sessionmanager | Iisbgfhaciadc2_browsingDll[.]dll

General

Target
Iisbgfhaciadc2_browsingDll.dll
Size 163KB
Sample230811-w7tabaga75
SHA256 2a0b83c316219ed8c7ce1d14edf09794fa76a71cb04348d2a332991f3fceab2b
MD5 84b20e95d52f38bb4f6c998719660c35
SHA1 9af6dde77c274af5384dfea76a414bc60a99c878
SHA512 56922ecf1cee78c8ec76bad9c5d6aec5c56bed9cfc025d66f1db5541023a962c9784b9708e82c5cb84ed828f053e15186fd7e0483666eaee111c4cbdcac81ea0
SSDEEP 3072:1LHuUlJiR+2h8DdMhUlHKoaQZTaw59X1mVXYYiNRoac:1LHuUiR+2hB+lqeR5BFRoa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor sessionmanager

Malware Config

Signatures

Detected SessionManager backdoor 1 IoCs

backdoor

resource	yara_rule
sample	family_sessionmanager

Sessionmanager family
sessionmanager

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Iisbgfhaciadc2_browsingDll.dll

File Explorer

Iisbgfhaciadc2_browsingDll.dll

.dll 163KB

Iisbgfhaciadc2_browsingDll.dll

IMPHASH 37791ed07fb74bfe504edfe9d52f4e3a
SHA256 2a0b83c316219ed8c7ce1d14edf09794fa76a71cb04348d2a332991f3fceab2b
MD5 84b20e95d52f38bb4f6c998719660c35
SHA1 9af6dde77c274af5384dfea76a414bc60a99c878
SHA512 56922ecf1cee78c8ec76bad9c5d6aec5c56bed9cfc025d66f1db5541023a962c9784b9708e82c5cb84ed828f053e15186fd7e0483666eaee111c4cbdcac81ea0
SSDEEP 3072:1LHuUlJiR+2h8DdMhUlHKoaQZTaw59X1mVXYYiNRoac:1LHuUiR+2hB+lqeR5BFRoa
MD5 SHA1 SHA512 SSDEEP

windows x64

Detected SessionManager backdoor

backdoor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31304

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

OutputDebugStringA DebugBreak ReadFile CreatePipe GetLastError CloseHandle CreateProcessA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc DeleteFileW WriteFile GetConsoleCP GetConsoleMode GetStringTypeW GetACP ReadConsoleW GetStdHandle GetFileType LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CreateFileW SetStdHandle FlushFileBuffers SetFilePointerEx WriteConsoleW HeapSize HeapReAlloc SetEndOfFile

Name

.text

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Iisbgfhaciadc2_browsingDll.dll

kernel32