af966453f1ce9960104bdd2664a2db90ea831d06ca099ac89d9921b2bcd0c6a2

Sharing

Copy URL

Twitter E-mail

Reason

config extraction: CobaltStrike64: cobaltstrike: $reflective_dll not found

General

Target

af966453f1ce9960104bdd2664a2db90ea831d06ca099ac89d9921b2bcd0c6a2
Size

251KB
MD5

708dbc116b93904d87526bf6d08138ad
SHA1

f65ecb86950c2e308d60e736e8a904d673068d28
SHA256

af966453f1ce9960104bdd2664a2db90ea831d06ca099ac89d9921b2bcd0c6a2
SHA512

655b9382d0c29e612122a759ef2df2aaf6951cc967bc49314d3f6a3734d914198c2ebc7e9b4fa0072242eb6f78d4798537a8ab3176874315dd7a16b9400b6970
SSDEEP

6144:TXt8VaLuxvxL4IaOT6tEm93WfwM31tOK+e:TaVaLavxsIa3nGP31n9

Score

N/A

Malware Config

Signatures

Files

af966453f1ce9960104bdd2664a2db90ea831d06ca099ac89d9921b2bcd0c6a2
.dll windows x64

e2815d998dd6166b20b250ae29a3b3e0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CopyFileA
MoveFileA
VirtualAlloc
VirtualProtect
VirtualAllocEx
VirtualProtectEx
HeapAlloc
HeapFree
GetProcessHeap
CreateRemoteThread
WriteProcessMemory
DuplicateHandle
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
ProcessIdToSessionId
FreeLibrary
SetLastError
GetThreadContext
SetThreadContext
Wow64GetThreadContext
Wow64SetThreadContext
ResumeThread
CreateToolhelp32Snapshot
SetNamedPipeHandleState
PeekNamedPipe
WaitNamedPipeA
LocalAlloc
LocalFree
FindNextFileA
TerminateProcess
Process32First
Process32Next
FindFirstFileA
GetFileAttributesA
ExpandEnvironmentStringsA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindClose
GetLogicalDrives
GetFullPathNameA
GetVersionExA
CreateNamedPipeA
GetModuleHandleA
ConnectNamedPipe
ReadFile
GetCurrentThread
CreateThread
GetCurrentProcess
GetProcAddress
CreateFileA
GetCurrentDirectoryW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetEnvironmentVariableA
GetStartupInfoA
CreateProcessA
DisconnectNamedPipe
CreatePipe
CloseHandle
SetFileTime
GetFileTime
FlushFileBuffers
SetEnvironmentVariableA
WriteFile
WaitForSingleObject
GetLastError
SetEndOfFile
CreateFileW
SetEnvironmentVariableW
VirtualQuery
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
CompareStringW
HeapReAlloc
HeapSize
OutputDebugStringW
LoadLibraryW
RaiseException
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
RemoveDirectoryW
CreateDirectoryW
DeleteFileW
GetFileType
SetFilePointerEx
SetFilePointer
OpenProcess
GetTickCount
GetLocalTime
Sleep
GetComputerNameA
GetCurrentProcessId
ReadConsoleW
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
LoadLibraryExW
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo

advapi32

GetUserNameA
CreateProcessAsUserA
CreateProcessWithLogonW
CreateProcessWithTokenW
CloseServiceHandle
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
CheckTokenMembership
DuplicateTokenEx
LogonUserA
LookupAccountSidA
FreeSid
AllocateAndInitializeSid
GetTokenInformation
RevertToSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenProcessToken
QueryServiceStatusEx
OpenServiceA
ControlService
ImpersonateLoggedOnUser
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenThreadToken
ImpersonateNamedPipeClient
StartServiceA
QueryServiceStatus
OpenSCManagerA
DeleteService
CreateServiceA

wininet

InternetOpenA
InternetCloseHandle
InternetConnectA
InternetReadFile
InternetQueryDataAvailable
InternetQueryOptionA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetSetOptionA

ws2_32

ntohs
socket
send
htons
__WSAFDIsSet
closesocket
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_ntoa
htonl
ntohl
accept
bind
ioctlsocket
listen
recv
select
shutdown
WSAGetLastError
inet_addr
connect

dnsapi

DnsQuery_A
DnsFree

iphlpapi

GetIfEntry
GetIpAddrTable

secur32

LsaConnectUntrusted
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage

Exports

Exports

ReflectiveLoader

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

e2815d998dd6166b20b250ae29a3b3e0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

wininet

ws2_32

dnsapi

iphlpapi

secur32

Exports

Exports

Sections

.text Size: 165KB - Virtual size: 164KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 10KB - Virtual size: 72KB

.pdata Size: 7KB - Virtual size: 7KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 165KB - Virtual size: 164KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 10KB - Virtual size: 72KB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 3KB