RtkBtManServ[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RtkBtManServ.exe
Size

710KB
MD5

614dd53e3c83bb369f23548faac71061
SHA1

67f6b2447462c3cd0bf343991e40b49d4346599b
SHA256

21c05d6ffe59386ef40abc1582374694010c08a134d5fb142a7678f0961b6287
SHA512

3858c6f004d031d8090d43617f4883e5fab4c47e1be10f4681b36118f64430f1395ad25af9b126d8c14bbedcbc6f070e99a7523a85374fa2986c0c22f7a14456
SSDEEP

12288:ysZeZdQONJoFUtZGdcxeJD/68z5N/tjcLyE+:yrjQVFSG1JD68z5N/tj46

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RtkBtManServ.exe

Files

RtkBtManServ.exe
.exe windows:6 windows x64 arch:x64

c2d9fde39619d57abf8b5d597c886bd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SVN\BTDevManager_Merge\vs2017_BTDevManager\BTDevManager\bin\x64\Win10 Release\RtkBtManServ.pdb

Imports

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
SetErrorMode

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapDestroy
HeapSize
HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-synch-l1-1-0

CreateMutexW
WaitForSingleObject
ReleaseMutex
ResetEvent
EnterCriticalSection
LeaveCriticalSection
CreateEventW
OpenEventW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSectionEx
SetEvent
InitializeCriticalSection

api-ms-win-core-synch-l1-2-0

Sleep
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

ExitProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcess
OpenProcessToken
ExitThread
CreateProcessAsUserW
GetCurrentThreadId
ResumeThread
SuspendThread
GetCurrentThread
GetExitCodeProcess
CreateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW
GetProcAddress
FreeLibrary
GetModuleHandleW
LockResource
FindResourceExW
FreeLibraryAndExitThread
LoadResource
SizeofResource

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
AdjustTokenPrivileges
SetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegNotifyChangeKeyValue
RegEnumValueW
RegQueryInfoKeyW

api-ms-win-devices-config-l1-1-1

CM_Get_Device_IDW
CM_Get_Device_ID_List_SizeW
CM_Register_Notification
CM_Unregister_Notification
CM_Get_Parent
CM_Get_Device_ID_ListW
CM_Enable_DevNode
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Locate_DevNodeW
CM_Get_DevNode_Status
CM_Disable_DevNode
CM_Get_Device_Interface_PropertyW

api-ms-win-core-file-l1-1-0

CreateFileW
WriteFile
SetEndOfFile
GetFileType
ReadFile
CreateDirectoryW
FindClose
DeleteFileW
FindFirstFileExW
FindNextFileW
GetFileSize
SetFilePointerEx
FlushFileBuffers

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetLocalTime
GetSystemTimeAsFileTime
GetSystemInfo
GetVersionExW
GetSystemDirectoryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

DeleteService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
StartServiceW
CreateServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW

ws2_32

WSACleanup
WSAStartup

api-ms-win-shell-shdirectory-l1-1-0

ord290

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot
Process32NextW
Process32FirstW

oleaut32

SysAllocStringLen

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalAlloc
GlobalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
FreeEnvironmentStringsW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-psapi-l1-1-0

K32EnumProcessModules
K32GetModuleBaseNameW
K32EnumProcesses

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalHandle
GlobalUnlock

rpcrt4

UuidToStringW
RpcStringFreeW

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle
WlanCloseHandle
WlanFreeMemory
WlanQueryInterface
WlanEnumInterfaces

wlanapi

WlanIhvControl

shlwapi

PathRemoveFileSpecW

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiBuildDriverInfoList
SetupDiSetClassInstallParamsW
SetupDiEnumDriverInfoW
SetupDiSetDeviceInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiDestroyDriverInfoList
SetupDiOpenDevRegKey
SetupDiCallClassInstaller
SetupDiGetDeviceInstallParamsW

wtsapi32

WTSQueryUserToken

dbghelp

MiniDumpWriteDump

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlPcToFileHeader
RtlUnwindEx
RtlUnwind
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsFree
FlsAlloc
FlsGetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
GetStringTypeW
CompareStringW
MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

LCMapStringW
IsValidCodePage
GetACP
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
GetOEMCP
EnumSystemLocalesW
GetCPInfo

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
ReadConsoleW
WriteConsoleW
GetConsoleCP
GetConsoleMode

Sections

.text
Size: 497KB - Virtual size: 497KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c2d9fde39619d57abf8b5d597c886bd5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

ws2_32

api-ms-win-shell-shdirectory-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

userenv

api-ms-win-core-toolhelp-l1-1-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

rpcrt4

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

setupapi

wtsapi32

dbghelp

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-1-0

Sections

.text Size: 497KB - Virtual size: 497KB

.rdata Size: 144KB - Virtual size: 143KB

.data Size: 4KB - Virtual size: 18KB

.pdata Size: 25KB - Virtual size: 25KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 497KB - Virtual size: 497KB

.rdata
Size: 144KB - Virtual size: 143KB

.data
Size: 4KB - Virtual size: 18KB

.pdata
Size: 25KB - Virtual size: 25KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB