mpclient[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mpclient.dll.exe
Size 2.6MB
Sample250810-m4bresyvhw
SHA256 fa8d09a3d211aaefb69b1438a2b3bb45cb30b84162a02d7d291d8cbc9b56b508
MD5 6dc0abefffd9a3e27cb7f8ebedc2fd2c
SHA1 22d28687f52612ec57789383ac3abd74a6f1a7a5
SHA512 9392f18293941073b65b87517ec31b36a7a3668d62d9ab764b217d9651bc8972b5d640c1c42704034e384cb325fd0d9266a96163bec02c48b4db17e3c2472e88
SSDEEP 49152:xIOJpIhAyfFoUMtrCub0WYxqn/XaRBRui4P11w9vCAxFxQY8Flj1sHB1e7:xdEytJ14TxjQYbHi7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mpclient.dll.exe

File Explorer

mpclient.dll.exe

.dll 2.6MB

mpclient.dll.exe

IMPHASH 5a29eaf155d6023c1563271c65acb070
SHA256 fa8d09a3d211aaefb69b1438a2b3bb45cb30b84162a02d7d291d8cbc9b56b508
MD5 6dc0abefffd9a3e27cb7f8ebedc2fd2c
SHA1 22d28687f52612ec57789383ac3abd74a6f1a7a5
SHA512 9392f18293941073b65b87517ec31b36a7a3668d62d9ab764b217d9651bc8972b5d640c1c42704034e384cb325fd0d9266a96163bec02c48b4db17e3c2472e88
SSDEEP 49152:xIOJpIhAyfFoUMtrCub0WYxqn/XaRBRui4P11w9vCAxFxQY8Flj1sHB1e7:xdEytJ14TxjQYbHi7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

444272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegEnumValueW

bcrypt

BCryptCreateHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptGenRandom

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader InterlockedFlushSList SetLastError GetLastError FreeConsole FormatMessageW CloseHandle GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses GetProcessId DuplicateHandle GetCurrentProcess CloseThreadpoolIo GetCommandLineW GetCurrentProcessId MultiByteToWideChar GetStdHandle RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentThread Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW WideCharToMultiByte GetCPInfo LocalAlloc GetConsoleOutputCP GetProcAddress LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CreateDirectoryW CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW ReadFile SetFileInformationByHandle SetThreadErrorMode GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx SetEvent CreateEventExW GetEnvironmentVariableW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime InitializeCriticalSectionEx ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead

ole32

CoTaskMemAlloc CoGetApartmentType CoTaskMemFree CoWaitForMultipleHandles CoInitializeEx CoUninitialize

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc calloc

api-ms-win-crt-math-l1-1-0

floor pow modf tan ceil sin cos

api-ms-win-crt-string-l1-1-0

wcsncmp strcpy_s _stricmp strcmp strncpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initterm _register_onexit_function _execute_onexit_table _configure_narrow_argv _crt_atexit abort _seh_filter_dll _initterm_e _cexit terminate _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __acrt_iob_func

AddArraycyReadAllLinesAsync AddToCleanupListVARFLAGFRESTRICTEDIsNegativeInfinity DESCKINDTYPECOMPOrderedNotEqualSignalinggetOperandType EverythingFILESEQUENTIALONLYEmitWriteLine FILESEQUENTIALONLYMultiplyBySelectedScalarWideningUpperAndSubtractWaitThreadNode GCALLOCFLAGSArgumentOutOfRangeSmallCapacitygetGenericParameterPosition IFormattableSingleToUInt32BitsGenericDelegateCache2 MaxPairwiseScalargetCompanyTryCode MpAccessibilityAsyncEvent MpAddDynamicSignatureFile MpAllocMemory MpAmsiCloseSession MpAmsiNotify MpAmsiScan MpAsrSetHipsUserExclusion MpAsrSetHipsUserExclusionEx MpChangeCapability MpCheckAccessForClipboardOperation MpCheckAccessForClipboardOperationEx MpCheckAccessForClipboardOperationEx2 MpCheckAccessForCopyFile MpCheckAccessForDragDropOperation MpCheckAccessForDragDropOperation2 MpCheckAccessForPrintOperation MpCheckAccessForPrintOperation2 MpCleanControl MpCleanOpen MpCleanPrecheckStart MpCleanStart MpClientUtilExportFunctions MpClientUtilExportFunctionsSize MpClose MpConfigClose MpConfigDelValue MpConfigGetValue MpConfigGetValueAlloc MpConfigInitialize MpConfigIteratorClose MpConfigIteratorEnum MpConfigIteratorEnumV2 MpConfigIteratorOpen MpConfigOpen MpConfigQueryProtection MpConfigRefresh MpConfigRegisterForNotifications MpConfigSetValue MpConfigUninitialize MpConfigUnregisterNotifications MpConveyDlpBypass MpConveySampleSubmissionResult MpConveyUserChoiceForDlpNotification MpConveyUserChoiceForDlpNotificationEx MpConveyUserChoiceForSampleList MpCreateComInstance MpDbgAllocMemory MpDebugExportFunctions MpDefenderIsPrintAccessCheckNeeded MpDefenderPrintAccessCheck MpDefenderPrintDataProvide MpDelegateCopyFile MpDelegateCopyFileAsync MpDeleteAsrHistory MpDetectionEnumerate MpDetectionQuery MpDeviceControlAuthenticateNetworkShare MpDeviceControlQueryInformation MpDeviceControlValidateDataDuplicationRemoteLocationConfiguration MpDlpCheckAccessForBuffer MpDlpDelegateEnforcement MpDlpDispatchAccessEvent MpDlpGetEvidenceFileUrl MpDlpGetOperationEnforcmentMode MpDlpInitializeEnforcementMode MpDlpNotifyCloseDocumentFile MpDlpNotifyPostOpenDocumentFile MpDlpNotifyPostSaveAsDocument MpDlpNotifyPostStartPrint MpDlpNotifyPreOpenDocumentFile MpDlpNotifyPrePrint MpDlpNotifyPreSaveAsDocument MpDlpScanLLM MpDlpServicePingRpc MpDynamicSignatureEnumerate MpDynamicSignatureOpen MpEffectiveConfigurationReport MpElevateCleanHandle MpElevationHandleAcquire MpElevationHandleActivate MpElevationHandleAttach MpElevationHandleOpen MpErrorMessageFormat MpFastMemoryScan MpFastMemoryScanOpen MpFlushLowfiCache MpForcedReboot MpFreeFileTrustExtraInfo MpFreeMemory MpFreeTSModeInfo MpFreeUpToDateInfo MpGenerateSignature MpGenerateSignatureEx MpGenerateThreatReport MpGetASRPerRuleExclusions MpGetAsrBlockedActionInfos MpGetAsrBlockedActions MpGetAsrBlockedProcesses MpGetCallistoDetections MpGetConfigPayloadStatus MpGetConfigValue MpGetCopyAcceleratorCancellableCopyStatus MpGetCopyAcceleratorProcessStatus MpGetDevMode MpGetDevVolumesProtectionState MpGetDeviceControlSecurityPolicies MpGetDeviceControlStatus MpGetDlpEvents MpGetEngineVersion MpGetFCValue MpGetHIPSRuleInfo MpGetMAPSConnectivityStatusInfo MpGetNpSupportFile MpGetRunningMode MpGetSACInfo MpGetSCCState MpGetSampleChunk MpGetSampleListRequiringConsent MpGetTDTFeatureStatus MpGetTDTFeatureStatusEx MpGetTPStateInfo MpGetTSModeInfo MpGetTaskSchedulerStrings MpGetThreatExecutionInfo MpGetUpToDateInfo MpGetUpdatePlatformStatus MpHandleClose MpImportConfigPayload MpIsDeviceControlAvailable MpIsGivenRunningModeSupported MpIsRtpAutoEnable MpManagerDisable MpManagerEnable MpManagerOpen MpManagerStatusQuery MpManagerStatusQueryEx MpManagerVersionQuery MpManagerXBGMDisable MpManagerXBGMEnable MpMemoryScanStart MpNetworkCapture MpNotificationRegister MpOfflineScanInstall MpOfflineScanStatusQuery MpOpen MpProductGenuineCheck MpQuarantineRequest MpQueryDefaultFolderGuardList MpQueryDevVolumeProtectionState MpQueryEngineConfigDword MpQueryFileTrustByHandle MpQueryFileTrustByHandle2 MpRemapCallistoDetections MpRemoveDynamicSignatureFile MpReportClipboardOwner MpRequestSnooze MpRollbackPlatform MpSampleQuery MpSampleSubmit MpScanControl MpScanResult MpScanStart MpScanStartEx MpSendBrowserHeartbeat MpServiceLogMessage MpSetBreakTheGlassStatus MpSetTPState MpSetUacElevationDefaultWindowHandle MpShowDlpDetailsDialog MpShutdownCopyAcceleratorProcess MpSmartLockerEnable MpTelemetryAddToAverageDWORD MpTelemetryAddToStreamDWORD MpTelemetryAddToStreamDWORD64 MpTelemetryAddToStreamString MpTelemetryIncrementDWORD MpTelemetryInitialize MpTelemetryIsOptIn MpTelemetryLiteralAddToAverageDWORD MpTelemetryLiteralAddToStreamDWORD MpTelemetryLiteralAddToStreamDWORD64 MpTelemetryLiteralAddToStreamString MpTelemetryLiteralIncrementDWORD MpTelemetryLiteralSetDWORD MpTelemetryLiteralSetDWORD64 MpTelemetryLiteralSetIfMaxDWORD MpTelemetryLiteralSetIfMinDWORD MpTelemetryLiteralSetString MpTelemetrySetConsent MpTelemetrySetDWORD MpTelemetrySetDWORD64 MpTelemetrySetIfMaxDWORD MpTelemetrySetIfMinDWORD MpTelemetrySetString MpTelemetryUninitialize MpTelemetryUpdateUserConsent MpTelemetryUpload MpThreatAction MpThreatEnumerate MpThreatHistoryRequest MpThreatLocalizedInfoQuery MpThreatOpen MpThreatQuery MpThreatRollup MpTriggerErrorHeartbeatReport MpTriggerHeartbeatOnUninstall MpTriggerStatusRefreshNotification MpUnblockEngine MpUnblockPlatform MpUnblockSignatures MpUpdateBrowserActiveTab MpUpdateControl MpUpdateDevMode MpUpdateEngine MpUpdatePlatform MpUpdateServicePingRpc MpUpdateStart MpUpdateStartEx MpUpdateTSMode MpUpdateTSModeEx MpUtilsExportFunctions MpWDEnable MpXBGMEnable MpXBGMFreeEvent MpXBGMGetData MpXBGMPutData MpXBGMUpdateIV MputAddToAverageDWORD64Rpc MputAddToAverageDWORDRpc MputIncrementDWORD64Rpc MputIncrementDWORDRpc MputSetBoolRpc MputSetDWORD64Rpc MputSetDWORDRpc MputSetIfMaxDWORD64Rpc MputSetIfMaxDWORDRpc MputSetIfMinDWORD64Rpc MputSetIfMinDWORDRpc MputSetStringRpc NormalizeDriveNamegetNormalMantissaMaskIsRealNumber OriginalStringCosIsPow2 SIGINTIsPinvokeImplChildren ShiftArithmeticSaturateScalarDISPPARAMSgetTask Ssse3GetReferenceszCSDVersioneFixedBuffer TryEnterReadLockBufferedStreamIFormatterConverter TwoObjectsHexInt64ReturnType WDEnable WDStatus WidenAsciiToUtf16HaveTimeLV getAbbreviatedMonthNamesTaskTTransitionToFinalAlreadyCompletedBeforeFieldInit getMinSupportedDateTimeIAsyncLocalValueMapTail

Name

.text

Size

454KB

Virtual Size

454KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.1MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

445KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mpclient.dll.exe

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

generic