Core Temp[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Core Temp.exe
Size

1016KB
MD5

dd0b36ba71e37897a4abb6965101f0a4
SHA1

64225a3da45a6555aafc1d1ae9e8ab0cde96418f
SHA256

c7791d37852d3db59c843e9b12c23cfe4add9a05686d7a9b166cf20a6e980cd9
SHA512

6ea2630c0c24265642cb396fb0717eb61c0980df53fd6909bb316e36625a2ae965a267e8ec0a5bdc54dc255c39a646c60dec65e77a79828f2dc2d842fb6afe89
SSDEEP

12288:sZdIGdnXNBAEtfarFE2bxGP/hAWs7Yhkbm05YBaSxnKvBQR4CYg7x:sZdIGdnvZ9arc/xriq05e5nKvm4CYg7x

Score

1^/10

Malware Config

Signatures

Files

Core Temp.exe
.exe windows:5 windows x64 arch:x64

6bdb3a5e0aec4758aa1e8f6e9c8c0a93

Code Sign

9a:98:ab:f4:94:19:a8:44:9c:06:f8:5c:19:a5:51:a8
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

18/05/2021, 00:00

Not After

17/05/2024, 23:59

Subject

CN=ALCPU,O=ALCPU,L=Ramat Gan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

40:77:74:75:d1:85:98:59:2d:fa:fe:a0:0f:77:75:e8:ea:1d:f6:f0:62:16:db:f6:00:0b:30:42:9b:f4:27:a7
Signer

Actual PE Digest

40:77:74:75:d1:85:98:59:2d:fa:fe:a0:0f:77:75:e8:ea:1d:f6:f0:62:16:db:f6:00:0b:30:42:9b:f4:27:a7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\Programming\CoreTemp\CoreTempDriverRework\x64\Release\Core Temp.pdb

Imports

comctl32

ImageList_AddMasked
ImageList_GetIcon
ImageList_Destroy
ImageList_Create
InitCommonControlsEx

powrprof

SetSuspendState

gdiplus

GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipLoadImageFromFile
GdipAlloc
GdipFree

kernel32

DeviceIoControl
FindNextFileW
FreeResource
LockResource
LoadResource
FindResourceW
EnumResourceNamesW
GetUserDefaultUILanguage
QueryPerformanceFrequency
QueryPerformanceCounter
LocalAlloc
lstrcpynW
FreeLibrary
LoadLibraryW
GetFileSize
TerminateThread
SetErrorMode
SetFileAttributesW
RemoveDirectoryW
WaitForMultipleObjects
SetThreadPriority
SetPriorityClass
ReadFile
GetModuleFileNameA
GetVersion
HeapReAlloc
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointer
CloseHandle
GetFileType
SetHandleCount
GetStringTypeW
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
WideCharToMultiByte
HeapCreate
HeapSetInformation
ExitProcess
GetStdHandle
GetTimeZoneInformation
FlsAlloc
GetCurrentThreadId
SetLastError
FlsFree
FlsSetValue
FlsGetValue
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetCommandLineW
DeleteFileA
RtlPcToFileHeader
RaiseException
HeapFree
GetTimeFormatW
HeapAlloc
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
RtlUnwindEx
RtlLookupFunctionEntry
MultiByteToWideChar
FindFirstFileW
FindClose
GetFileSizeEx
GetFullPathNameW
VerSetConditionMask
VerifyVersionInfoW
GetModuleHandleW
GetProcAddress
GetVersionExW
GetLocalTime
GetTickCount
GetModuleFileNameW
Sleep
MulDiv
CreateFileA
CompareStringW
SetEnvironmentVariableW
WriteConsoleW
SetEndOfFile
GetProcessHeap
SetEnvironmentVariableA
GetExitCodeThread
LoadLibraryA
CreateThread
GetCurrentThread
GetCurrentProcess
GetDateFormatW
FormatMessageW
LocalFree
UnmapViewOfFile
CreateMutexW
WaitForSingleObject
CreateFileMappingW
MapViewOfFile
CreateFileW
WriteFile
DeleteFileW
OpenMutexW
GetLastError
EnterCriticalSection
ReleaseMutex
DeleteCriticalSection

user32

LoadMenuW
DrawMenuBar
GetClassNameW
GetMenuItemInfoW
GetMenuStringW
SetMenuItemInfoW
ScreenToClient
GetClassInfoExW
GetDlgCtrlID
GetSysColorBrush
CopyRect
SetFocus
DestroyIcon
MonitorFromPoint
FillRect
LoadStringW
LoadAcceleratorsW
FindWindowW
IsIconic
OffsetRect
MapDialogRect
SetRectEmpty
GetDialogBaseUnits
ReleaseDC
GetDC
GetSystemMetrics
CreateWindowExW
SetWindowPos
CallWindowProcW
GetWindowLongPtrW
GetSysColor
MessageBoxW
MapWindowPoints
GetParent
GetWindowRect
MoveWindow
GetClientRect
GetWindowTextW
SendMessageW
SetCursor
AdjustWindowRectEx
DrawTextExW
ExitWindowsEx
CreateDialogParamW
PostMessageW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadIconW
RegisterClassExW
RegisterWindowMessageA
RegisterWindowMessageW
DefWindowProcW
GetSubMenu
PostQuitMessage
DestroyWindow
DialogBoxParamW
EnableMenuItem
GetMenuState
GetMenu
SetWindowLongW
SetTimer
KillTimer
EnableWindow
GetWindowLongW
EnumChildWindows
SendNotifyMessageW
GetDlgItem
EndDialog
SetWindowLongPtrW
SetWindowTextW
CreatePopupMenu
GetMenuItemCount
InsertMenuItemW
CheckMenuItem
GetCursorPos
TrackPopupMenu
DestroyMenu
SetForegroundWindow
UpdateWindow
LoadBitmapW
InvalidateRect
ShowWindow
LoadCursorW
SystemParametersInfoW

gdi32

CreateCompatibleDC
BitBlt
DeleteObject
DeleteDC
SelectObject
GetTextExtentPoint32W
CreateSolidBrush
SetTextColor
SetBkColor
GetDeviceCaps
CreateBrushIndirect
CreateBitmap
CreateDIBSection
CreateFontIndirectW
CreateFontW
GetTextMetricsW
SetTextAlign
TextOutW

comdlg32

ChooseFontW
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW

advapi32

RegDeleteValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeSecurityDescriptor
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
RegOpenKeyExW
CloseServiceHandle
DeleteService
ControlService
OpenServiceW
OpenSCManagerW
StartServiceW
CreateServiceW
GetUserNameW
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl

shell32

Shell_NotifyIconW
ExtractIconW
ShellExecuteW

ole32

CoCreateInstance
CoInitialize

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

shlwapi

PathAppendW
PathRemoveFileSpecW
PathIsFileSpecW

ws2_32

socket
connect
WSACleanup
gethostbyname
inet_ntoa
htons
inet_addr
WSAStartup
send
recv
shutdown
closesocket

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo

Sections

.text
Size: 581KB - Virtual size: 581KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bdb3a5e0aec4758aa1e8f6e9c8c0a93

Code Sign

9a:98:ab:f4:94:19:a8:44:9c:06:f8:5c:19:a5:51:a8Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

40:77:74:75:d1:85:98:59:2d:fa:fe:a0:0f:77:75:e8:ea:1d:f6:f0:62:16:db:f6:00:0b:30:42:9b:f4:27:a7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

powrprof

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

version

setupapi

Sections

.text Size: 581KB - Virtual size: 581KB

.rdata Size: 172KB - Virtual size: 171KB

.data Size: 14KB - Virtual size: 191KB

.pdata Size: 30KB - Virtual size: 29KB

.rsrc Size: 119KB - Virtual size: 118KB

.reloc Size: 7KB - Virtual size: 6KB

9a:98:ab:f4:94:19:a8:44:9c:06:f8:5c:19:a5:51:a8
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

40:77:74:75:d1:85:98:59:2d:fa:fe:a0:0f:77:75:e8:ea:1d:f6:f0:62:16:db:f6:00:0b:30:42:9b:f4:27:a7
Signer

.text
Size: 581KB - Virtual size: 581KB

.rdata
Size: 172KB - Virtual size: 171KB

.data
Size: 14KB - Virtual size: 191KB

.pdata
Size: 30KB - Virtual size: 29KB

.rsrc
Size: 119KB - Virtual size: 118KB

.reloc
Size: 7KB - Virtual size: 6KB