BthA2dp[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BthA2dp.sys
Size

532KB
MD5

83fe48f382a079c67531d04fc20069eb
SHA1

c9f11334b4e8447de8a57aa405ca43a0da7a12c4
SHA256

00ec9ff7f96086ad15e27b8f3eac658e66c08f2d10807df51efaf11cf7638560
SHA512

564ff9797a54eadf744923977cf461473776a1ac5f1f7aa59768b96741445fc8ff22917897149296f769a4210276b326547ea0ca11bfbbb05fc3a7cf0d78863e
SSDEEP

6144:0xISNaO5pipMYi7dIZ99lJ96iLoMnnUdlZrwDAw/g:0xISb5dCZ1n6uUd+Aw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BthA2dp.sys

Files

BthA2dp.sys
.sys windows:10 windows x64 arch:x64

0e1e97c58121ad3e928b7106af7d3268

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

btha2dp.pdb

Imports

ntoskrnl.exe

RtlAnsiCharToUnicodeChar
EtwRegister
EtwUnregister
RtlUnregisterFeatureConfigurationChangeNotification
RtlQueryFeatureConfigurationChangeStamp
EtwSetInformation
RtlQueryFeatureConfiguration
RtlRegisterFeatureConfigurationChangeNotification
KeQueryInterruptTimePrecise
EtwActivityIdControl
ExCancelTimer
ExAllocateTimer
ExSetTimer
IoGetDeviceInterfacePropertyData
IoGetDevicePropertyData
KeQuerySystemTimePrecise
IoSetDevicePropertyData
KeQueryUnbiasedInterruptTime
IoSetDeviceInterfacePropertyData
IoQueueWorkItemEx
ExAllocatePool2
EtwWriteTransfer
ExInitializePushLock
KeAcquireSpinLockRaiseToDpc
IofCallDriver
IoBuildDeviceIoControlRequest
ExFreePool
IoCsqInsertIrp
IoCsqRemoveNextIrp
IoCsqInitialize
ZwOpenKey
ZwClose
IoWMIRegistrationControl
ZwQueryValueKey
MmGetSystemRoutineAddress
DbgPrintEx
RtlAppendUnicodeToString
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
RtlCopyUnicodeString
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
_purecall
RtlInitUnicodeString
IofCompleteRequest
KeCancelTimer
KeClearEvent
KeInitializeTimer
IoInitializeRemoveLockEx
KeInitializeDpc
IoGetDeviceInterfaces
IoGetDeviceObjectPointer
ObfDereferenceObject
IoFreeIrp
IoSetCompletionRoutineEx
IoAllocateIrp
IoReleaseRemoveLockAndWaitEx
IoCancelIrp
IoReleaseCancelSpinLock
KeQueryTimeIncrement
ZwPowerInformation
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlInitAnsiString
RtlCompareUnicodeString
KeInitializeSemaphore
PsCreateSystemThread
ObReferenceObjectByHandle
KeReleaseSemaphore
KeWaitForMultipleObjects
PsTerminateSystemThread
__chkstk
IoQueueWorkItem
KseQueryDeviceFlags
MmIsDriverVerifyingByAddress
RtlRunOnceExecuteOnce
IoQueryFullDriverPath
DbgkWerCaptureLiveKernelDump
IoCsqInitializeEx
IoCsqInsertIrpEx
IoReleaseRemoveLockEx
IoAcquireRemoveLockEx
KeSetTimer
KeResetEvent
KeWaitForSingleObject
KeInitializeEvent
ExFreePoolWithTag
IoFreeWorkItem
KeSetEvent
KeReleaseSpinLock
KeInitializeSpinLock
KeGetCurrentIrql
IoAllocateWorkItem

hal

KeQueryPerformanceCounter

ks.sys

KsGetNextSibling
KsFilterFactorySetDeviceClassesState
KsGetFirstChild
KsGetDeviceForDeviceObject
KsReleaseDevice
KsAcquireDevice
KsPinGetParentFilter
KsFreeObjectBag
KsGetNodeIdFromIrp
KsFilterFactoryGetSymbolicLink
KsFilterFactoryUpdateCacheData
KsGetObjectFromFileObject
KsGetParent
KsCreateFilterFactory
KsGenerateEvent
KsDefaultAddEventHandler
KsAddEvent
KsGetFilterFromIrp
KsInitializeDriver
KsDispatchIrp
KsStreamPointerClone
KsStreamPointerAdvance
KsPinAcquireProcessingMutex
KsStreamPointerGetNextClone
KsAllocateObjectBag
KsPinReleaseProcessingMutex
KsStreamPointerUnlock
KsReleaseControl
KsPinGetFirstCloneStreamPointer
KsPinGetLeadingEdgeStreamPointer
KsStreamPointerSetStatusCode
KsGetPinFromIrp
KsStreamPointerAdvanceOffsets
KsGetDevice
KsAcquireControl
KsStreamPointerDelete
KsGenerateEvents
_KsEdit
KsPinAttemptProcessing

btampm.sys

BtaMpmBuildIndirectStringFromMessageWithSingleUTF8Arg
BtaMpmConnectionRequest
BtaMpmUnregisterPnp
BtaMpmGetRemoteDeviceProfileVersionAndAttribute
BtaMpmUpdateConnectionStatus
BtaMpmRegisterPnp
BtaMpmUpdateSuspendStatus
BtaMpmUnregister
BtaMpmUpdatePlayStatus
BtaMpmRegister

wpprecorder.sys

WppAutoLogTrace
imp_WppRecorderReplay
WppAutoLogStop
WppAutoLogStart

wdfldr.sys

WdfVersionUnbind
WdfLdrQueryInterface
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

ksecdd.sys

BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash

Sections

.text
Size: 320KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

NONPAGE
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 446B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e1e97c58121ad3e928b7106af7d3268

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

ks.sys

btampm.sys

wpprecorder.sys

wdfldr.sys

ksecdd.sys

Sections

.text Size: 320KB - Virtual size: 317KB

.rdata Size: 64KB - Virtual size: 60KB

.data Size: 4KB - Virtual size: 1KB

.pdata Size: 20KB - Virtual size: 16KB

.idata Size: 8KB - Virtual size: 6KB

NONPAGE Size: 4KB - Virtual size: 176B

PAGE Size: 72KB - Virtual size: 71KB

fothk Size: 4KB - Virtual size: 4KB

INIT Size: 4KB - Virtual size: 446B

GFIDS Size: 4KB - Virtual size: 1KB

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 12KB - Virtual size: 8KB

.text
Size: 320KB - Virtual size: 317KB

.rdata
Size: 64KB - Virtual size: 60KB

.data
Size: 4KB - Virtual size: 1KB

.pdata
Size: 20KB - Virtual size: 16KB

.idata
Size: 8KB - Virtual size: 6KB

NONPAGE
Size: 4KB - Virtual size: 176B

PAGE
Size: 72KB - Virtual size: 71KB

fothk
Size: 4KB - Virtual size: 4KB

INIT
Size: 4KB - Virtual size: 446B

GFIDS
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 12KB - Virtual size: 8KB