procexp64[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

procexp64.exe
Size

1.4MB
MD5

29da4e6b4b4325651fd4e1a87d333b22
SHA1

d3dc46078a137f17c50887ff6f17be40dab20626
SHA256

77358157efbf4572c2d7f17a1a264990843307f802d20bad4fb2442245d65f0b
SHA512

12f3d75d8b0f2d32a06d8e52eef1364dd219ada8fcaeda997d68a792413744cb5d66b2cf7aabe6bf9e56f54f348680b8101ec04353842ef0b08887f6eb6b4b66
SSDEEP

24576:8Wd/PTCb6xqDtw5lx/HvYhNj0mHxURctb/r3G:ZJbASq6lFPYhVBHxuz

Score

N/A

Malware Config

Signatures

Files

procexp64.exe
.exe windows x64

290a32d240db413a1c805200d7a67944

Code Sign

33:00:00:01:e0:71:73:24:ca:5c:98:f8:19:00:00:00:00:01:e0
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-12-2020 21:31

Not After

02-12-2021 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:f1:61:86:0e:ca:71:03:c3:90:31:4e:5d:35:70:d9:62:a5:89:a3:01:b5:96:53:0d:eb:ad:a2:e4:73:e3:b1
Signer

Actual PE Digest

1b:f1:61:86:0e:ca:71:03:c3:90:31:4e:5d:35:70:d9:62:a5:89:a3:01:b5:96:53:0d:eb:ad:a2:e4:73:e3:b1

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

09-09-2022 13:02
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

SHAutoComplete
ColorHLSToRGB
ColorRGBToHLS
StrStrIW
ord176
StrCmpIW
UrlUnescapeW

iphlpapi

GetExtendedTcpTable
GetExtendedUdpTable

ws2_32

getservbyport
WSAStartup
gethostbyaddr
htonl
ntohs
ntohl
htons

mpr

WNetGetConnectionW

comctl32

ImageList_ReplaceIcon
ImageList_Add
InitCommonControlsEx
ImageList_Destroy
ImageList_DrawEx
ord17
PropertySheetW
ImageList_Create
CreateStatusWindowW
ord413
ImageList_GetIcon
ord410
CreatePropertySheetPageW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

credui

CredUIPromptForCredentialsW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

crypt32

CertDuplicateCertificateContext
CertGetNameStringW

aclui

ord1

powrprof

IsPwrHibernateAllowed
IsPwrSuspendAllowed
SetSuspendState

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSSendMessageW
WTSDisconnectSession
WTSLogoffSession
WTSFreeMemory

uxtheme

EnableThemeDialogTexture

ntdll

NtQueryInformationProcess
NtQueryMutant
NtQueryEvent
NtQuerySemaphore
NtQuerySymbolicLinkObject
NtQueryObject
NtOpenSymbolicLinkObject
NtQuerySystemInformation
NtSetInformationProcess
NtLoadDriver
NtCreateKey
NtOpenKey
RtlVirtualUnwind
RtlUnwindEx
NtQuerySection
NtResumeThread
NtSuspendProcess
RtlLookupFunctionEntry
NtOpenThread
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
RtlCaptureContext
NtQueryInformationThread
NtSuspendThread
NtResumeProcess
RtlPcToFileHeader
RtlUnwind

gdi32

RectInRegion
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetTextColor
GetStockObject
Polyline
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
CreateFontIndirectW
GetTextExtentPoint32W
SetTextAlign
ExtTextOutW
GetTextExtentExPointW
LineTo
Rectangle
RestoreDC
SaveDC
SetROP2
MoveToEx
CreateBitmap
GetDeviceCaps
GetBkMode
GetBkColor
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
GetObjectW
CreateDIBSection
GetTextMetricsW

comdlg32

GetSaveFileNameW
ChooseFontW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError
ChooseColorW
FindTextW

kernel32

GetLastError
SetErrorMode
InitializeCriticalSection
Sleep
GetCurrentProcess
ExitThread
TlsAlloc
TlsSetValue
CreateProcessW
OpenProcess
GetVersion
GetSystemWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
IsWow64Process
GetSystemWow64DirectoryW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageA
lstrlenW
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstFileW
GetFileAttributesW
GetPrivateProfileStringW
FreeLibrary
LoadLibraryExW
ReadFile
InitializeSListHead
MultiByteToWideChar
FindClose
FindNextFileW
LeaveCriticalSection
EnterCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateThread
GetExitCodeThread
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
SetLastError
GetVersionExW
GetFileSizeEx
LoadLibraryW
GetTickCount
MulDiv
GlobalAddAtomW
FormatMessageW
GetCommandLineW
GetFileType
LocalAlloc
TerminateThread
GlobalAlloc
GlobalReAlloc
GlobalUnlock
WriteFile
Module32FirstW
Module32NextW
DeleteCriticalSection
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
IsBadStringPtrW
OpenEventW
GetEnvironmentVariableW
ReadProcessMemory
lstrcmpiW
SearchPathW
SetFilePointer
GetCurrentProcessId
GetSystemDirectoryW
VirtualQueryEx
OpenThread
SuspendThread
ResumeThread
GetThreadContext
Thread32First
Thread32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
IsBadReadPtr
DeleteFileW
TerminateProcess
SetPriorityClass
ProcessIdToSessionId
GetProcessId
GlobalMemoryStatusEx
GetLogicalProcessorInformation
GlobalFree
SetProcessWorkingSetSize
PulseEvent
GetComputerNameW
WTSGetActiveConsoleSessionId
GetCurrentDirectoryW
GetDriveTypeW
OutputDebugStringW
DuplicateHandle
DeviceIoControl
VirtualAlloc
VirtualFree
IsProcessInJob
CreateJobObjectW
QueryInformationJobObject
GetThreadGroupAffinity
SetThreadGroupAffinity
GlobalMemoryStatus
GetProcessAffinityMask
SetProcessAffinityMask
GetProcessWorkingSetSize
GetActiveProcessorGroupCount
GetActiveProcessorCount
WideCharToMultiByte
K32GetModuleFileNameExW
K32QueryWorkingSet
K32GetMappedFileNameW
DecodePointer
RaiseException
InitializeCriticalSectionEx
GetNativeSystemInfo
ExpandEnvironmentStringsA
LoadLibraryExA
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
TlsFree
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetConsoleCP
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
GetLongPathNameW
GetFullPathNameW
GetFileTime
GetFileSize
FileTimeToLocalFileTime
CreateFileW
ExpandEnvironmentStringsW
GetTimeZoneInformation
SetEnvironmentVariableW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetStdHandle
TlsGetValue
EncodePointer
LCMapStringEx
GetCPInfo
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetEndOfFile
WriteConsoleW
CloseHandle
GlobalLock
GetStartupInfoW
GetCurrentThreadId
GetStringTypeW

user32

EndMenu
RedrawWindow
WindowFromPoint
CheckMenuRadioItem
DrawIconEx
IsDialogMessageW
LockWorkStation
IsHungAppWindow
PeekMessageW
SendMessageTimeoutW
CheckRadioButton
GetDlgCtrlID
MsgWaitForMultipleObjects
GetDesktopWindow
GetWindow
GetGuiResources
LoadBitmapW
CopyImage
GetMenuInfo
TrackPopupMenu
RemoveMenu
CreateMenu
DrawMenuBar
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowEnabled
GetDlgItemTextW
CreateDialogParamW
SetLayeredWindowAttributes
IsWindow
PostQuitMessage
ExitWindowsEx
DispatchMessageW
TranslateMessage
GetMessageW
DrawEdge
RegisterWindowMessageW
EndTask
GetWindowDC
SetMenuItemInfoW
IsIconic
ShowWindowAsync
KillTimer
GetMonitorInfoW
MonitorFromPoint
EnumWindows
SetClassLongW
ClientToScreen
GetWindowTextW
InvalidateRgn
TrackPopupMenuEx
ModifyMenuW
AppendMenuW
GetMenuItemCount
GetMenuItemID
EnableMenuItem
CreatePopupMenu
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetWindowPlacement
LoadIconW
SetWindowPlacement
DefMDIChildProcW
DefFrameProcW
DefDlgProcW
CreateIconIndirect
FrameRect
IsWindowVisible
DestroyWindow
GetClassNameW
EnumChildWindows
SetWindowLongW
GetWindowLongW
PtInRect
UnionRect
CopyRect
ScreenToClient
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsZoomed
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DrawFrameControl
ChildWindowFromPoint
DialogBoxParamW
MoveWindow
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetScrollInfo
SetScrollInfo
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
OffsetRect
IntersectRect
InflateRect
FillRect
GetSysColorBrush
GetSysColor
MapWindowPoints
GetCursorPos
GetWindowRect
GetClientRect
GetPropW
SetPropW
ScrollWindowEx
ValidateRect
InvalidateRect
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
UpdateWindow
DrawTextW
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetFocus
SetWindowPos
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetParent
SetDlgItemTextW
PostMessageW
LoadStringW
ReleaseDC
GetDC
EnumDisplaySettingsW
LoadImageW
DestroyIcon
LoadCursorW
GetWindowThreadProcessId
FindWindowExW
FindWindowW
SetCursor
MessageBoxW
SetForegroundWindow
DeleteMenu
InsertMenuW
GetSubMenu
CheckMenuItem
GetMenu
GetSystemMetrics
SetFocus
ShowWindow
WaitForInputIdle
SetMenuInfo
SendMessageW

advapi32

OpenProcessToken
AdjustTokenPrivileges
AllocateAndInitializeSid
DuplicateTokenEx
EqualSid
GetLengthSid
QueryServiceConfigW
AddAccessAllowedAce
AddAce
FreeSid
GetTokenInformation
ImpersonateLoggedOnUser
CreateRestrictedToken
GetAce
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
RevertToSelf
LookupAccountSidW
InitializeAcl
IsValidSid
SetTokenInformation
GetSecurityInfo
SetSecurityInfo
LsaFreeMemory
RegCloseKey
LsaOpenPolicy
LsaEnumerateAccountRights
ConvertSidToStringSidW
FlushTraceW
RegConnectRegistryW
CreateProcessAsUserW
GetKernelObjectSecurity
SetKernelObjectSecurity
LookupPrivilegeNameW
EnumServicesStatusExW
RegQueryValueExA
RegOpenKeyExA
ProcessTrace
LookupAccountNameW
LookupPrivilegeValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
OpenTraceW
ControlTraceW
StartTraceW
SetServiceObjectSecurity
QueryServiceObjectSecurity
MapGenericMask
RegCreateKeyW
LsaClose
CloseTrace
StartServiceW
QueryServiceStatus
RegEnumValueW
RegLoadKeyW
RegOpenKeyW
ControlService
QueryServiceConfig2W
OpenServiceW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
RegDeleteValueW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueW
RegUnLoadKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
CopySid

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
ShellExecuteW
SHGetMalloc
Shell_NotifyIconW
ShellExecuteExW
SHGetFolderPathW
SHGetFileInfoW

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoSetProxyBlanket
CoInitialize
CoMarshalInterThreadInterfaceInStream

oleaut32

SysAllocStringLen
VariantCopy
SafeArrayGetElement
SafeArrayUnaccessData
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantInit
VariantClear
VariantChangeType
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData

winhttp

WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl

Sections

.text
Size: 915KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

290a32d240db413a1c805200d7a67944

Code Sign

33:00:00:01:e0:71:73:24:ca:5c:98:f8:19:00:00:00:00:01:e0Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

1b:f1:61:86:0e:ca:71:03:c3:90:31:4e:5d:35:70:d9:62:a5:89:a3:01:b5:96:53:0d:eb:ad:a2:e4:73:e3:b1Signer

Signature Validations

Verification

09-09-2022 13:02 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

iphlpapi

ws2_32

mpr

comctl32

version

credui

setupapi

crypt32

aclui

powrprof

wtsapi32

uxtheme

ntdll

gdi32

comdlg32

kernel32

user32

advapi32

shell32

ole32

oleaut32

winhttp

Sections

.text Size: 915KB - Virtual size: 915KB

.rdata Size: 262KB - Virtual size: 261KB

.data Size: 41KB - Virtual size: 184KB

.pdata Size: 31KB - Virtual size: 31KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 208KB - Virtual size: 208KB

.reloc Size: 5KB - Virtual size: 4KB

33:00:00:01:e0:71:73:24:ca:5c:98:f8:19:00:00:00:00:01:e0
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

1b:f1:61:86:0e:ca:71:03:c3:90:31:4e:5d:35:70:d9:62:a5:89:a3:01:b5:96:53:0d:eb:ad:a2:e4:73:e3:b1
Signer

09-09-2022 13:02
Valid: false

.text
Size: 915KB - Virtual size: 915KB

.rdata
Size: 262KB - Virtual size: 261KB

.data
Size: 41KB - Virtual size: 184KB

.pdata
Size: 31KB - Virtual size: 31KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 208KB - Virtual size: 208KB

.reloc
Size: 5KB - Virtual size: 4KB