Behavioral task
behavioral1
Sample
520-90-0x00000000056D0000-0x0000000005711000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
520-90-0x00000000056D0000-0x0000000005711000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
520-90-0x00000000056D0000-0x0000000005711000-memory.dmp
-
Size
260KB
-
MD5
11227a1eba14420b85f673e244ba7b79
-
SHA1
17767b0493ea169568d9bdf5a724eb301a5ba868
-
SHA256
9733f114f3e9f6a66cf980993480002dbdc661c008e180ee099ae8cde4f33737
-
SHA512
f29775479a2c45a8dbb0e4df8191b8037dda04ad2e688178298a85146fefd90971b8509461e2859afcf30ee66d096e943937cf5a8bfe90fd4169ed1b126a52f6
-
SSDEEP
3072:JchA951pSyIjSWtSX8IYGvLahv+KuMInNMzgr/ML4DAGVjlUm5ScSBS:JchWFSSW08IbvI+/MYaFL4DNjw
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
Processes:
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
Files
-
520-90-0x00000000056D0000-0x0000000005711000-memory.dmp.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 153KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ