Procmon[.]1[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Procmon.1.exe
Size

3.9MB
MD5

c3e77b6959cc68baee9825c84dc41d9c
SHA1

bc18a67ad4057dd36f896a4d411b8fc5b06e5b2f
SHA256

3b7ea4318c3c1508701102cf966f650e04f28d29938f85d74ec0ec2528657b6e
SHA512

f825521149f4e771c9f51abaa4fa956258a5393754ec7422692dc0c24c120ed9f103dd3953b47b7bb331dd4095b3e97b95fb35c4dfe03ce39574ba4b39b76d7d
SSDEEP

49152:C9TJDVmHMAlNXFJelNOBLVKcu6NvhM6qHJfTJb5lmzSzko22LGywmtG6tlp0NjCd:O4sA5JelIBs9JlmzSzko2zjCf9fP

Score

1^/10

Malware Config

Signatures

Files

Procmon.1.exe
.exe windows:6 windows x86 arch:x86

b6b70847ec4b6d39f641691853d7b02b

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:95:2c:0c:ec:80:ae:a3:7b:ab:ca:82:2b:bb:32:d1:d6:dd:d4:3b:8d:81:51:90:8f:90:8e:0e:bc:35:20:12
Signer

Actual PE Digest

8d:95:2c:0c:ec:80:ae:a3:7b:ab:ca:82:2b:bb:32:d1:d6:dd:d4:3b:8d:81:51:90:8f:90:8e:0e:bc:35:20:12

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\__w\1\s\exe\Win32\Release\Procmon.pdb

Imports

ws2_32

getsockname
listen
recv
closesocket
socket
gethostbyname
WSAGetLastError
ntohs
WSAStartup
htonl
inet_addr
inet_ntoa
bind
connect
htons
accept
send
gethostbyaddr
WSASetLastError
getservbyname
getservbyport

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_AddMasked
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_GetImageCount
ImageList_DrawIndirect
CreateStatusWindowW
ImageList_SetOverlayImage
InitCommonControlsEx
ImageList_Add
ImageList_Draw
ImageList_GetIcon
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Destroy
ImageList_Create

fltlib

FilterSendMessage
FilterGetMessage
FilterReplyMessage
FilterConnectCommunicationPort

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
GetSystemInfo
VerSetConditionMask
RaiseException
GetCurrentThreadId
VerifyVersionInfoW
GlobalAddAtomW
EnumResourceNamesW
SetCurrentDirectoryW
CreateProcessW
OpenProcess
CompareStringW
GetLocaleInfoW
VirtualQuery
lstrcmpW
lstrcmpiW
MultiByteToWideChar
GetFileSize
SetEndOfFile
SetFilePointer
TryEnterCriticalSection
VirtualAlloc
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FileTimeToLocalFileTime
LocalFileTimeToFileTime
ReadFile
FormatMessageW
FileTimeToSystemTime
SystemTimeToFileTime
GetDateFormatW
GetTimeFormatW
ReleaseSRWLockExclusive
QueryPerformanceCounter
QueryPerformanceFrequency
HeapCreate
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventW
WaitForMultipleObjects
CreateSemaphoreW
ExitProcess
SetThreadPriority
GetComputerNameA
GetFileAttributesExW
DecodePointer
GetCurrentProcessId
SetProcessShutdownParameters
VirtualFree
GetComputerNameW
SetConsoleCtrlHandler
OpenThread
GetThreadContext
GetSystemDirectoryA
TrySubmitThreadpoolCallback
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetSystemDirectoryW
InterlockedPopEntrySList
EncodePointer
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
FlushInstructionCache
LoadLibraryExA
WideCharToMultiByte
GetStringTypeW
LCMapStringEx
GetCPInfo
RtlUnwind
GetCurrentProcess
SetFileAttributesW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
InitializeCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThread
CreateThread
Sleep
WaitForSingleObject
FreeResource
GlobalMemoryStatusEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetConsoleCP
VirtualProtect
ExitThread
FreeLibraryAndExitThread
GetFullPathNameW
lstrlenW
MulDiv
LoadLibraryW
FreeLibrary
GetThreadId
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetFileAttributesW
GlobalLock
GlobalUnlock
GlobalAlloc
LocalFree
LocalAlloc
ReleaseSRWLockShared
GetProcAddress
GetModuleHandleW
GetFileType
GetCommandLineW
GetStdHandle
LoadLibraryExW
GetVersionExW
SetLastError
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetNumberFormatW
InterlockedPushEntrySList
LCMapStringW

user32

LoadStringA
DrawEdge
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessagePos
PostQuitMessage
GetWindowPlacement
SetWindowPlacement
CheckRadioButton
CharLowerW
CreatePopupMenu
RemoveMenu
InsertMenuItemW
SetRectEmpty
ChildWindowFromPoint
InsertMenuW
GetMenuStringW
SetMenu
GetMenu
CharNextW
IsMenu
GetWindowThreadProcessId
FindWindowExW
FindWindowW
SetForegroundWindow
IsIconic
WaitForInputIdle
CreateIconFromResourceEx
GetDlgItemInt
GetActiveWindow
RegisterWindowMessageW
GetAsyncKeyState
SetWindowTextA
EnumChildWindows
UnionRect
DrawFrameControl
IsDialogMessageW
CheckMenuRadioItem
SetRect
WindowFromPoint
ClientToScreen
AdjustWindowRectEx
SetMenuDefaultItem
GetMenuItemInfoW
DeleteMenu
AppendMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
ReleaseCapture
SetCapture
GetCapture
SetFocus
GetDlgCtrlID
SetDlgItemInt
CreateDialogParamW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetClassInfoExW
RegisterClassExW
TrackMouseEvent
FlashWindowEx
MapWindowPoints
GetCursor
GetCursorPos
GetFocus
LoadStringW
LoadIconW
MessageBeep
GetPropW
SetPropW
SetActiveWindow
UnregisterClassW
GetDesktopWindow
DialogBoxParamW
GetWindow
MessageBoxW
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextW
DestroyWindow
IsWindow
GetWindowRect
SetDlgItemTextW
GetAncestor
GetWindowModuleFileNameW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
GetParent
SetClassLongW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
CopyRect
EqualRect
GetClassLongW
IntersectRect
ScrollWindowEx
ValidateRect
GetUpdateRgn
GetUpdateRect
GetKeyState
CreateIconIndirect
GetForegroundWindow
SetMenuInfo
GetMenuInfo
FrameRect
FillRect
DrawFocusRect
ScreenToClient
GetClientRect
GetWindowTextLengthW
GetWindowTextW
ShowScrollBar
SetScrollPos
RedrawWindow
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
DrawTextW
GetSystemMetrics
IsWindowEnabled
KillTimer
SetTimer
IsZoomed
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
IsChild
CreateWindowExW
TrackPopupMenuEx
MonitorFromPoint
ModifyMenuW
CallWindowProcW
DefWindowProcW
PostMessageW
GetIconInfo
DrawIconEx
LoadImageW
GetSysColor
SetMenuItemInfoW
DestroyMenu
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
LoadCursorW
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SendMessageW
EnableWindow

gdi32

SaveDC
RestoreDC
SetBrushOrgEx
SetPixel
PatBlt
GetPixel
ExcludeClipRect
SetROP2
LineTo
CreatePatternBrush
SelectClipRgn
RectInRegion
GetBkMode
CreateRectRgnIndirect
CreateRectRgn
GetDIBits
CreateBitmapIndirect
CreateBitmap
GdiFlush
GetTextMetricsW
GetCurrentObject
CreateFontW
Polygon
GetObjectW
GetBitmapBits
GetBkColor
CreateDIBSection
Polyline
TextOutW
MoveToEx
SetTextAlign
SetTextColor
SetMapMode
GetDeviceCaps
Rectangle
GetTextExtentPoint32W
GetStockObject
CreatePen
CreateFontIndirectW
CreateSolidBrush
SetViewportOrgEx
ExtTextOutW
SetBkColor
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
EndPage
StartPage
EndDoc
StartDocW
SetBkMode

comdlg32

ChooseColorW
GetOpenFileNameW
PrintDlgW
ChooseFontW
FindTextW
GetSaveFileNameW

advapi32

RegQueryValueExW
ConvertStringSidToSidW
ConvertSidToStringSidW
RegSetValueW
RegEnumKeyW
LookupAccountSidW
MapGenericMask
GetTokenInformation
GetLengthSid
FreeSid
EqualSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegOpenKeyW
RegCreateKeyW
RegCloseKey

shell32

SHGetSpecialFolderLocation
ExtractIconExW
SHGetPathFromIDListW
CommandLineToArgvW
SHChangeNotify
SHBrowseForFolderW
SHGetMalloc
DragQueryFileW
ShellExecuteExW
SHGetFileInfoW
ShellExecuteW

ole32

CoTaskMemFree
RegisterDragDrop
ReleaseStgMedium
CoTaskMemRealloc
OleUninitialize
CreateBindCtx
OleInitialize
CoTaskMemAlloc
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx

oleaut32

SysFreeString
SysStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen
VarUI4FromStr
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayGetElement

shlwapi

SHAutoComplete

uxtheme

IsThemeActive
SetWindowTheme
IsAppThemed
IsCompositionActive

dwmapi

DwmSetWindowAttribute
DwmDefWindowProc

ntdll

RtlGetVersion

Sections

.text
Size: 875KB - Virtual size: 874KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 233KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6b70847ec4b6d39f641691853d7b02b

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:afCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

8d:95:2c:0c:ec:80:ae:a3:7b:ab:ca:82:2b:bb:32:d1:d6:dd:d4:3b:8d:81:51:90:8f:90:8e:0e:bc:35:20:12Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

version

comctl32

fltlib

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

uxtheme

dwmapi

ntdll

Sections

.text Size: 875KB - Virtual size: 874KB

.rdata Size: 233KB - Virtual size: 232KB

.data Size: 26KB - Virtual size: 99KB

.rsrc Size: 2.8MB - Virtual size: 2.8MB

.reloc Size: 57KB - Virtual size: 56KB

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

8d:95:2c:0c:ec:80:ae:a3:7b:ab:ca:82:2b:bb:32:d1:d6:dd:d4:3b:8d:81:51:90:8f:90:8e:0e:bc:35:20:12
Signer

.text
Size: 875KB - Virtual size: 874KB

.rdata
Size: 233KB - Virtual size: 232KB

.data
Size: 26KB - Virtual size: 99KB

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

.reloc
Size: 57KB - Virtual size: 56KB