CompatTelRunner[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CompatTelRunner.exe
Size

156KB
MD5

47dd94d79d9bac54a2c3a1cf502770c6
SHA1

134fd2ad04cf59b0c10596230da5daf6fc711bd1
SHA256

046f009960f70981597cd7b3a1e44cbb4ba5893cc1407734366aa55fbeda5d66
SHA512

ba01d3bd0e308ddd29f0eade9ebd5b6080bf011acccb2fa0d96f70390d8b9f5684878377a13c2594bf330b783d767a2e6e9fcbd635c3ef80415583325ec85253
SSDEEP

3072:0CsRfrsh8fzKuxGuNWR/Kz/2+qrDG69UkbbiVwD6twJ2HOtOe:RWfIh2zKuxGuNW6/2otkPD66jb

Score

1^/10

Malware Config

Signatures

Files

CompatTelRunner.exe
.exe windows x64

073d2008cd517daa64fe601ce086a682

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

89:57:1e:bd:f2:85:be:70:f9:e9:53:da:6d:b0:e0:15:5e:67:9a:50:69:8e:88:46:d0:35:f4:63:64:35:b4:61
Signer

Actual PE Digest

89:57:1e:bd:f2:85:be:70:f9:e9:53:da:6d:b0:e0:15:5e:67:9a:50:69:8e:88:46:d0:35:f4:63:64:35:b4:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

strtol
_set_errno
??1exception@@UEAA@XZ
_errno
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
wcsrchr
wcscpy_s
_vsnwprintf
malloc
_callnewh
_purecall
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
??1type_info@@UEAA@XZ
strncpy_s
wcsstr
_wcslwr
wcscat_s
_wcsnicmp
strcpy_s
wcsncmp
memcmp
_onexit
__dllonexit
wcschr
_unlock
_lock
?terminate@@YAXXZ
??3@YAXPEAX@Z
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
memcpy_s
sprintf_s
strchr
_vsnprintf
_stricmp
_wcsicmp
__CxxFrameHandler3
memset

ntdll

RtlReleaseRelativeName
NtLoadKeyEx
RtlDosPathNameToRelativeNtPathName_U
RtlStringFromGUID
RtlRandomEx
RtlFreeSid
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlAdjustPrivilege
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
EtwEventRegister
EtwEventWrite
EtwEventUnregister
NtQueryLicenseValue
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwQueryValueKey
RtlInitUnicodeStringEx
ZwEnumerateKey
ZwOpenKey
RtlFreeUnicodeString
RtlInitUnicodeString
ZwClose
RtlLeaveCriticalSection
RtlFreeHeap
RtlInitializeCriticalSection
RtlMultiByteToUnicodeN
RtlInitAnsiString
RtlEnterCriticalSection
RtlReAllocateHeap
RtlEqualString
RtlAllocateHeap
RtlDeleteCriticalSection
WinSqmIsOptedInEx
NtCreateEvent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask

oleaut32

SysFreeString
SysStringLen
SysAllocString

rpcrt4

UuidCreate

ws2_32

gethostname
WSAGetLastError
WSACleanup
getaddrinfo
freeaddrinfo
WSAStartup

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetSystemDirectoryA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW

api-ms-win-core-realtime-l1-1-0

QueryProcessCycleTime

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
TerminateProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
SetPriorityClass
GetExitCodeProcess

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegDeleteKeyExW
RegQueryInfoKeyW
RegSaveKeyExW
RegDeleteTreeW
RegEnumValueW
RegSetValueExW
RegLoadAppKeyW
RegUnLoadKeyW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegSetKeySecurity
RegLoadKeyW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-synch-l1-1-0

SetEvent
OpenWaitableTimerW
CreateEventW
CreateSemaphoreExW
LeaveCriticalSection
WaitForSingleObject
ReleaseSemaphore
EnterCriticalSection
SetWaitableTimer
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseMutex
CreateMutexExW
WaitForSingleObjectEx
OpenSemaphoreW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoUninitialize

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
ExpandEnvironmentStringsW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-service-management-l1-1-0

OpenServiceW
StartServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-file-l1-1-0

WriteFile
CreateFileW
FindClose
FindFirstFileW
DeleteFileW
GetFileSizeEx
GetFileAttributesW
FindNextFileW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-security-base-l1-1-0

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNA

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects
CreateWaitableTimerW

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

073d2008cd517daa64fe601ce086a682

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

89:57:1e:bd:f2:85:be:70:f9:e9:53:da:6d:b0:e0:15:5e:67:9a:50:69:8e:88:46:d0:35:f4:63:64:35:b4:61Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

oleaut32

rpcrt4

ws2_32

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-1

Sections

.text Size: 88KB - Virtual size: 86KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 568B

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

89:57:1e:bd:f2:85:be:70:f9:e9:53:da:6d:b0:e0:15:5e:67:9a:50:69:8e:88:46:d0:35:f4:63:64:35:b4:61
Signer

.text
Size: 88KB - Virtual size: 86KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 568B