HWMonitor_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

HWMonitor_x64.exe
Size

2.9MB
MD5

906bd1fea20ea2611d9c730546faf122
SHA1

905917f025e6f444a2221c6577925c4b26169c40
SHA256

66bbf93add17c22b97b207030cca4a372082b9fc6bbae66a709e2ae9f28eaa33
SHA512

eedd717a8199793b2fad7535821fd2a85dc08f9e62bc3ece049b2f437193002f23805bd9bb3ad7e6e3bfbd6e9ee01bf1daa428e99e95f4a4b6b73873a7063bfc
SSDEEP

24576:dJ6B9M0SM683wGUAg2VKbwL8covTd4N1WU9NbFZ5yiRumRW8W+PQModKG2BzNO18:f6B9MTM6/LAgVb08cV1nFyiIz1

Score

1^/10

Malware Config

Signatures

Files

HWMonitor_x64.exe
.exe windows:5 windows x64 arch:x64

04434d5cadc136fdea9dd84be8565898

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:6d:14:9d:f3:df:52:d8:79:73:62:ed:08:2f:c2:a1
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

03/07/2024, 00:00

Not After

03/07/2025, 23:59

Subject

SERIALNUMBER=493 590 202 00047,CN=CPUID,O=CPUID,ST=Nord,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024652

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:8e:c6:da:65:47:9a:ca:76:73:0e:2e:40:f3:6a:e5:f7:ad:1a:31:21:a1:76:a9:08:61:a8:ca:7d:e1:e9:81
Signer

Actual PE Digest

0f:8e:c6:da:65:47:9a:ca:76:73:0e:2e:40:f3:6a:e5:f7:ad:1a:31:21:a1:76:a9:08:61:a8:ca:7d:e1:e9:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\cpuid2\HWMonitor\vc2008\x64\Release\HWMonitor_x64.pdb

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueW
CreateServiceW
DeleteService
OpenServiceA
StartServiceA
ControlService
OpenSCManagerA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegSetValueW
RegQueryValueExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
SetFileSecurityW
GetFileSecurityW
RegCreateKeyExW
RegCreateKeyW
RegSetValueExW
CloseServiceHandle

kernel32

TlsFree
GlobalFlags
lstrlenA
GetThreadLocale
FileTimeToSystemTime
SystemTimeToFileTime
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
MoveFileW
GetStringTypeExW
lstrcmpiW
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
FindClose
FindFirstFileW
GetVolumeInformationW
GetShortPathNameW
CreateFileW
FileTimeToLocalFileTime
GetFileAttributesExW
LocalFileTimeToFileTime
GetFileSizeEx
GetSystemDirectoryW
SetErrorMode
GetStartupInfoW
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
HeapReAlloc
ExitProcess
HeapQueryInformation
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
RtlCaptureContext
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetLocaleInfoA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetLastError
MultiByteToWideChar
GetVersionExW
GetSystemWindowsDirectoryW
GetFileAttributesW
GetTempPathW
WideCharToMultiByte
GetProcAddress
FindResourceW
LoadResource
SizeofResource
FreeLibrary
LoadLibraryW
MulDiv
LockResource
CloseHandle
CreateThread
WaitForSingleObject
GetModuleHandleW
GetModuleFileNameW
CreateMutexW
GetCurrentDirectoryW
SetThreadPriority
ResumeThread
GetComputerNameW
ExitThread
ReleaseMutex
Sleep
SetCurrentDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
DeleteFileW
SetLastError
lstrlenW
lstrcpyW
lstrcatW
RtlVirtualUnwind
WinExec
HeapFree
GetProcessHeap
GetCurrentProcess
GetModuleFileNameA
GetCurrentDirectoryA
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GetDiskFreeSpaceW
GetFullPathNameW
GetTempFileNameW
GetFileTime
SetFileTime
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
LoadLibraryExW
CompareStringA
GlobalGetAtomNameW
GetCurrentProcessId
DeviceIoControl
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
lstrcmpW
ReadFile
CancelIo
ResetEvent
CreateEventA
SetEnvironmentVariableA
GetCurrentThread
SetThreadAffinityMask
WriteConsoleA
GlobalMemoryStatus
VirtualAlloc
VirtualFree
GetTickCount
GetDiskFreeSpaceA
LocalAlloc
LocalFree
QueryPerformanceFrequency
QueryPerformanceCounter
SetFilePointer
CreateDirectoryA
GetTempPathA
GetModuleHandleA
FindResourceA
GetWindowsDirectoryA
WriteFile
DeleteFileA
RemoveDirectoryA
GetComputerNameA
OpenMutexA
CreateMutexA
GetVersionExA
GetSystemInfo
LoadLibraryA
CreateFileA

user32

LoadCursorW
GetSysColorBrush
SystemParametersInfoW
GetMenuItemInfoW
IsZoomed
ShowOwnedPopups
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
UnpackDDElParam
ReuseDDElParam
DestroyMenu
GetActiveWindow
ReleaseCapture
LoadAcceleratorsW
InsertMenuItemW
CreatePopupMenu
SetRectEmpty
BringWindowToTop
GetDesktopWindow
TranslateAcceleratorW
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetMenuStringW
InsertMenuW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
EnableMenuItem
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageA
SendDlgItemMessageW
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassNameW
GetClassLongPtrW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetWindowLongPtrW
SetWindowLongPtrW
UnhookWindowsHookEx
GetMessageTime
PeekMessageW
MapWindowPoints
TrackPopupMenu
WindowFromPoint
CharUpperW
DestroyIcon
DeleteMenu
CheckMenuItem
UnregisterClassW
GetKeyState
SetMenu
SetScrollPos
GetScrollPos
SetForegroundWindow
IsWindowVisible
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
SetScrollInfo
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
LoadMenuW
GetSubMenu
wsprintfA
PostMessageW
CreateCursor
GetSystemMetrics
SetCursor
SetTimer
InflateRect
DrawFocusRect
IsRectEmpty
KillTimer
SetWindowLongW
LoadBitmapW
MessageBoxW
GetWindowRect
UpdateWindow
SetRect
ReleaseDC
GetDC
GetParent
SendMessageW
PtInRect
GetWindowLongW
CopyRect
GetSysColor
GetClientRect
LoadImageW
InvalidateRect
IsWindow
EnableWindow
GetMessagePos

gdi32

RestoreDC
SetBkMode
SetMapMode
ExcludeClipRect
IntersectClipRect
GetPixel
PtVisible
RectVisible
ExtTextOutW
Escape
SaveDC
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreatePatternBrush
GetTextMetricsW
GetBkColor
SetViewportOrgEx
CreateBitmap
GetClipBox
CreateDCA
CreateSolidBrush
CreateFontIndirectW
GetStockObject
SetBkColor
SetTextColor
CreateICW
CreateFontW
GetDeviceCaps
GetTextExtentPoint32W
BitBlt
CreateCompatibleBitmap
StretchBlt
SelectObject
CreateCompatibleDC
PatBlt
GetObjectW
TextOutW
DeleteObject

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

shell32

DragFinish
DragQueryFileW
ExtractIconW
SHGetFileInfoW
ShellExecuteW

shlwapi

PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathRemoveFileSpecW
PathIsUNCW

ole32

CoTaskMemFree
StringFromGUID2
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
VariantClear
VariantInit
SysStringLen
SysFreeString

winmm

timeGetTime

iphlpapi

GetAdaptersInfo
GetIfEntry

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 179KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 669KB - Virtual size: 668KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04434d5cadc136fdea9dd84be8565898

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

7b:6d:14:9d:f3:df:52:d8:79:73:62:ed:08:2f:c2:a1Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

0f:8e:c6:da:65:47:9a:ca:76:73:0e:2e:40:f3:6a:e5:f7:ad:1a:31:21:a1:76:a9:08:61:a8:ca:7d:e1:e9:81Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

advapi32

kernel32

user32

gdi32

comdlg32

winspool.drv

shell32

shlwapi

ole32

oleaut32

winmm

iphlpapi

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 451KB - Virtual size: 450KB

.data Size: 179KB - Virtual size: 205KB

.pdata Size: 71KB - Virtual size: 71KB

.rsrc Size: 669KB - Virtual size: 668KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

7b:6d:14:9d:f3:df:52:d8:79:73:62:ed:08:2f:c2:a1
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

0f:8e:c6:da:65:47:9a:ca:76:73:0e:2e:40:f3:6a:e5:f7:ad:1a:31:21:a1:76:a9:08:61:a8:ca:7d:e1:e9:81
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 451KB - Virtual size: 450KB

.data
Size: 179KB - Virtual size: 205KB

.pdata
Size: 71KB - Virtual size: 71KB

.rsrc
Size: 669KB - Virtual size: 668KB