Behavioral task
behavioral1
Sample
2032-55-0x0000000000550000-0x000000000058E000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2032-55-0x0000000000550000-0x000000000058E000-memory.dll
Resource
win10v2004-20230221-en
General
-
Target
2032-55-0x0000000000550000-0x000000000058E000-memory.dmp
-
Size
248KB
-
MD5
38afa3fe4dd6ba0fda8b5d768de2d8e6
-
SHA1
f8a1942acf7fb50e587decdf05b8d3db7dbbfe4a
-
SHA256
d4272f8cc7a8c0ad18068c6d007adc14f65fefc921809b93b74f6da94e347d3d
-
SHA512
311df9d8fdd6322df9a7429ae3841423018b26870889d9b8cb7ce38a3ab25e8ed1adb59047c12391de109535471a0fa9ae119bb42ad4a0eb5e677a1cf5286fe1
-
SSDEEP
3072:byqtZXXue7yhOHpPs8CchzHH+KPsStPwipg4t//BuZjdUg5Ut8j:b5XusyEU8CG6KPltl9t//wju
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule sample cobalt_reflective_dll -
Cobaltstrike family
Files
-
2032-55-0x0000000000550000-0x000000000058E000-memory.dmp.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ