_ReflectiveLoader@4
Behavioral task
behavioral1
Sample
3d9bd652e10399b0f12b33ea5e46fe8edefa6b0e732fb5e3e083bb1347d41f50.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3d9bd652e10399b0f12b33ea5e46fe8edefa6b0e732fb5e3e083bb1347d41f50.dll
Resource
win10v2004-20230703-en
General
-
Target
3d9bd652e10399b0f12b33ea5e46fe8edefa6b0e732fb5e3e083bb1347d41f50
-
Size
205KB
-
MD5
f14355ca2b1edca99e011dd7e4adc231
-
SHA1
f7b43a31f54a372a1365d2608d2ea7b83a7b45d7
-
SHA256
3d9bd652e10399b0f12b33ea5e46fe8edefa6b0e732fb5e3e083bb1347d41f50
-
SHA512
ec6963a8a7780f32e72caadfb4faa217e082f7e8bb32f11fbc940475f3ec1f246611e546c0d13f5cb68ea09abee729789189272576aed33e41dfd7612da3b010
-
SSDEEP
3072:bYXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtOelL5euN:8Xkiq4wfv4Kjnv+srwokv
Malware Config
Extracted
cobaltstrike
0
http://10.0.6.155:445/j.ad
-
access_type
512
-
crypto_scheme
256
-
host
10.0.6.155,/j.ad
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
60000
-
port_number
445
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUsiQ/BNc/cEobDgW1agotE2IrVgBeJhhOFvmsLfw+i/z3DMZ1kVbJ8PSmBHyDSp7udn6la9vOwEQO7wHbilzqEWgeBPO3xOhl8cHIc92UuOJtQXGfDt17BYqY7wY7jXRxM3aoXlFvFCEZ3Pr7j1xwvdNZE1J8xCcKKsvSm2lwBQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch; ASU2JS)
-
watermark
0
Signatures
-
Cobaltstrike family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d9bd652e10399b0f12b33ea5e46fe8edefa6b0e732fb5e3e083bb1347d41f50
Files
-
3d9bd652e10399b0f12b33ea5e46fe8edefa6b0e732fb5e3e083bb1347d41f50.dll windows x86
0bc418575efc832b308d227b31192688
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
UpdateProcThreadAttribute
HeapFree
GetProcessHeap
CreateRemoteThread
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
LoadLibraryA
ProcessIdToSessionId
DuplicateHandle
InitializeProcThreadAttributeList
WriteProcessMemory
CreateThread
GetThreadContext
SetThreadContext
FreeLibrary
VirtualFree
Thread32First
Thread32Next
SetLastError
OpenThread
CreateToolhelp32Snapshot
GetVersionExA
SuspendThread
ResumeThread
PeekNamedPipe
WaitNamedPipeA
SetNamedPipeHandleState
LocalAlloc
LocalFree
GetComputerNameA
Process32First
TerminateProcess
HeapAlloc
ExitProcess
DeleteProcThreadAttributeList
VirtualProtect
FindNextFileA
MoveFileA
FindClose
CopyFileA
FindFirstFileA
FileTimeToSystemTime
GetFileAttributesA
ExpandEnvironmentStringsA
GetLogicalDrives
SystemTimeToTzSpecificLocalTime
GetFullPathNameA
GetModuleHandleA
CreateNamedPipeA
GetProcAddress
ReadFile
GetCurrentThread
ConnectNamedPipe
GetCurrentProcess
CloseHandle
GetFileTime
GetCurrentDirectoryA
CreatePipe
GetCurrentDirectoryW
GetLastError
GetStartupInfoA
SetCurrentDirectoryA
FlushFileBuffers
DisconnectNamedPipe
MultiByteToWideChar
CreateProcessA
OpenProcess
WriteFile
SetFileTime
WaitForSingleObject
SetEnvironmentVariableW
CreateFileA
Sleep
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
VirtualQuery
GetModuleFileNameW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
HeapSize
IsValidCodePage
GetCPInfo
DebugBreak
RaiseException
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentProcessId
GetOEMCP
GetLocalTime
GetACP
Process32Next
GetTickCount
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
GetFileType
GetModuleHandleW
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
GetCurrentThreadId
GetCommandLineA
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
advapi32
RegEnumValueA
CloseServiceHandle
OpenProcessToken
CreateProcessWithLogonW
DeleteService
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
LogonUserA
CheckTokenMembership
FreeSid
RevertToSelf
AllocateAndInitializeSid
DuplicateTokenEx
LookupAccountSidA
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyA
CreateProcessAsUserA
RegOpenCurrentUser
RegOpenKeyExA
GetUserNameA
AdjustTokenPrivileges
ControlService
QueryServiceStatusEx
ImpersonateNamedPipeClient
ImpersonateLoggedOnUser
LookupPrivilegeValueA
OpenThreadToken
OpenServiceA
OpenSCManagerA
QueryServiceStatus
CreateProcessWithTokenW
StartServiceA
CreateServiceA
wininet
HttpQueryInfoA
InternetQueryDataAvailable
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetQueryOptionA
InternetConnectA
ws2_32
ntohs
connect
htons
socket
accept
send
gethostname
inet_ntoa
WSAStartup
WSACleanup
gethostbyname
htonl
ntohl
listen
__WSAFDIsSet
bind
recv
shutdown
WSAGetLastError
select
ioctlsocket
inet_addr
closesocket
dnsapi
DnsFree
DnsQuery_A
iphlpapi
GetIfEntry
GetIpAddrTable
secur32
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaLookupAuthenticationPackage
Exports
Exports
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ