BstkRooter[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BstkRooter.exe
Size 3.1MB
Sample260511-lktx8aet2s
SHA256 cb8718999aa96c134a9f7cf0af3b633a8f8c32344b724fa3a5a2dbec3c50d187
MD5 5378a4184093c525c816b1c6c24bb371
SHA1 809a0a3a29601fe200251531643ed53a84ff6bb8
SHA512 0a08beb64af892d3cceb86f5f1e885d6ce7669fa830ad1f24931a7e4bf870d5ae33004bc3e7436ff137ec62bcbb459d64b8c479dc56251b102c13d9d85c0311e
SSDEEP 49152:rNCs+QHeE1j7CwGhnB9b1043JDw0X5xzWWfpa3IWhHQTc3MUViy:8qegC04/X5tWWfpaPQTc8U
TLSH
T1D5E5D0095EB4098EF436843AEC990649C67D3C94E3E449DF8747F25EBBDA8B402B7364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BstkRooter.exe

File Explorer

BstkRooter.exe

.exe 3.1MB

BstkRooter.exe

IMPHASH 3c49e430c565a0b16f26dbf97b7ea6ac
SHA256 cb8718999aa96c134a9f7cf0af3b633a8f8c32344b724fa3a5a2dbec3c50d187
MD5 5378a4184093c525c816b1c6c24bb371
SHA1 809a0a3a29601fe200251531643ed53a84ff6bb8
SHA512 0a08beb64af892d3cceb86f5f1e885d6ce7669fa830ad1f24931a7e4bf870d5ae33004bc3e7436ff137ec62bcbb459d64b8c479dc56251b102c13d9d85c0311e
SSDEEP 49152:rNCs+QHeE1j7CwGhnB9b1043JDw0X5xzWWfpa3IWhHQTc3MUViy:8qegC04/X5tWWfpaPQTc8U
TLSH
T1D5E5D0095EB4098EF436843AEC990649C67D3C94E3E449DF8747F25EBBDA8B402B7364
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

696804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

G:\Git\bstk_re\BSTKRooter\build\BstkRooter.pdb

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

ShellExecuteW

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

msvcp140

?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z _Strcoll _Strxfrm ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

virtdisk

AttachVirtualDisk OpenVirtualDisk DetachVirtualDisk GetVirtualDiskPhysicalPath

user32

MonitorFromWindow LoadCursorA SetWindowLongPtrA SetWindowLongW SetWindowLongA GetWindowLongW WindowFromPoint ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetPropA SetPropA ReleaseDC GetDC SetForegroundWindow GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState SetFocus BringWindowToTop GetMonitorInfoA SetWindowPos SetLayeredWindowAttributes IsChild GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard PostMessageA MonitorFromPoint LoadIconA ScreenToClient UpdateWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageA DispatchMessageA TranslateMessage EnumDisplayMonitors IsIconic SetProcessDPIAware GetClientRect

kernel32

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx CopyFileW GetModuleHandleW AreFileApisANSI SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose IsDebuggerPresent GetLocaleInfoEx FormatMessageA LocalFree IsDBCSLeadByte GetLocaleInfoA LoadLibraryA GetProcAddress FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc OutputDebugStringA DeviceIoControl GetLastError WriteFile SetFilePointerEx SetFilePointer ReadFile IsProcessorFeaturePresent FlushFileBuffers CreateFileW CreateFileA Process32Next Process32First CreateToolhelp32Snapshot OpenProcess TerminateProcess CloseHandle GetTempPathA FindResourceA SizeofResource LockResource LoadResource GetModuleHandleA Sleep GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileSizeEx

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

gdi32

GetDeviceCaps

d3dcompiler_47

D3DCompile

vcruntime140

__std_exception_destroy __current_exception_context __current_exception __C_specific_handler memmove memcmp memchr _CxxThrowException __std_exception_copy strchr __std_terminate memset memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _get_initial_narrow_environment _set_app_type _seh_filter_exe abort _initterm _wassert _initialize_narrow_environment _initterm_e _crt_atexit _register_onexit_function exit _initialize_onexit_table _invoke_watson _exit __p___argc _register_thread_local_exe_atexit_callback __p___argv _cexit _c_exit terminate

api-ms-win-crt-string-l1-1-0

strcmp strcpy _stricmp strncmp tolower strncpy wcslen strlen

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func fopen fread _wfopen __stdio_common_vfprintf __stdio_common_vsprintf __p__commode setvbuf fwrite _fseeki64 fsetpos fputc fgetpos fflush _get_stream_buffer_pointers fclose feof ferror _set_fmode fgetc ungetc ftell fseek __stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

_set_new_mode free calloc _callnewh realloc malloc

api-ms-win-crt-math-l1-1-0

fmodf cosf ceilf acosf sinf ldexp pow sqrtf __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale