ReflectiveLoader
Static task
static1
Behavioral task
behavioral1
Sample
223ac4d7fab0509853ba8186d3f5b229b70ce6419c014f7d5b822a46d5309867.dll
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
223ac4d7fab0509853ba8186d3f5b229b70ce6419c014f7d5b822a46d5309867.dll
Resource
win10v2004-en-20220113
General
-
Target
223ac4d7fab0509853ba8186d3f5b229b70ce6419c014f7d5b822a46d5309867
-
Size
260KB
-
MD5
2a5e37c41fed15c20bbcbc34d43dd2aa
-
SHA1
9a6cc365d3ecebbf7ef9e75e7e810cba7bd711ec
-
SHA256
223ac4d7fab0509853ba8186d3f5b229b70ce6419c014f7d5b822a46d5309867
-
SHA512
5a7c6e24e0708241d61bca4c9e74b59bff646ceb5dba8df2e4e1025ce66025d363f0f53ae1d4facfea92913d9990a78fa7e0cd98c879736551eb5824ed605de8
Malware Config
Extracted
cobaltstrike
1873433027
http://144.202.113.237:80/ca
-
access_type
512
-
host
144.202.113.237,/ca
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
80
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCiWxUsos2cNsbKGY594FiixuYl43pV0DTAtPMBsC/lqL+KJNUlGp+0dLHrx4gVAGdqvGBdF/nxC2/rS2ed5miUpyz+xzten62ViGhzqtV6zEY0zTV5m1oKz55t1/fEFQNCs8HR2IBOLhNamGxHphEg0VPHtHyb+7DNseHdr3d18QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; .NET CLR 2.0.50727)
-
watermark
1873433027
Signatures
-
Cobaltstrike family
Files
-
223ac4d7fab0509853ba8186d3f5b229b70ce6419c014f7d5b822a46d5309867.dll windows x64
5d58634383b49de64bde0ee76012a61a
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FindNextFileA
CopyFileA
MoveFileA
VirtualProtect
VirtualAllocEx
GetCurrentProcessId
CreateRemoteThread
LoadLibraryA
CreateThread
OpenThread
CreateToolhelp32Snapshot
Thread32First
Thread32Next
SetThreadContext
VirtualAlloc
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
Wow64GetThreadContext
Wow64SetThreadContext
SetLastError
SetNamedPipeHandleState
PeekNamedPipe
WaitNamedPipeA
LocalAlloc
LocalFree
GetComputerNameA
GetVersionExA
GetACP
GetOEMCP
HeapAlloc
HeapFree
GetProcessHeap
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
SetErrorMode
UpdateProcThreadAttribute
DuplicateHandle
FindFirstFileA
Process32First
Process32Next
VirtualFree
VirtualQuery
ExitProcess
GetFileAttributesA
ExpandEnvironmentStringsA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindClose
GetLogicalDrives
GetFullPathNameA
CreateProcessA
ResumeThread
GetThreadContext
WriteProcessMemory
ReadProcessMemory
TerminateProcess
VirtualProtectEx
CreateNamedPipeA
GetModuleHandleA
ConnectNamedPipe
ReadFile
GetCurrentThread
GetCurrentProcess
GetProcAddress
MultiByteToWideChar
CreateFileA
GetCurrentDirectoryW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetStartupInfoA
DisconnectNamedPipe
CreatePipe
GetTickCount
GetLocalTime
CloseHandle
RaiseException
SetEnvironmentVariableW
SetEnvironmentVariableA
SetFileTime
GetFileTime
FlushFileBuffers
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
CompareStringW
HeapReAlloc
HeapSize
LoadLibraryW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
RemoveDirectoryW
CreateDirectoryW
DeleteFileW
GetFileType
SetFilePointerEx
SetFilePointer
WriteFile
WaitForSingleObject
GetLastError
OpenProcess
Sleep
ProcessIdToSessionId
ReadConsoleW
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetModuleHandleExW
AreFileApisANSI
GetCommandLineA
GetCurrentThreadId
GetStdHandle
GetModuleFileNameW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
RtlUnwindEx
IsValidCodePage
GetCPInfo
advapi32
CheckTokenMembership
CreateProcessWithLogonW
CloseServiceHandle
CreateServiceA
DeleteService
OpenSCManagerA
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
DuplicateTokenEx
LogonUserA
LookupAccountSidA
FreeSid
AllocateAndInitializeSid
GetTokenInformation
RevertToSelf
RegOpenKeyExA
RegEnumValueA
RegEnumKeyA
RegOpenCurrentUser
RegCloseKey
GetUserNameA
CreateProcessWithTokenW
CreateProcessAsUserA
QueryServiceStatusEx
OpenServiceA
ControlService
ImpersonateLoggedOnUser
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenThreadToken
ImpersonateNamedPipeClient
StartServiceA
QueryServiceStatus
OpenProcessToken
wininet
InternetOpenA
InternetConnectA
InternetReadFile
InternetQueryDataAvailable
InternetQueryOptionA
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetCloseHandle
ws2_32
send
htons
connect
WSACleanup
socket
gethostname
gethostbyname
inet_ntoa
htonl
ntohl
ntohs
ioctlsocket
recv
shutdown
WSAGetLastError
__WSAFDIsSet
accept
bind
listen
WSAStartup
select
closesocket
dnsapi
DnsQuery_A
DnsFree
iphlpapi
GetIpAddrTable
GetIfEntry
secur32
LsaConnectUntrusted
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
Exports
Exports
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ