conhost[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
conhost.exe
Size 847KB
Sample230517-axy7xsdb67
SHA256 a26a1ffb81a61281ffa55cb7778cc3fb0ff981704de49f75f51f18b283fba7a2
MD5 17a7131db3e37157c6d3c09a0bae95d3
SHA1 edd3f649f5f0556d2edc8b19265adb6b93465721
SHA512 cb225a3cea0b8e00b6c6ebc91366cc5fe47264660b097073127ec6a61fe026b72421982b8f7f536815cfd3b592162c39580b649b19b0cb971c04fe2fd3005d7b
SSDEEP 12288:CEA9haaJkvmZOxGVG7/55aJhDXAfZGzq1OtURAOQJIkR:zA9harvSOxV7xMD2Mq1O8AjJIU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
conhost.exe

File Explorer

conhost.exe

.exe 847KB

conhost.exe

IMPHASH c21b297aeb85cef1bcce8d72106bbdd0
SHA256 a26a1ffb81a61281ffa55cb7778cc3fb0ff981704de49f75f51f18b283fba7a2
MD5 17a7131db3e37157c6d3c09a0bae95d3
SHA1 edd3f649f5f0556d2edc8b19265adb6b93465721
SHA512 cb225a3cea0b8e00b6c6ebc91366cc5fe47264660b097073127ec6a61fe026b72421982b8f7f536815cfd3b592162c39580b649b19b0cb971c04fe2fd3005d7b
SSDEEP 12288:CEA9haaJkvmZOxGVG7/55aJhDXAfZGzq1OtURAOQJIkR:zA9harvSOxV7xMD2Mq1O8AjJIU
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

128896

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcp_win

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?good@ios_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ ?flags@ios_base@std@@QEBAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Xlength_error@std@@YAXPEBD@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?setf@ios_base@std@@QEAAHHH@Z ?setf@ios_base@std@@QEAAHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Xout_of_range@std@@YAXPEBD@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z _Mtx_destroy_in_situ _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z _Mtx_lock _Mtx_init_in_situ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-private-l1-1-0

_o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__itoa_s _o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode memmove _o__wcsicmp _o__wcsnicmp _o_calloc _o_exit _o_floor _o_free _o_iswdigit _o_iswspace _o_malloc _o_roundf _o_sqrt _o_terminate _o_towlower _o_towupper _o_wcscpy_s _o_wcstol _o_wcstoul __C_specific_handler __CxxFrameHandler3 _CxxThrowException _o__cexit _o__callnewh _o__exit _o__errno _o___stdio_common_vswprintf_s _o___stdio_common_vswprintf _o___stdio_common_vsprintf_s _o___stdio_common_vsprintf _o___stdio_common_vsnwprintf_s _o___stdio_common_vsnprintf_s _o___std_exception_destroy _o___std_exception_copy _o__crt_atexit _o___p__commode _o__configure_wide_argv __std_terminate __CxxFrameHandler4 _o__configthreadlocale memcmp memcpy wcschr

api-ms-win-crt-string-l1-1-0

wcsncmp wcscmp memset wcsnlen

api-ms-win-core-libraryloader-l1-2-0

LoadResource FreeLibrary GetModuleFileNameW LockResource GetModuleHandleExW LoadLibraryExW FindResourceExW GetModuleHandleW GetProcAddress GetModuleFileNameA LoadStringW

api-ms-win-core-synch-l1-1-0

CreateEventW InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx ResetEvent ReleaseMutex SetEvent WaitForSingleObject CreateSemaphoreExW ReleaseSemaphore CreateEventExW ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapFree HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId UpdateProcThreadAttribute GetCurrentThread DeleteProcThreadAttributeList CreateProcessW GetProcessTimes GetStartupInfoW GetCurrentThreadId GetCurrentProcess OpenProcessToken SetProcessShutdownParameters ExitThread TerminateProcess CreateThread InitializeProcThreadAttributeList

api-ms-win-core-localization-l1-2-0

FormatMessageW GetACP GetOEMCP GetCPInfo IsValidCodePage GetUserDefaultLocaleName

api-ms-win-core-debug-l1-1-0

DebugBreak IsDebuggerPresent OutputDebugStringW OutputDebugStringA

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer CreateTimerQueueTimer DeleteTimerQueueEx CreateTimerQueue

api-ms-win-core-file-l1-1-0

WriteFile ReadFile

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW SearchPathW GetStdHandle SetEnvironmentVariableW

api-ms-win-core-registry-l1-1-0

RegGetValueW RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryValueExW RegOpenCurrentUser

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte GetStringTypeW CompareStringOrdinal

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetWindowsDirectoryW GetSystemDirectoryW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer EventActivityIdControl EventSetInformation EventRegister EventUnregister

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW PathFindFileNameW PathIsSameRootW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-heap-l2-1-0

GlobalAlloc GlobalFree LocalFree

ntdll

RtlFreeHeap RtlAllocateHeap RtlQueryPackageClaims NtQueryVolumeInformationFile CsrClientCallServer NtAlpcSendWaitReceivePort NtAlpcQueryInformationMessage AlpcGetMessageAttribute AlpcInitializeMessageAttribute RtlCreateUnicodeString NtAlpcConnectPort

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-registry-l2-1-0

RegCreateKeyW RegOpenKeyW

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait Sleep

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-com-l1-1-0

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize GlobalLock GlobalUnlock

api-ms-win-core-io-l1-1-1

CancelSynchronousIo

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-base-l1-1-0

GetSidSubAuthority GetTokenInformation GetSidSubAuthorityCount

api-ms-win-core-path-l1-1-0

PathCchRemoveExtension

api-ms-win-shell-shellcom-l1-1-0

SHCoCreateInstance

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-crt-math-l1-1-0

ceilf

Name

.text

Size

618KB

Virtual Size

617KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ