RegisterModule
Behavioral task
behavioral1
Sample
Iisbgfhaciadc1_browsingDll.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Iisbgfhaciadc1_browsingDll.dll
Resource
win10v2004-20230703-en
General
-
Target
Iisbgfhaciadc1_browsingDll.dll
-
Size
163KB
-
MD5
5ffc31841eb3b77f41f0ace61becd8fd
-
SHA1
87aa3c10f8a291fe4eceeb18e01a2aa1856966f3
-
SHA256
500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686
-
SHA512
442e7d7537833a5ecdff6e5e892671376ee8e56b120a8c5dda32520e5fe499d85b7204d56637f4fd6e74f4cdf9e0e19efd80fe6d6bc8e118a73e9fa61ea444f6
-
SSDEEP
3072:pLZ+qJFCij+Qr2rSrkEKFGxofAZ2aw59XFmTiwiNhtlRLc:pLZ+qCij+Qr2P3FgB+53tnlRL
Malware Config
Signatures
-
Detected SessionManager backdoor 1 IoCs
resource yara_rule sample family_sessionmanager -
Sessionmanager family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Iisbgfhaciadc1_browsingDll.dll
Files
-
Iisbgfhaciadc1_browsingDll.dll.dll windows x64
37791ed07fb74bfe504edfe9d52f4e3a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
OutputDebugStringA
DebugBreak
ReadFile
CreatePipe
GetLastError
CloseHandle
CreateProcessA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
DeleteFileW
WriteFile
GetConsoleCP
GetConsoleMode
GetStringTypeW
GetACP
ReadConsoleW
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
CreateFileW
SetStdHandle
FlushFileBuffers
SetFilePointerEx
WriteConsoleW
HeapSize
HeapReAlloc
SetEndOfFile
Exports
Exports
Sections
.text Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ