ReflectiveLoader
General
-
Target
1672-56-0x0000000000590000-0x00000000005D1000-memory.dmp
-
Size
260KB
-
MD5
9a9d1513897619233a185b1960a71751
-
SHA1
f9c7b4b9806fd7a0552928d42cd09bc84a9dedc6
-
SHA256
fd2aca257fdf19d1e1f07d59f1b1ed0cd8082f8af0f971972f27bb53a6cde062
-
SHA512
474e17ed46311e957388889386a4c5eeb3f2bc17e0d9e0ca5acc5a126a3ff6277ab4d53b3e94986cf5669ba5868f8cdfa7adf0d49a082383e919764b72e6edad
-
SSDEEP
3072:RsYckn3Xzq4IDwSK2Mbn/gprEJwJNJsCwQTIfXouPruOOTR219BQYJerCoXL:RsYwjwIGIprEJweGTIDjhOTRCQ8s
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
Botnet
0
C2
http://werewolves.su:443/poll
Attributes
-
access_type
512
-
beacon_type
2048
-
host
werewolves.su,/poll
-
http_header1
AAAACgAAABVYLUN1c3RvbS1QU0s6IDEyMzQ1NjcAAAAHAAAAAAAAAA0AAAAIAAAADQAAAAUAAAAFdG9rZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACQAAAB5hY3Rpb249R2V0RXh0ZW5zaWJpbGl0eUNvbnRleHQAAAAKAAAALUNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vanNvbjsgY2hhcnNldD11dGYtOAAAAAoAAAAQUHJhZ21hOiBuby1jYWNoZQAAAAoAAAAVWC1DdXN0b20tUFNLOiAxMjM0NTY3AAAABwAAAAAAAAAFAAAABXRva2VuAAAABwAAAAEAAAAPAAAAAwAAAAIAAAAZeyJ2ZXJzaW9uIjoiMiIsInJlcG9ydCI6IgAAAAEAAAACIn0AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoF8VZjxm15ziTwzdE+jW+r54e9S60MKgSH1OnPssSGh0CIiVo7hbwzHllXOcl8eWvZAn87FQZoz48ftehl+MGybvk8Zpi6riqha7Mp4kHj+dELTMYxrt+YeDLb2TQEr7Z7E8pK+ldsWvyBiSuV4bK0xhEJ17M1hjbrrjjNJ574QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.102727936e+09
-
unknown2
AAAABAAAAAEAAAACAAAAAgAAACMAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/upload
-
user_agent
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; BTRS125526)
-
watermark
0
Signatures
-
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1672-56-0x0000000000590000-0x00000000005D1000-memory.dmp
bd0c83d6821617ef54f9b1da8449e4a3
Headers
Imports
Exports
Sections