SystemHealthMonitor[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SystemHealthMonitor.exe
Size 773KB
Sample261015-2cl6eas1hx
SHA256 25389448ceaa92b3133c26e4fe2cc34cfc908f32cf44d93cc886a2d62deb06e1
MD5 dfe84bfa99992de2e606b2c1c49871a1
SHA1 ff49c5791b4deaf058f0d74d061410319cf95252
SHA512 e5ca62ddaee3c3802280a824ec7782810880b8d9f97dd82b99ea1366c1c14b998ca812d37e6d768886a8b1b0612d56d3cbde3e5db80e7bc057181c0328fe47de
SSDEEP 6144:DeEU7BYrccUZTEJh+brYBKDC42hh1vSZPfcAmAPBpfWiTvzE5ls8qyxYRQ+8xSrU:qlTA2bKkqb1INpOUgiRQfbK6Td
TLSH
T12AF421AC636D2F17E25171F37A7229206ED115BD037F25C3C24285DA0B273528A6BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

SystemHealthMonitor.exe

.exe 773KB

SystemHealthMonitor.exe

IMPHASH ec533b3e4c20d64408cbc70009cde003
SHA256 25389448ceaa92b3133c26e4fe2cc34cfc908f32cf44d93cc886a2d62deb06e1
MD5 dfe84bfa99992de2e606b2c1c49871a1
SHA1 ff49c5791b4deaf058f0d74d061410319cf95252
SHA512 e5ca62ddaee3c3802280a824ec7782810880b8d9f97dd82b99ea1366c1c14b998ca812d37e6d768886a8b1b0612d56d3cbde3e5db80e7bc057181c0328fe47de
SSDEEP 6144:DeEU7BYrccUZTEJh+brYBKDC42hh1vSZPfcAmAPBpfWiTvzE5ls8qyxYRQ+8xSrU:qlTA2bKkqb1INpOUgiRQfbK6Td
TLSH
T12AF421AC636D2F17E25171F37A7229206ED115BD037F25C3C24285DA0B273528A6BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

e3:4b:7f:a4:0d:ab:3a:08:ed:02:56:b8:50:1f:5b:66:8b:4e:79:09:f7:8c:6e:1f:a0:dc:e0:28:d0:90:eb:8a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Teapot Software Oy,O=Teapot Software Oy,L=Vantaa,ST=Uusimaa,C=FI

Chains

Oct 14, 2026

CN=Teapot Software Oy,O=Teapot Software Oy,L=Vantaa,ST=Uusimaa,C=FI

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Teapot Software Oy,O=Teapot Software Oy,L=Vantaa,ST=Uusimaa,C=FI

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Teapot Software Oy,O=Teapot Software Oy,L=Vantaa,ST=Uusimaa,C=FI

Serial Number

78:a8:6c:aa:fd:d6:f6:de:0d:c5:cf:2a:0c:12:82:65

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2026 - Aug 11, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

634272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SystemHealth.pdb

bcrypt

BCryptGenRandom

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSendRequest

wininet

InternetGetConnectedState

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx GetFileTime ReadFile SetFileTime WriteFile GetTempPathW CloseHandle GetLastError WaitForSingleObject CreateMutexW GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GetTickCount64 GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW LocalFree QueryFullProcessImageNameW CopyFileW SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetOEMCP SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx HeapSize WriteConsoleW Sleep GetACP IsValidCodePage FindFirstFileExW HeapReAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx RtlLookupFunctionEntry SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle ExitProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW

advapi32

ConvertSidToStringSidW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey GetTokenInformation OpenProcessToken

shell32

SHGetKnownFolderPath

ole32

CoUninitialize CoTaskMemFree CLSIDFromString CoCreateInstance CoInitializeEx

oleaut32

SysAllocString SysFreeString

Name

.text

Size

681KB

Virtual Size

681KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SystemHealthMonitor.exe

bcrypt

winhttp

wininet

kernel32

advapi32

shell32

ole32

oleaut32

generic