ReflectiveLoader
Static task
static1
Behavioral task
behavioral1
Sample
0be1c7e075bd94a9bb7c346f16e6767259cc0feeddcef327c4635dbb4d220194.dll
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
0be1c7e075bd94a9bb7c346f16e6767259cc0feeddcef327c4635dbb4d220194.dll
Resource
win10v2004-20220310-en
General
-
Target
0be1c7e075bd94a9bb7c346f16e6767259cc0feeddcef327c4635dbb4d220194
-
Size
257KB
-
MD5
7dbec1319ed3055cdff02b344b1156c5
-
SHA1
71d0a70cc17822ebdc74b123c91c97114a5ef055
-
SHA256
0be1c7e075bd94a9bb7c346f16e6767259cc0feeddcef327c4635dbb4d220194
-
SHA512
920610bd92628903fb37a42db1a5b8a93412d8549f8b6735fbe75ac9b1b1e7b62ba469873d39266a85aa169ae6c67b41df3f7f7bec59fe4af6d79406a882f5b6
Malware Config
Extracted
cobaltstrike
1
http://97.64.41.151:443/updates.rss
-
access_type
512
-
beacon_type
2048
-
host
97.64.41.151,/updates.rss
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCankoBq5UDnhgUxF0OfEVJTPPf6HPFu8auEwzgBrE+/siaMDiTpCHeGYGtv5KDOupG2vMFiV79iOTIKvvEHH9MP1VBGjAzPWnVWfj1w+h5fnXOWJWyJGSz9om1ezOYU7904YHx1pm6F5Ag0+9SB740PuaSWUEhrDfU6x7dpyo6GQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MATM)
-
watermark
1
Signatures
-
Cobaltstrike family
Files
-
0be1c7e075bd94a9bb7c346f16e6767259cc0feeddcef327c4635dbb4d220194.dll windows x64
b3fb86001908c53f2eb7c4d62ac6612a
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FindNextFileA
CopyFileA
MoveFileA
VirtualProtect
VirtualAlloc
VirtualAllocEx
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcessId
CreateThread
CreateRemoteThread
DuplicateHandle
LoadLibraryA
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
ProcessIdToSessionId
Wow64GetThreadContext
Wow64
SetLastError
SetNamedPipeHandleState
PeekNamedPipe
WaitNamedPipeA
LocalAlloc
LocalFree
GetComputerNameA
GetVersionExA
GetACP
GetOEMCP
CreateToolhelp32Snapshot
Process32First
FindFirstFileA
VirtualFree
ExitProcess
GetFileAttributesA
ExpandEnvironmentStringsA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindClose
GetLogicalDrives
GetFullPathNameA
CreateProcessA
ResumeThread
GetThreadContext
WriteProcessMemory
ReadProcessMemory
TerminateProcess
VirtualProtectEx
CreateNamedPipeA
GetModuleHandleA
ConnectNamedPipe
ReadFile
GetCurrentThread
GetCurrentProcess
GetProcAddress
MultiByteToWideChar
CreateFileA
GetCurrentDirectoryW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetStartupInfoA
DisconnectNamedPipe
CreatePipe
GetTickCount
GetLocalTime
CloseHandle
SetFileTime
RaiseException
VirtualQuery
SetEnvironmentVariableW
SetEnvironmentVariableA
GetFileTime
FlushFileBuffers
WriteFile
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
CompareStringW
HeapReAlloc
HeapSize
LoadLibraryW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
RemoveDirectoryW
CreateDirectoryW
DeleteFileW
GetFileType
WaitForSingleObject
GetLastError
OpenProcess
Sleep
Process32Next
SetFilePointerEx
SetFilePointer
ReadConsoleW
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetModuleHandleExW
AreFileApisANSI
GetCommandLineA
GetCurrentThreadId
GetStdHandle
GetModuleFileNameW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
RtlUnwindEx
IsValidCodePage
GetCPInfo
WideCharToMultiByte
GetConsoleCP
advapi32
RegOpenCurrentUser
CreateProcessWithLogonW
CloseServiceHandle
CreateServiceA
DeleteService
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
CheckTokenMembership
DuplicateTokenEx
LogonUserA
LookupAccountSidA
FreeSid
AllocateAndInitializeSid
GetTokenInformation
RevertToSelf
RegOpenKeyExA
RegEnumValueA
RegEnumKeyA
OpenProcessToken
RegCloseKey
GetUserNameA
CreateProcessWithTokenW
CreateProcessAsUserA
QueryServiceStatusEx
OpenServiceA
ControlService
ImpersonateLoggedOnUser
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenThreadToken
ImpersonateNamedPipeClient
StartServiceA
QueryServiceStatus
OpenSCManagerA
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetQueryDataAvailable
InternetQueryOptionA
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetConnectA
ws2_32
socket
send
htons
connect
ntohs
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_ntoa
htonl
ntohl
ioctlsocket
recv
shutdown
WSAGetLastError
__WSAFDIsSet
accept
bind
listen
select
closesocket
dnsapi
DnsQuery_A
DnsFree
iphlpapi
GetIfEntry
GetIpAddrTable
secur32
LsaConnectUntrusted
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
Exports
Exports
Sections
.text Size: 170KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ