taskhostw.exe

First submission 2024-10-12 17:24:03 Last sumbission 2024-10-13 07:07:03

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 1260.5 KB (1290752 bytes)
Compile time: 2024-10-12 09:42:27
MD5: 6539c2c942c9aa3ab9c7fe14fccf0b4e
SHA1: f4a663d69419e1cdef4d31ae003c89f6c19f23c0
SHA256: d98fa625a92c790403ee5f8be928948855ea23a892321cc7d219895d3f5b1c36
Import Hash : afcdf79be1557326c854b6e20cb900a7
Sections 5 .text .rdata .data .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 26/77 VT report date: 2024-10-12 17:20:56
Malware Type 1 trojan
Threat Type 2 shadow autoit

URLs, FQDN and IP indicators 2

URL Host (FQDN/IP) Date Added
hXXp://104.168.7.25/350/taskhostw.exe VirusTotal Report 104.168.7.25 VirusTotal Report 2024-10-13 07:07:06
hXXp://104.168.7.25/450/taskhostw.exe VirusTotal Report 104.168.7.25 VirusTotal Report 2024-10-12 17:24:03

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x8dd2e 581120 6ca4f81d951a00335345adcc6c9699211bfef144 c2c2260508750422d20cd5cbb116b146
.rdata 0x8f000 0x2e10e 188928 57b47ecaac29f80d8daf40951c7d7f4f16ac6d05 4513b58651e3d8d87c81a396e5b2f1d1
.data 0xbe000 0x8f74 20992 bd045801410191cce6558498902a89353b03fcb6 c2de4a3d214eae7e87c7bfc06bd79775
.rsrc 0xc7000 0x7283c 469504 20f38d98c4d8db0aefe7e36cc61c226d530a6ff7 51a35aec43650a4e0faa1d4927358dd7
.reloc 0x13a000 0x7130 29184 55df6e389cdefeadf102dce6c3b142530d4153c5 1254908a9a03d2bcf12045d49cd572b9

PE Resources 7

Name Language Sublanguage Offset Size Data
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_UK 0xcd038 1128
RT_MENU LANG_ENGLISH SUBLANG_ENGLISH_UK 0xcd4a0 80
RT_STRING LANG_ENGLISH SUBLANG_ENGLISH_UK 0xcf660 344
RT_RCDATA LANG_NEUTRAL SUBLANG_NEUTRAL 0xcf7b8 432900
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_UK 0x13935c 20
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_UK 0x139370 220
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_UK 0x13944c 1007

Meta infos 1

Translation: 0x0809 0x04b0

Packers detected 2

Microsoft Visual C++ 8
VC8 -> Microsoft Corporation

Anti debug functions 12

FindWindowExW
FindWindowW
GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
OutputDebugStringW
Process32FirstW
Process32NextW
RaiseException
TerminateProcess
UnhandledExceptionFilter

Anti debug functions 1

VMCheck.dll

Strings analysis - File found

Database
{b0.Db
Library
USER32.dll
KERNEL32.dll
mscoree.dll
combase.dll
OLEAUT32.dll
ADVAPI32.dll
VERSION.dll
UxTheme.dll
WSOCK32.dll
SHELL32.dll
PSAPI.DLL
COMCTL32.dll
ole32.dll
IPHLPAPI.DLL
WININET.dll
USERENV.dll
WINMM.dll
GDI32.dll
COMDLG32.dll
MPR.dll

Strings analysis - Possible IPs found 1

255.255.255.255

Import functions

Name Latest seen MD5
ransom_builder.exe 2022-09-26 11:13:02 43a2c7ba0ecd3a1b8ff0b82a0e82296d
HVC.exe 2024-05-18 06:22:04 d3d4eadf3c33f7f479c4e647ac76ed25
eee.exe 2024-05-18 07:07:09 db8d5c5808856045722588e5c2e589fb
Document0984757478.exe 2024-05-19 08:56:03 c36f798f2646092c180c6fc904c418f7
EAP.exe 2024-05-19 10:54:03 76609684d4f0fdd1e46ddf8353c389bf
ngown.exe 2024-05-23 06:15:01 66e5c9de148b496d53b2968c6a03c257
wxijgyp.exe 2024-05-24 12:26:01 ca82319fef771a184d1f98750e5bbb21
gywervcyuj.exe 2024-05-23 08:45:01 d90f41701d76908bf5a1519fe7b99f23
tsaplQyj.exe 2024-05-24 06:47:02 bcdda917607e4c698f148d10466c3b80
zwuivg.exe 2024-05-24 10:10:02 9bd9e74ec90979f70c3e6ceead15aa5a
wsiopohwqsd.exe 2024-05-24 10:53:01 a7e106df2ca7b17bd39ec582d19522a0
QEwecfyhj.exe 2024-05-27 06:26:09 9efd5e60fd358a4bed2382d3815783ae
ESF.exe 2024-05-30 15:27:04 38ed148872d265a595e39e1763a88427
IGCC.exe 2024-06-06 18:20:02 29b2b081df5861fed9651766f37b7738
Satin06.exe 2024-06-08 18:03:03 09ab6049a1abaac4ce2aef0dc60b6b6d
Delivery%2007.exe 2024-06-08 18:04:03 b94b6c27e410388cd4e7dfeb352b75ce
Auto%20R.exe 2024-06-08 18:05:03 351650a422e427140d74d8c68185fa24
proposal%20report.exe 2024-06-08 18:06:03 092cd26903ed79eb7da016adbb7c928d
Delivery%2006.exe 2024-06-08 18:07:03 132e9cb76def326daa4088f99587b759
DELIVERED%200606.exe 2024-06-08 18:09:03 2eebcdd0e833ba968a9cac360aed72de
jonny.exe 2024-06-11 21:22:02 00511c6ef7405a6b00333eaeed463824
twapcdhuj20shds2WOP90sdhy.exe 2024-06-11 21:23:02 49771fd313935046468ff48e9a97f287
DIP.exe 2024-06-12 08:18:02 3f02a2516380a49f81ae8e15e7f548cc
qgtplfgy2.exe 2024-06-13 12:43:03 3d033b03106e5b46abde0df781c164d5
nomi.exe 2024-06-13 12:44:02 5dba79262866002740d9fc8e10d35e7d
QmU99jUVU4mWEyUw7e6kKW8mHeocJZoEM5nUeB87FDFPEh 2024-06-21 08:20:02 2c5a6d97f9c1c28cd3a644ff896b5d95
snukingorig2.5.exe 2024-07-01 21:47:06 7d50650cd2ba63482d4caf875ae65a8e
pilnmAc2.6.exe 2024-07-02 09:22:04 9929a1a4d2ec5d72c028435c6b71054f
PO%2012.04%20pdf.exe 2024-07-06 22:08:03 d90a72256615ac3ba74c924012fea42c
igccu.exe 2024-07-07 11:50:03 c3ebea7cd7e96887d0fffff22bf00101
igccu.exe 2024-07-07 13:54:04 7e65b6742284236fdd138467fad4a26b
notebyx.exe 2024-09-05 18:25:03 7a8463b22eb60bf18f4df8444e006d96
abQOhgu.exe 2024-09-05 18:26:03 387d4b12ac9e87b9db76589fcca2b937
d4eb98701bc0c33b5f9c3e202bf55c1b2e2cb1c1e4b7c81ad6305d7938d0f959.exe.exe 2024-09-28 23:06:04 7b793a4247b701bd24c86920b237acd0
e05adb9434907f4eb8d318c414ced92c177236d5f28d4e2814bbe5719a38fa27.exe.exe 2024-09-30 18:29:04 e9d7eea6b6f3734d4f1f79f0ecf22429
6e99f41ac17bbbcfbb0bcd6ea1f2b3a9c7b659981ff6da15ff24d44385d58f3b.exe.exe 2024-09-30 18:41:04 e7077a89901f62b2ef9559d7631d02c0
win10key.exe 2024-10-15 18:43:03 11205f15a2dc7c76c9bd555d4163f80d