Static task
static1
Behavioral task
behavioral1
Sample
celestial.exe
Resource
win10-20230703-en
Behavioral task
behavioral2
Sample
celestial.exe
Resource
win10v2004-20230703-en
General
-
Target
celestial.exe
-
Size
2.8MB
-
MD5
03171af2784ba56cc259391b280846cc
-
SHA1
cb1527f52b5755ccf682ed26aa04726cfbb28225
-
SHA256
f18f6f57da6d01bb2c4267c53098d607bd4ed8d08148dac0102861a530d55638
-
SHA512
8504a145422aeebe30e419b5f113292cbe85df977dd317d896a7ca78e3e750f3b8dad1e36e07925c9723ce0a390fdf35fdb0d7f141a90723c208832c856af0c5
-
SSDEEP
49152:hToGtlqUIU6i8iRQ7bwZmwSyKWmw8m6ubV1un1oobBQ1meONPjoQTXpFAvg:ZW+8aQ7bwZflmyI1LQ1VOxo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource celestial.exe
Files
-
celestial.exe.exe windows x64
bb2dc3bc7687420c069319a83fac7a92
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetTickCount
FreeConsole
CreateThread
FormatMessageA
GetLocaleInfoEx
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
FindNextFileW
ReleaseSRWLockExclusive
GetModuleHandleW
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
GetTickCount64
FindClose
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
FindFirstFileW
VirtualFreeEx
SetUnhandledExceptionFilter
WriteProcessMemory
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryA
AcquireSRWLockExclusive
VirtualAllocEx
GetProcAddress
GetCurrentDirectoryW
LoadLibraryW
K32GetModuleInformation
Process32FirstW
LoadLibraryA
Process32NextW
GetFileAttributesA
GetModuleHandleA
GetCurrentProcess
WideCharToMultiByte
VirtualProtect
FreeLibrary
VerifyVersionInfoA
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
GetSystemTime
SystemTimeToFileTime
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
GetModuleHandleExW
FormatMessageW
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
Module32NextW
ReadProcessMemory
Module32FirstW
CreateToolhelp32Snapshot
GetProcessId
GetConsoleWindow
Sleep
SetConsoleTitleA
GetCurrentProcessId
CloseHandle
DeleteFileW
GetFileAttributesExW
GetLastError
OpenProcess
CreateFileW
lstrlenA
VirtualAlloc
VirtualFree
LocalFree
IsProcessorFeaturePresent
CreateDirectoryW
user32
GetWindowTextW
SetForegroundWindow
SetWindowsHookExW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetClassNameW
SendMessageA
EnumWindows
UnhookWindowsHookEx
GetForegroundWindow
IsWindowVisible
GetWindowThreadProcessId
GetCursorPos
FindWindowA
CreatePopupMenu
PostQuitMessage
AppendMenuW
LoadCursorW
MessageBoxA
GetMessageW
DefWindowProcW
GetWindowRect
LoadIconW
RegisterClassExW
TrackPopupMenu
DispatchMessageW
CreateWindowExA
TranslateMessage
ShowWindow
gdi32
GetStockObject
shell32
SHGetKnownFolderPath
Shell_NotifyIconW
ole32
StringFromGUID2
oleaut32
VariantClear
SysAllocString
SysFreeString
msvcp140
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
_Xtime_get_ticks
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?fail@ios_base@std@@QEBA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1_Lockit@std@@QEAA@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?bad@ios_base@std@@QEBA_NXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
dbghelp
SymUnloadModule64
SymInitializeW
SymLoadModuleExW
SymSetOptions
SymFromName
SymCleanup
urlmon
URLDownloadToFileW
ws2_32
getnameinfo
shutdown
WSAGetLastError
inet_pton
gethostname
select
WSASetLastError
freeaddrinfo
bind
ioctlsocket
recvfrom
connect
getpeername
getsockname
listen
getsockopt
getaddrinfo
htons
sendto
ntohs
setsockopt
WSAIoctl
WSAStartup
ntohl
accept
closesocket
recv
send
socket
__WSAFDIsSet
htonl
WSACleanup
wldap32
ord27
ord26
ord46
ord22
ord301
ord200
ord41
ord211
ord60
ord30
ord79
ord35
ord143
ord45
ord32
ord33
ord50
crypt32
CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertCloseStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
_CxxThrowException
memset
memcpy
strrchr
memmove
strstr
memcmp
memchr
wcsstr
__std_exception_destroy
__std_exception_copy
__std_terminate
strchr
__current_exception_context
__current_exception
api-ms-win-crt-heap-l1-1-0
realloc
_set_new_mode
calloc
_callnewh
malloc
free
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fflush
fclose
fgetc
__stdio_common_vfprintf
fwrite
fgetpos
setvbuf
_open
ungetc
fsetpos
fputc
_fseeki64
_get_stream_buffer_pointers
_close
_write
fopen
_read
_set_fmode
__p__commode
fputs
__stdio_common_vsscanf
fseek
fread
ftell
fgets
__stdio_common_vswprintf
_lseeki64
_wfopen
feof
setbuf
clearerr
_setmode
_fileno
ferror
__stdio_common_vsprintf
api-ms-win-crt-runtime-l1-1-0
terminate
exit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
system
_register_onexit_function
_errno
strerror_s
signal
_beginthreadex
__sys_nerr
strerror
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_invalid_parameter_noinfo_noreturn
raise
_crt_atexit
api-ms-win-crt-convert-l1-1-0
mbstowcs_s
strtoll
wcstombs_s
strtol
atoi
wcstombs
strtoull
strtod
_itoa_s
strtoul
api-ms-win-crt-filesystem-l1-1-0
_mkdir
_unlock_file
_stat64i32
_lock_file
_access
_fstat64i32
_fstat64
_stat64
api-ms-win-crt-string-l1-1-0
isupper
strspn
strcspn
_strnicmp
strcmp
_wcsicmp
_strdup
strpbrk
_stricmp
tolower
strncpy
strncmp
isspace
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_gmtime64
_gmtime64_s
_time64
_localtime64
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dclass
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
bcrypt
BCryptGenRandom
advapi32
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 674KB - Virtual size: 674KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ