Behavioral task
behavioral1
Sample
1920-55-0x0000000000370000-0x00000000003C2000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1920-55-0x0000000000370000-0x00000000003C2000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1920-55-0x0000000000370000-0x00000000003C2000-memory.dmp
-
Size
328KB
-
MD5
92ceaefe1fbcb74159d424e489a8dc2c
-
SHA1
f9b489b0f9f848268e5707c6b384041a7dc626e8
-
SHA256
d200b47d9a3ea337bd3061d15d92803bed129aa039b2c8844fe15c42a16a8c5a
-
SHA512
579329715fb8f2f3290803cf889a81f147280f162154e11299a9a24f4da0e09c3adef0c39889fa0c57fd0080f93683db897818893218bdf01a51061c5c2c7189
-
SSDEEP
3072:rzbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnLaeV0YJj6vzHkgZYJrv:rzbUWootfDCvT4ZTXzCL30J4rKM
Malware Config
Signatures
-
Cobaltstrike family
Files
-
1920-55-0x0000000000370000-0x00000000003C2000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ