svchost[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
svchost.exe
Size 2.1MB
Sample260930-n16casvgla
SHA256 afe50f00fabd0de37f90a32db77a9c2228917ad4fb1dc9027ee37cc3a5bff5f9
MD5 0b41bb89a8c4ece267dd6de18ee09f8d
SHA1 c239d56b95a5acea3b7a8029cbde48cb131bfade
SHA512 6c5e2d20d7308ae8e4afc7ab72729e08b86d1ed7bd7a40d8cee67c5414c8f48bc4a2745db520284fb9a6de4dd5aa66f8e988100cdada98405ac87c3cfee1e339
SSDEEP 49152:9GHjzvPzAWq7IwwP6hMxTnErsrZevQ7vGgOz4OeJ25AVZbmQLkpEi:9x/7Iwwzxn4srOnteJ2qHbmQLE
TLSH
T1F1A50115E7950DFEEA374BBCC84A484AE667BC53139402AB07F086E58F167E05C3FA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
svchost.exe

File Explorer

svchost.exe

.exe 2.1MB

svchost.exe

IMPHASH deb8224bc8fc18df9472627e3c76655a
SHA256 afe50f00fabd0de37f90a32db77a9c2228917ad4fb1dc9027ee37cc3a5bff5f9
MD5 0b41bb89a8c4ece267dd6de18ee09f8d
SHA1 c239d56b95a5acea3b7a8029cbde48cb131bfade
SHA512 6c5e2d20d7308ae8e4afc7ab72729e08b86d1ed7bd7a40d8cee67c5414c8f48bc4a2745db520284fb9a6de4dd5aa66f8e988100cdada98405ac87c3cfee1e339
SSDEEP 49152:9GHjzvPzAWq7IwwP6hMxTnErsrZevQ7vGgOz4OeJ25AVZbmQLkpEi:9x/7Iwwzxn4srOnteJ2qHbmQLE
TLSH
T1F1A50115E7950DFEEA374BBCC84A484AE667BC53139402AB07F086E58F167E05C3FA16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

118820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenThreadToken ImpersonateSelf ConvertStringSecurityDescriptorToSecurityDescriptorA OpenProcessToken

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate

user32

DispatchMessageW PeekMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow ShowWindow UpdateLayeredWindow GetDC ReleaseDC GetWindowRect ScreenToClient LoadCursorW SystemParametersInfoW SetProcessDpiAwarenessContext TranslateMessage

gdiplus

GdipAddPathArc GdipClosePathFigure GdipResetPath GdipDeletePath GdipDeleteBrush GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCloneBrush GdipCreateSolidFill GdipCreateLineBrush GdipCreatePen1 GdipDeletePen GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipDrawLine GdipDrawPath GdipGraphicsClear GdipFillEllipse GdipFillPath GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipDeleteFont GdipCreateFont GdipDrawString GdipMeasureString GdipCreatePath

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP SetFilePointerEx GetFileType HeapFree HeapAlloc GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx GetStdHandle GetEnvironmentVariableW GetProcessHeap CreateFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileSizeEx SetFileAttributesW WriteFile GetTempPathW CloseHandle GetLastError SetEvent WaitForSingleObject OpenEventW Sleep GetCurrentProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread CreateProcessW OpenProcess GetSystemInfo GetTickCount64 GetWindowsDirectoryW VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx IsWow64Process GetModuleHandleW GetProcAddress LocalFree FormatMessageW QueryFullProcessImageNameW WideCharToMultiByte GetConsoleMode SetConsoleMode GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW K32GetProcessMemoryInfo ReadFile ConnectNamedPipe GetOverlappedResult CancelIo ResetEvent CreateEventA GetCurrentThread GetTickCount GetModuleHandleA CreateNamedPipeA RaiseException SetStdHandle ReadConsoleW HeapSize WriteConsoleW SearchPathW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FormatMessageA GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle GetFileInformationByHandleEx MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RtlUnwind

gdi32

SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateDIBSection

Name

.text

Size

258KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

svchost.exe

advapi32

rpcrt4

user32

gdiplus

kernel32

gdi32

generic