Static task
static1
Behavioral task
behavioral1
Sample
CONHOST.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
CONHOST.exe
Resource
win10v2004-20230703-en
General
-
Target
CONHOST.EXE
-
Size
26KB
-
MD5
f8aae13d7ab5bf4cffa7782d2e72c40a
-
SHA1
c4205619e236eefb60ddbc0157b9bf6bf4301ef7
-
SHA256
0dba4ae0e70438be2e61de3aa90147b489dd87912930fde95e6255e83efbc4c8
-
SHA512
cd39248a4cf33d1010469f50d6a3e97af33a7809333ab316781378ebb5b504922a390ded4658fd3f4183cbde072b108beba98b4116476f9c28db17a1ce241857
-
SSDEEP
384:62AeSOCguz8sfE4XslZzN5hbFJ5K6gUf6mgKWjwtdeKpuZPFa3mWVPymW49TUS+:VCJD8lZZ5hbFJILcve34EpF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CONHOST.EXE
Files
-
CONHOST.EXE.exe windows x86
da2666d3347f129193ab91a0eab85c0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
DbgPrint
RtlInitUnicodeString
NtOpenKey
NtClose
api-ms-win-core-localregistry-l1-1-0
RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-processthreads-l1-1-0
SetThreadPriority
GetCurrentThread
CreateThread
GetCurrentProcess
CreateProcessW
OpenProcessToken
user32
CharNextW
GetKeyboardLayout
GetSystemMetrics
ExitWindowsEx
MessageBoxW
LoadStringW
LoadRemoteFonts
DefWindowProcW
RegisterClassExW
DestroyWindow
CreateWindowExW
SystemParametersInfoW
userenv
ord175
msvcrt
_ismbblead
_XcptFilter
_exit
_cexit
exit
_wcsicmp
memset
memmove
_vsnwprintf
_initterm
_acmdln
_amsg_exit
__setusermatherr
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__getmainargs
__p__commode
kernel32
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedExchange
LoadLibraryA
RegOpenKeyExA
RegQueryValueExA
ExpandEnvironmentStringsA
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
HeapSetInformation
SetCurrentDirectoryW
FormatMessageW
GetFileAttributesExW
GetSystemDirectoryW
SetLastError
ExpandEnvironmentStringsW
GetUserDefaultLangID
SetEvent
OpenEventW
Sleep
WaitForSingleObject
CloseHandle
GetLastError
SetEnvironmentVariableW
SearchPathW
GetCurrentThreadId
CompareFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetEnvironmentVariableW
LocalAlloc
LocalFree
GetVersionExW
lstrlenW
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE