Behavioral task
behavioral1
Sample
taskhost.exe
Resource
win11-20240508-en
General
-
Target
taskhost.exe
-
Size
5.5MB
-
MD5
bde189d41dc7594fb6ab5e3fee659b0e
-
SHA1
fa8739b6734f4bca949c94242e922aba730bac88
-
SHA256
703b57adaf02eef74097e5de9d0bbd06fc2c29ea7f92c90d54a0b9a01172babe
-
SHA512
a321cd45efe2a430f88c488ef4af47ae5401cdbeef162c04449126ae2e9da0493613dffcbfcb70d5fc002b53d3a6494cd4851026e7d1393f5e8409c8a878bd8a
-
SSDEEP
98304:7fbLE4V2tQPSKfoYFifteQfPhrLmhVwZyk0KtlTe7lL8PK46JL:7zL3VgBAogi1eAP1mhVwZy5II7F8yJL
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
taskhost.exe.exe windows:6 windows x86 arch:x86
ddf8b4571b47fb86c47a80fc2d078686
Code Sign
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29/01/1996, 00:00Not After01/08/2028, 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21/05/2009, 00:00Not After20/05/2019, 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
2f:63:04:0f:94:b3:30:a5:3b:38:b5:ea:6d:a2:36:1cCertificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before18/09/2009, 00:00Not After14/03/2010, 23:59SubjectCN=Andrea Electronics,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Andrea Digital,O=Andrea Electronics,L=MELVILLE,ST=New York,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
93:ee:22:7b:c6:ea:9e:99:bb:2c:fb:5d:2f:48:94:69:7b:e9:3f:60Signer
Actual PE Digest93:ee:22:7b:c6:ea:9e:99:bb:2c:fb:5d:2f:48:94:69:7b:e9:3f:60Digest Algorithmsha1PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
Imports
kernel32
GetModuleFileNameA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
:��I<Z"��'*���}�����SE�նƱ��N�6�s}x��݂u'<o�sw��Z~:Y���4U����hU!D?}�*8E=����un8=�#����ik��1�� }�t�4����aJ �Vf~�n{�E�_M�^y����b8����٭�{��6��uC�Cb���C�]49��~#�,�3����&�fʰ��C�B��8ߦ����l���Kş��׀8���>��[�]pEU���:�z��D�x��Ga.�m��#$��/t����w���L�T#�4�j�nt+9*h�8�2��˯�M���M葰��5"b��NyL-�Qb�v�:�M��:�Wd���]`z���|y|��6m�S�u.�Sã ťl�X��&Q>� N6M \rN�}>��f�6�� 2���,��]Jî�% �l̄"�l���O��������D�W$�P��8%��Ě��eP����b��>���*�J4NB}3��1h@��*�j;_Xx|\�=8��-GG�N��(5�|J6ͧ��J�u�7a���P+�1ED�V]�at��?��ۡ�x^]���Q(�zȤ]�~�H����J�)�̟:��o�K�� ����"�|Џ ��A����db�M�!XXY2@Y o��"�*�'�� <�b_�Yݿ2W�� ��}\�7����ȃ<��>`���~���Pľ� �[i�i�)�2jY�>���}��c�6m� 5j!�8���u��o�G[Z����Q㍬��0��s��n����Sy���\��,�p�(����G�Ì?��Ηd5k�W3�ٰ^ύ_V�<H�QF��i1~��]g���xp+/?�zl�"i���[#�n3�c � EU��v{�l6�}z֔6OcB@�1�M��T�Dz� �i���aQ���9BôJ��VnT�A!)P?}�k5�w��cn�+Kp�?�kWƈ;����I�Jԏ�Sj$��N����Z5�,���,�.gx�����G���`���vw�1 ������-]����Z��_�Z~�� ���3J��o�ƿ��e��� �v�F^ЇJZDY�X٢?'�GmaȤ���iٚ�wa��ǧe�q�B�O��? �J��Ć_�6���w�~�뛪7����Nbm�v���&�T������ҥ�ި��o��:A3��zAq�jCxU����Y��{r��!}����hжa�{���k;�l?2y �o>�R�\�� �;��j�\�(�U��#��Kv�j�圹3b�Y�rez1���Fl@�U�W��,�o��>e�x�F����o������s͍�d�'Ul@�b�����R�:QRl6st�&!W�K� Be��t�]@U�0�/�~W�`�bw{�{�2�PJŒ�\{Ȥ=F��8A�T ����� Ah2*��l�����^�-Hgd(��R�C&�ώ��8 X�sHm���B�ޝ�%�4���r��RK;��ڔ�k�"Ϙ���'��9Hn��k��� ȃ�Y�7��k$�"��l�r��}a�����\�;� #�*h���S����*���՞����@7�|�[���MV�,Y�z��R�x�UG�{4_|�y�X���#&о����(���bP�i�g ��o8u�j5���bAK�R�T������F<�x��J�_�>!�ًk�v�KlwZ�L� �b��8�;?�r"I�V��� *�ݾH��� ��~F�A�ٮW���#�S�b��!8�0���pq��I l�l���|=���J���nt��������]Am��w�'��-��7H`�q�}ˆ��ț,�p�cϧ9�N�2$�"J�T� ���^���i��j��vª{��o�.��W~��� ��>Fۦ)� )���<�� �@U���"87�B�ɮ�I< U�ۭYą��A(2h͟���IB�$��Ժ!ꊞ��-�,L��������Ib�Ҥ��́Mq�Nc�Z�������Q������&$���Ǜ�ڧ�q�ܬ�!�1[�h��:�0T[羘K�V�����,�x'�� o]7r���Ǜ�X�KԨ4�n�ș��ꨚ������P�oS�DW���^)~��R|<���Vת�Yɜ����r�7}�ana-����V�'s�cD�{�+�r��5>"zcb���|�<�}��llƵ���t� +B|�'�}���������T槠Lj6���&d���Ps3�x1�����E�F�W����Nμ~Z��]�+�C�_�`s�F�.� �Z��a��d�4X�Ӱ$���&�qZ �W�����(���N���;[�)'A�#�\4� �CyS���2����k@�E\��~X��2���������Tb����j�����vxNQ@��Z�#�l�x�@M�i�H��頇.���" 9w�I�.G�?�� �1��3˭~,>��3C[D�'�T #W(7�Q�t�JH��W�A0LT�|� �s[������e����1?G�?�ߔ�r!���$�.����$ch��ȅjǷ���y�L�^��� t�}b�W���F����,��<�gY���,|ف�������dz�S~���b�c���hrL̴��Ը���oh�UJ!n���?hZ��?�%��jY`��F��^V�]2��`*O+�V�X�;����d�ͣ4�U�+��� �B�����@�ƾ���iv�RnrdB���x�M��OE�q�q��G��]Өk�N#�i��ϣ��Tl1 [��K�"�S=&�}��`�*�vjAu5]�&ke���Xw��l?����ջ�8��g6ׇ:����P<�o&�%k��h��廕��1ϓ��8��O�W�-0I���(�,�"�J���]s� N����FF��)m�+��-oq̤��Y����G#�)�N�~��hcR߀�E�$���S�bB��ɉˌǬ���S`�r1ڃ��(?���`枺ab�AEs�d��܁��R2��>#}�k����rW�+��&����G�e�%qR�'o�%W'�d��+����>�>�>��Q�vl���c���r|`l�9���ҒR)3����w�_O��&�X��Mfj�1/�3��(=
Sections
.text Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ