeSid
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
LsaQueryInformationPolicy
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage
EventRegister

oleaut32

VariantClear
VariantInit

samlib

SamOpenDomain
SamCloseHandle
SamQuerySecurityObject
SamQueryInformationDomain
SamFreeMemory
SamQueryInformationUser
SamOpenUser
SamConnect

winbio

WinBioGetLogonSetting
WinBioGetDomainLogonSetting
WinBioGetEnabledSetting
WinBioRemoveAllCredentials

samcli

NetUserGetInfo

netutils

NetApiBufferFree

authz

AuthzInitializeResourceManager
AuthzFreeResourceManager
AuthzAccessCheck
AuthzFreeContext
AuthzInitializeContextFromSid
AuthzAddSidsToContext

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptHashData

rpcrt4

CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
NdrStubCall3
CStdStubBuffer_Invoke
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_QueryInterface_Proxy
NdrOleFree
CStdStubBuffer_IsIIDSupported
NdrStubForwardingFunction
CStdStubBuffer_AddRef
RpcBindingBind
RpcBindingCreateW
RpcBindingSetAuthInfoExW
I_RpcMapWin32Status
NdrClientCall3
RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
NdrOleAllocate
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
HSTRING_UserUnmarshal64
HSTRING_UserFree
HSTRING_UserSize64
HSTRING_UserMarshal64
WindowsGetStringRawBuffer
WindowsCreateString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
HSTRING_UserUnmarshal
HSTRING_UserMarshal
HSTRING_UserFree64
HSTRING_UserSize
WindowsDeleteString

api-ms-win-core-winrt-error-l1-1-1

RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
IsErrorPropagationEnabled
GetRestrictedErrorInfo
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
RoTransformError

api-ms-win-shcore-thread-l1-1-0

SHGetThreadRef
SHSetThreadRef
SHCreateThreadRef

combase

ord90

twinapi

ord9

twinapi.appcore

ord2
ord3

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
EasClientSecurityPolicyApply
EasClientSecurityPolicyCheckCompliance
EasGetClientDeviceInformation
EasRegisterEncryptionProvider
EasUnRegisterEncryptionProvider

Sections

.text
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 239B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9e964785fec14cc183973c18d2771c8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

ole32

user32

advapi32

oleaut32

samlib

winbio

samcli

netutils

authz

bcrypt

rpcrt4

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-shcore-thread-l1-1-0

combase

twinapi

twinapi.appcore

Exports

Exports

Sections

.text Size: 157KB - Virtual size: 156KB

.orpc Size: 512B - Virtual size: 239B

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 4KB - Virtual size: 4KB

.idata Size: 12KB - Virtual size: 11KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 157KB - Virtual size: 156KB

.orpc
Size: 512B - Virtual size: 239B

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 4KB - Virtual size: 4KB

.idata
Size: 12KB - Virtual size: 11KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB