sessionmanager | Iisbgfhaciadc1_browsingDll[.]dll

General

Target
Iisbgfhaciadc1_browsingDll.dll
Size 163KB
Sample230811-w7tabaaa2s
SHA256 500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686
MD5 5ffc31841eb3b77f41f0ace61becd8fd
SHA1 87aa3c10f8a291fe4eceeb18e01a2aa1856966f3
SHA512 442e7d7537833a5ecdff6e5e892671376ee8e56b120a8c5dda32520e5fe499d85b7204d56637f4fd6e74f4cdf9e0e19efd80fe6d6bc8e118a73e9fa61ea444f6
SSDEEP 3072:pLZ+qJFCij+Qr2rSrkEKFGxofAZ2aw59XFmTiwiNhtlRLc:pLZ+qCij+Qr2P3FgB+53tnlRL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor sessionmanager

Malware Config

Signatures

Detected SessionManager backdoor 1 IoCs

backdoor

resource	yara_rule
sample	family_sessionmanager

Sessionmanager family
sessionmanager

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Iisbgfhaciadc1_browsingDll.dll

File Explorer

Iisbgfhaciadc1_browsingDll.dll

.dll 163KB

Iisbgfhaciadc1_browsingDll.dll

IMPHASH 37791ed07fb74bfe504edfe9d52f4e3a
SHA256 500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686
MD5 5ffc31841eb3b77f41f0ace61becd8fd
SHA1 87aa3c10f8a291fe4eceeb18e01a2aa1856966f3
SHA512 442e7d7537833a5ecdff6e5e892671376ee8e56b120a8c5dda32520e5fe499d85b7204d56637f4fd6e74f4cdf9e0e19efd80fe6d6bc8e118a73e9fa61ea444f6
SSDEEP 3072:pLZ+qJFCij+Qr2rSrkEKFGxofAZ2aw59XFmTiwiNhtlRLc:pLZ+qCij+Qr2P3FgB+53tnlRL
MD5 SHA1 SHA512 SSDEEP

windows x64

Detected SessionManager backdoor

backdoor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31288

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

OutputDebugStringA DebugBreak ReadFile CreatePipe GetLastError CloseHandle CreateProcessA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc DeleteFileW WriteFile GetConsoleCP GetConsoleMode GetStringTypeW GetACP ReadConsoleW GetStdHandle GetFileType LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CreateFileW SetStdHandle FlushFileBuffers SetFilePointerEx WriteConsoleW HeapSize HeapReAlloc SetEndOfFile

Name

.text

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Iisbgfhaciadc1_browsingDll.dll

kernel32