ReflectiveLoader
Static task
static1
Behavioral task
behavioral1
Sample
4a81775722b5eebb22e2b0c6da031ad47445c464aeb052ed36cce6765841e37b.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4a81775722b5eebb22e2b0c6da031ad47445c464aeb052ed36cce6765841e37b.dll
Resource
win10v2004-20220414-en
General
-
Target
4a81775722b5eebb22e2b0c6da031ad47445c464aeb052ed36cce6765841e37b
-
Size
257KB
-
MD5
4d8724800f3829b5a86a656e4097c1fe
-
SHA1
0c06a03d67b7e1f608ecd6a505d8786c424ccfbe
-
SHA256
4a81775722b5eebb22e2b0c6da031ad47445c464aeb052ed36cce6765841e37b
-
SHA512
8d3bcf55dae6abdd9651c7e407198b90e5b120d2d00ae815fca66f2f8a93b211235fe93cfd10c2ba169b506eb169c3c8ab320151aebb7008ba805aa6da2cd8a0
-
SSDEEP
3072:T7gxjmVNvK8UNiHIw7zGy3fVMzJa1KGhDVTzD49vPWO/M0/d0gHYJqDKUb:T7griHTHPKz0RTH83h/McHR
Malware Config
Extracted
cobaltstrike
0
http://154.223.177.194:8989/en_US/all.js
-
access_type
512
-
crypto_scheme
256
-
host
154.223.177.194,/en_US/all.js
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
polling_time
60000
-
port_number
8989
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMD0ch9nklHEnL+WKz/ZrA/ier0gvwTB57ObCRSoAg/7Ehy9LAUxqj7fGZENAC1GkQO9VMVTJpw1gBQBtxvn/Y8GrvPXxZAcIGyqpUuT1D03dE3EsxG3/LdkRhG3KYfoBhibTmqy17ZIxXnqBMShb7RH2hqfXRJdjW664s8+r9SwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
-
watermark
0
Signatures
-
Cobaltstrike family
Files
-
4a81775722b5eebb22e2b0c6da031ad47445c464aeb052ed36cce6765841e37b.dll windows x64
b3fb86001908c53f2eb7c4d62ac6612a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FindNextFileA
CopyFileA
MoveFileA
VirtualProtect
VirtualAlloc
VirtualAllocEx
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcessId
CreateThread
CreateRemoteThread
DuplicateHandle
LoadLibraryA
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
ProcessIdToSessionId
Wow64GetThreadContext
Wow64
SetLastError
SetNamedPipeHandleState
PeekNamedPipe
WaitNamedPipeA
LocalAlloc
LocalFree
GetComputerNameA
GetVersionExA
GetACP
GetOEMCP
CreateToolhelp32Snapshot
Process32First
FindFirstFileA
VirtualFree
ExitProcess
GetFileAttributesA
ExpandEnvironmentStringsA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindClose
GetLogicalDrives
GetFullPathNameA
CreateProcessA
ResumeThread
GetThreadContext
WriteProcessMemory
ReadProcessMemory
TerminateProcess
VirtualProtectEx
CreateNamedPipeA
GetModuleHandleA
ConnectNamedPipe
ReadFile
GetCurrentThread
GetCurrentProcess
GetProcAddress
MultiByteToWideChar
CreateFileA
GetCurrentDirectoryW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetStartupInfoA
DisconnectNamedPipe
CreatePipe
GetTickCount
GetLocalTime
CloseHandle
SetFileTime
RaiseException
VirtualQuery
SetEnvironmentVariableW
SetEnvironmentVariableA
GetFileTime
FlushFileBuffers
WriteFile
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
CompareStringW
HeapReAlloc
HeapSize
LoadLibraryW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
RemoveDirectoryW
CreateDirectoryW
DeleteFileW
GetFileType
WaitForSingleObject
GetLastError
OpenProcess
Sleep
Process32Next
SetFilePointerEx
SetFilePointer
ReadConsoleW
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetModuleHandleExW
AreFileApisANSI
GetCommandLineA
GetCurrentThreadId
GetStdHandle
GetModuleFileNameW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
RtlUnwindEx
IsValidCodePage
GetCPInfo
WideCharToMultiByte
GetConsoleCP
advapi32
RegOpenCurrentUser
CreateProcessWithLogonW
CloseServiceHandle
CreateServiceA
DeleteService
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
CheckTokenMembership
DuplicateTokenEx
LogonUserA
LookupAccountSidA
FreeSid
AllocateAndInitializeSid
GetTokenInformation
RevertToSelf
RegOpenKeyExA
RegEnumValueA
RegEnumKeyA
OpenProcessToken
RegCloseKey
GetUserNameA
CreateProcessWithTokenW
CreateProcessAsUserA
QueryServiceStatusEx
OpenServiceA
ControlService
ImpersonateLoggedOnUser
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenThreadToken
ImpersonateNamedPipeClient
StartServiceA
QueryServiceStatus
OpenSCManagerA
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetQueryDataAvailable
InternetQueryOptionA
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetConnectA
ws2_32
socket
send
htons
connect
ntohs
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_ntoa
htonl
ntohl
ioctlsocket
recv
shutdown
WSAGetLastError
__WSAFDIsSet
accept
bind
listen
select
closesocket
dnsapi
DnsQuery_A
DnsFree
iphlpapi
GetIfEntry
GetIpAddrTable
secur32
LsaConnectUntrusted
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
Exports
Exports
Sections
.text Size: 170KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ