_ReflectiveLoader@4
Static task
static1
Behavioral task
behavioral1
Sample
015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b.dll
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b.dll
Resource
win10v2004-20220310-en
General
-
Target
015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b
-
Size
208KB
-
MD5
b9633de88b7e0f25893cb43a878aa2b6
-
SHA1
9de65ed6b6de7c28077189b1fb8c2cab06f83808
-
SHA256
015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b
-
SHA512
96df62fe3fc4db59cc1de67c36567de39bb5f5c55318bd32b35b49b9042eac37aebd03d1889ae40021b9fa673a6ddf4e59b4387202ce213c6880df41c3d4d498
Malware Config
Extracted
cobaltstrike
1873433027
http://108.61.160.9:443/fwlink
-
access_type
512
-
beacon_type
2048
-
host
108.61.160.9,/fwlink
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCq3Z45eGoXqw1qI2HXzUJDk2UvoR7SNe0ds00fVF7bTw6r8TQH20ZMF0eW3ONdzKMHBJVbBSpSys67mKUdsRd07K/JgQed9N7FcA2rW6hEnExh4BFLG/cMBPgLFh6ImG5kdEBZIrSp0CLJAlPQOw/QBZq44ZPM8pyPHv/ANp8IZwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)
-
watermark
1873433027
Signatures
-
Cobaltstrike family
Files
-
015023eca9b453647fb666de2d78ffa308cf284717f134e54dd0528229cef53b.dll windows x86
7fa9c4c247b9d54feb65b7fae02f433a
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FindClose
MoveFileA
FindNextFileA
VirtualProtect
CreateRemoteThread
VirtualAllocEx
LoadLibraryA
GetCurrentProcessId
Thread32First
Thread32Next
OpenThread
CreateToolhelp32Snapshot
CreateThread
SetThreadContext
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
CreateFileMappingA
VirtualFree
SetLastError
GetVersionExA
PeekNamedPipe
WaitNamedPipeA
SetNamedPipeHandleState
LocalAlloc
LocalFree
GetComputerNameA
GetACP
GetOEMCP
DeleteProcThreadAttributeList
HeapAlloc
HeapFree
GetProcessHeap
InitializeProcThreadAttributeList
SetErrorMode
UpdateProcThreadAttribute
ProcessIdToSessionId
CopyFileA
Process32First
Process32Next
VirtualQuery
ExitProcess
FindFirstFileA
FileTimeToSystemTime
GetFileAttributesA
ExpandEnvironmentStringsA
GetLogicalDrives
SystemTimeToTzSpecificLocalTime
GetFullPathNameA
ResumeThread
WriteProcessMemory
VirtualProtectEx
TerminateProcess
CreateProcessA
ReadProcessMemory
GetThreadContext
GetModuleHandleA
CreateNamedPipeA
GetProcAddress
ReadFile
GetCurrentThread
ConnectNamedPipe
GetCurrentProcess
CloseHandle
GetFileTime
GetCurrentDirectoryA
CreatePipe
GetLocalTime
GetCurrentDirectoryW
GetLastError
GetStartupInfoA
SetCurrentDirectoryA
FlushFileBuffers
DisconnectNamedPipe
DebugBreak
RaiseException
SetEnvironmentVariableW
MultiByteToWideChar
OpenProcess
WriteFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
HeapSize
IsValidCodePage
GetCPInfo
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFileTime
GetTickCount
WaitForSingleObject
CreateFileA
Sleep
DuplicateHandle
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
GetFileType
GetModuleHandleW
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
GetCurrentThreadId
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
FreeLibrary
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetModuleFileNameW
advapi32
OpenProcessToken
CreateProcessWithLogonW
DeleteService
CreateServiceA
StartServiceA
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
LogonUserA
CheckTokenMembership
FreeSid
RevertToSelf
AllocateAndInitializeSid
DuplicateTokenEx
LookupAccountSidA
GetTokenInformation
RegCloseKey
RegEnumKeyA
RegEnumValueA
RegOpenCurrentUser
RegOpenKeyExA
GetUserNameA
CreateProcessWithTokenW
CreateProcessAsUserA
AdjustTokenPrivileges
ControlService
QueryServiceStatusEx
ImpersonateNamedPipeClient
ImpersonateLoggedOnUser
LookupPrivilegeValueA
OpenThreadToken
OpenServiceA
OpenSCManagerA
QueryServiceStatus
CloseServiceHandle
wininet
HttpQueryInfoA
InternetQueryDataAvailable
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetQueryOptionA
InternetConnectA
ws2_32
htons
socket
closesocket
gethostname
connect
WSAStartup
WSACleanup
gethostbyname
htonl
ntohl
ntohs
recv
shutdown
WSAGetLastError
ioctlsocket
accept
listen
__WSAFDIsSet
bind
inet_ntoa
select
send
dnsapi
DnsFree
DnsQuery_A
iphlpapi
GetIpAddrTable
GetIfEntry
secur32
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaLookupAuthenticationPackage
Exports
Exports
Sections
.text Size: 150KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ