e:\sz\x64\release\InCSRSS.pdb
Static task
static1
Behavioral task
behavioral1
Sample
consrv.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
consrv.dll
Resource
win10v2004-20240611-en
General
-
Target
consrv.dll
-
Size
52KB
-
MD5
6bf2039986af96d98e08824ac6c383fd
-
SHA1
0bb6384656a96943cb427baa92446f987219a02e
-
SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
-
SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e
-
SSDEEP
768:dKWXccihy5jWpHwAsRzYlkAWs/RP7Ae4UZ3OWnG7fBJSsM/G1bFFFYFefOFJYFxO:dKoyuWOneiqRn4KeWnHg4IjW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource consrv.dll
Files
-
consrv.dll.dll windows:5 windows x64 arch:x64
3f61e17165c2f3568456d5d7b8e5708f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
ZwOpenFile
ZwDeviceIoControlFile
ZwCreateSymbolicLinkObject
ZwMakeTemporaryObject
ZwDeleteFile
ZwCreateSection
ZwWriteFile
strcpy
RtlInitUnicodeString
swprintf
LdrFindEntryForAddress
ZwQueueApcThread
ZwWriteVirtualMemory
ZwAllocateVirtualMemory
ZwQueryInformationThread
ZwOpenThread
ZwOpenProcess
ZwQuerySystemInformation
RtlEqualUnicodeString
ZwReadVirtualMemory
ZwQueryInformationProcess
LdrProcessRelocationBlock
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwAlertThread
ZwWaitForSingleObject
RtlCreateUserThread
RtlComputeCrc32
ZwAllocateLocallyUniqueId
ZwDelayExecution
ZwCreateEvent
ZwAdjustPrivilegesToken
ZwOpenProcessToken
ZwOpenKey
ZwNotifyChangeKey
ZwSetInformationObject
ZwSetValueKey
memcmp
wcsstr
ZwQueryValueKey
ZwClose
ZwFsControlFile
wcslen
ZwCreateFile
memset
memcpy
RtlExitUserThread
LdrUnloadDll
__chkstk
kernel32
Sleep
DisableThreadLibraryCalls
CreateThread
LoadLibraryA
VirtualAlloc
SwitchToThread
GetTickCount
LoadLibraryW
VirtualFree
GetProcAddress
SleepEx
advapi32
CloseServiceHandle
OpenServiceW
ControlService
OpenSCManagerW
ws2_32
WSAStartup
WSACleanup
Exports
Exports
ConServerDllInitialization
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 994B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 282B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ