Static task
static1
Behavioral task
behavioral1
Sample
cs.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cs.exe
Resource
win10v2004-20221111-en
General
-
Target
cs.exe
-
Size
332KB
-
MD5
9f58be8d27bef7912e54734c9011e5dd
-
SHA1
3f788e3c803849ffeacdd3bd315a73ffd7555237
-
SHA256
d68fc328e4aafbb35d64f35ee9534d0b3a8b36cd9f2c6f36d495cf44937d1f8c
-
SHA512
ac57c5d990666bf81e23ae95cb43274f6b25f2314832ae33477cca1dfef2bc62b772dfab0e51e70aa1d686e50e405b49fbe96b677e611d61475c6b273d44222e
-
SSDEEP
6144:GP9MaWrlGNejO7RXBLzS+2hI6dT9ohpGfjlj:P7r1O7RxLa7d5oi
Malware Config
Signatures
Files
-
cs.exe.exe windows x64
d64cd1a933fef02408755e827f688889
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
VirtualProtect
VirtualFree
LoadLibraryExA
WaitForSingleObject
OpenProcess
CreateEventW
Sleep
K32GetModuleFileNameExA
SetEvent
GetCurrentThread
CloseHandle
GetSystemInfo
CreateThread
ResetEvent
AddVectoredExceptionHandler
GetProcAddress
GetCurrentProcessId
GetConsoleWindow
K32EnumProcessModules
VirtualQuery
WriteFile
CreateFileW
CreateToolhelp32Snapshot
GetTickCount64
Process32NextW
Process32FirstW
GetModuleHandleW
VirtualQueryEx
GetLastError
GetCurrentProcess
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtectEx
SetLastError
FreeLibrary
LoadLibraryExW
WriteConsoleW
SetEndOfFile
HeapSize
GetFileAttributesExW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
GetExitCodeProcess
CreateProcessW
HeapReAlloc
RtlUnwind
user32
MessageBoxW
ShowWindow
shlwapi
PathFindFileNameA
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
NtQuerySystemInformation
wininet
InternetReadFile
InternetOpenW
HttpSendRequestA
InternetOpenUrlW
InternetCloseHandle
Sections
.text Size: 222KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ