conhost[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
conhost.exe
Size 11.9MB
Sample261107-28hsvsge29
SHA256 bfed166c9129c9a3e52a04ddbf82f8768608f6dc815f37beed05f13f6caaa6d7
MD5 ada7f481e0500577c0f8503fa61a005d
SHA1 0043c6474ad9aad0793b9dcdc22134e21321622f
SHA512 20a584df002685bcfd105da1e06036c3523d81d320ae5c5a70886116028f26f4ab271bdc4473fbb2dabba03da403da1cbe589c2d100193d9b1d61e9447e5d728
SSDEEP 98304:d32IooKXIE+XUDeLfeDt9ygF8Ut7w2w16tCSwKTYEygmYhC8aSl0wI+vCB2lmWN:lKXIE+XUDeLfeZ9ytUABoY8palh+vFQG
TLSH
T1FAC65AE330C7A6EDC447C57A4313FD7F999F703A0626A8E75188A6326D26C943B25F09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
conhost.exe

File Explorer

conhost.exe

.exe 11.9MB

conhost.exe

IMPHASH ae67e904a4551f4b4121bb02c48a58e1
SHA256 bfed166c9129c9a3e52a04ddbf82f8768608f6dc815f37beed05f13f6caaa6d7
MD5 ada7f481e0500577c0f8503fa61a005d
SHA1 0043c6474ad9aad0793b9dcdc22134e21321622f
SHA512 20a584df002685bcfd105da1e06036c3523d81d320ae5c5a70886116028f26f4ab271bdc4473fbb2dabba03da403da1cbe589c2d100193d9b1d61e9447e5d728
SSDEEP 98304:d32IooKXIE+XUDeLfeDt9ygF8Ut7w2w16tCSwKTYEygmYhC8aSl0wI+vCB2lmWN:lKXIE+XUDeLfeZ9ytUABoY8palh+vFQG
TLSH
T1FAC65AE330C7A6EDC447C57A4313FD7F999F703A0626A8E75188A6326D26C943B25F09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3348512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken RegGetValueW RegSetKeyValueW

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpQueryOption WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetStatusCallback WinHttpSetTimeouts

crypt32

CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CryptEncodeObject CryptProtectData CryptUnprotectData

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize

shell32

SHGetKnownFolderPath ShellExecuteW

shlwapi

ord12

dwmapi

DwmSetWindowAttribute

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSACleanup WSAStartup accept bind closesocket getsockname htonl listen ntohs recv select send setsockopt socket

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CancelIoEx CheckRemoteDebuggerPresent CloseHandle CompareStringOrdinal CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateNamedPipeA CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetOEMCP GetOverlappedResult GetPackageId GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemFirmwareTable GetSystemTimeAsFileTime GetThreadContext GetTickCount64 GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MoveFileW MulDiv MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive ReleaseSRWLockShared ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetDefaultDllDirectories SetEndOfFile SetEnvironmentVariableW SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetProcessMitigationPolicy SetStdHandle SetThreadInformation SetUnhandledExceptionFilter SleepConditionVariableSRW SuspendThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

user32

CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetClientRect GetClipboardData GetDpiForSystem GetDpiForWindow GetKeyState GetSystemMetrics GetWindowLongPtrW LoadCursorW MessageBoxA MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RegisterClassExW ReleaseCapture ScreenToClient SetCapture SetClassLongPtrA SetClipboardData SetCursor SetProcessDpiAwarenessContext SetWindowDisplayAffinity SetWindowLongPtrW SetWindowPos ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UnregisterClassW UpdateWindow

d3dcompiler_47

D3DCompile

imm32

ImmGetCompositionStringW ImmGetContext ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

321B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.FOID

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.FOID

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

conhost.exe

advapi32

winhttp

crypt32

ole32

shell32

shlwapi

dwmapi

version

ws2_32

d3d11

kernel32

user32

d3dcompiler_47

imm32

generic