CompatTelRunner[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CompatTelRunner.exe
Size

181KB
MD5

5a0ebb5218acff2f102c2051326aa9f7
SHA1

92be78f815897d905538b36fbf015af29616cc49
SHA256

7dcd092a0fa5cd23c50214e8fb6c0c267ed3f8f1bf0ee8881a2f18d7b356fe72
SHA512

d8d66dc17126d3ef36edabb18adde6810de8fa4c168a5d5583aed226ff3b9f0f869159f583698351ab3d96db6d6f03f0beee01837506319f4fa0d17ddec015b8
SSDEEP

3072:Xe62NvIQU3K5QEJlhKhJ0kcxqmqLXUs73Z+DFDG59UkhiFukahJai8wZ:Xeca5QUhKhJ0kcxqLLXU+ZzYkSukD2

Score

1^/10

Malware Config

Signatures

Files

CompatTelRunner.exe
.exe windows:10 windows x64 arch:x64

Password: thanks

0de309ada60684eef12ed8335ccff28b

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:9a:1c:b9:1b:f5:75:f9:7b:56:45:fa:0b:95:12:82:9d:62:0c:ea:81:c6:61:a7:f1:f4:57:0d:44:bd:20:90
Signer

Actual PE Digest

eb:9a:1c:b9:1b:f5:75:f9:7b:56:45:fa:0b:95:12:82:9d:62:0c:ea:81:c6:61:a7:f1:f4:57:0d:44:bd:20:90

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

strncpy_s
strtol
_set_errno
malloc
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove
_errno
wcsstr
_wcslwr
wcscat_s
_wcsnicmp
strcpy_s
_callnewh
memcmp
??1type_info@@UEAA@XZ
wcsrchr
wcscpy_s
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
wcsncmp
_exit
__CxxFrameHandler3
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
sprintf_s
strchr
_vsnprintf
_stricmp
_wcsicmp
memmove_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
wcschr
memset

ntdll

RtlReleaseRelativeName
NtLoadKeyEx
RtlDosPathNameToRelativeNtPathName_U
RtlStringFromGUID
RtlRandomEx
RtlFreeSid
RtlAllocateAndInitializeSid
RtlNtStatusToDosError
RtlAdjustPrivilege
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
EtwEventRegister
EtwEventWrite
EtwEventUnregister
NtQueryLicenseValue
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
ZwQueryValueKey
RtlInitUnicodeStringEx
ZwEnumerateKey
ZwOpenKey
RtlFreeUnicodeString
RtlInitUnicodeString
ZwClose
RtlLeaveCriticalSection
RtlFreeHeap
RtlInitializeCriticalSection
RtlMultiByteToUnicodeN
RtlInitAnsiString
RtlEnterCriticalSection
RtlReAllocateHeap
RtlEqualString
RtlAllocateHeap
RtlDeleteCriticalSection
WinSqmIsOptedInEx
NtCreateEvent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask

oleaut32

SysAllocString
SysFreeString
SysStringLen

rpcrt4

UuidCreate

ws2_32

WSAStartup
getaddrinfo
freeaddrinfo
WSACleanup
WSAGetLastError
gethostname

kernel32

CreateSemaphoreW
OpenWaitableTimerW
WaitForMultipleObjects
CreateWaitableTimerW
SetWaitableTimer
GetTickCount
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
GetSystemPowerStatus
Sleep
SetPriorityClass
LoadLibraryExW
VerifyVersionInfoW
FreeLibrary
GetCurrentProcess
QueryProcessCycleTime
LoadLibraryA
GetSystemDirectoryA
lstrcmpA
IsDebuggerPresent
DebugBreak
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
GetProcAddress
HeapAlloc
CreateThreadpoolTimer
SetThreadpoolTimer
SetEvent
SystemTimeToFileTime
CreateProcessW
GetExitCodeProcess
GetTickCount64
CreateEventW
ExpandEnvironmentStringsW
MoveFileExW
GetCommandLineW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetFileSizeEx
LoadLibraryW
OutputDebugStringA
GetSystemWindowsDirectoryW
GetFileAttributesW
LocalFree
SetUnhandledExceptionFilter
ReleaseSRWLockShared
GetModuleHandleExA
CreateFileW
GetModuleFileNameW
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
LeaveCriticalSection
InitializeCriticalSectionEx
WriteFile

advapi32

SetEntriesInAclW
EventWriteTransfer
EventRegister
EventUnregister
SetSecurityDescriptorDacl
RegSetKeySecurity
RegDeleteKeyValueW
RegQueryInfoKeyW
RegSaveKeyExW
RegDeleteKeyExW
RegLoadAppKeyW
StartServiceW
QueryServiceStatusEx
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegLoadKeyW
RegUnLoadKeyW
SetSecurityDescriptorOwner
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteTreeW
RegEnumValueW
RegGetValueW
RegCloseKey
RegSetKeyValueW
RegEnumKeyExW
RegOpenKeyExW
InitializeSecurityDescriptor

shlwapi

StrCmpNA
PathFindFileNameW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

Sections

.text
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: thanks

0de309ada60684eef12ed8335ccff28b

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

eb:9a:1c:b9:1b:f5:75:f9:7b:56:45:fa:0b:95:12:82:9d:62:0c:ea:81:c6:61:a7:f1:f4:57:0d:44:bd:20:90Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

oleaut32

rpcrt4

ws2_32

kernel32

advapi32

shlwapi

ole32

Sections

.text Size: 108KB - Virtual size: 104KB

.rdata Size: 44KB - Virtual size: 42KB

.data Size: 4KB - Virtual size: 4KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 592B

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

eb:9a:1c:b9:1b:f5:75:f9:7b:56:45:fa:0b:95:12:82:9d:62:0c:ea:81:c6:61:a7:f1:f4:57:0d:44:bd:20:90
Signer

.text
Size: 108KB - Virtual size: 104KB

.rdata
Size: 44KB - Virtual size: 42KB

.data
Size: 4KB - Virtual size: 4KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 592B